$(@%systemRoot%\system32\usocore.dll,-104) $(@%systemRoot%\system32\usocore.dll,-103) 1.0 $(@%systemRoot%\system32\usocore.dll,-105) \Microsoft\Windows\UpdateOrchestrator\Schedule Scan D:(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FA;;;BA) PT22H false 2016-06-06T06:14:20.488Z true PT4H true PT2H 7524BCA33E06830D 01 0 true <QueryList><Query Id="0" Path="System"><Select Path="System">*[System[EventID=8202]]</Select></Query></QueryList> S-1-5-18 LeastPrivilege IgnoreNew false false true true false true false false true false false false true false PT72H 7 %systemroot%\system32\usoclient.exe StartScan