In the following pstree output, which process spawned cmd.exe,

which is not normal behavior? 

0x8b1b4680:dllhost.exe 356 520 2020-01-18 04:19:55 UTC+0000

. 0x89a412c0:csrss.exe 368 356 2020-01-18 04:19:48 UTC+0000 

.. 0x802f61c0:services.exe 520 448 2020-01-18 04:19:48 UTC+0000 

... 0x8ac77040:svchost.exe 628 520 2020-01-18 04:19:49 UTC+0000 

.. 0x802fc500:lsass.exe 528 448 2020-01-18 04:19:48 UTC+0000 

... 0x89766cc0:cmd.exe 920 528 2020-01-18 04:29:17 UTC+0000 

.... 0x896a8600:find.exe 1208 920 2020-01-18 04:31:27 UTC+0000