Scheduled tasks

schtasks /query /fo LIST /v

Check permissions on binary

icacls C:\Users\john\Documents\Cleanup.exe

If permissions are sufficient (I F) replace with malicious binary