powershell.exe powershell Add-MpPreference -ExclusionPath C:\
8064cmd.exe cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
3660reg.exe REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
1888powershell.exe powershell Add-MpPreference -ExclusionPath C:\
9024cmd.exe "C:\Windows\System32\cmd.exe"
4004explorer.exe C:\Windows\Explorer.EXE
1848