Check for strange exe (service/task/startup)

Hunt for unusual or custom-named binaries registered as services, tasks, or startup entries. A non-standard executable often points to a vulnerable third-party or homemade service.