For newer operating systems, events.exe creates task.xml as follows:  Then it creates a Windows scheduled task using the following command:       schtasks.exe /create /TN \"Events\\CacheTask_<user_name_here>" /XML \"<event_cache_dir_path>t /F"     At the system registry level, modules achieve persistence by adding themselves into the key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit when it finds possible add values to the Winlogon subkey, and in HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Activity Manager