wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\_Lzqtfofnnzmk.vbs"
3624powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chromee\chromee.exe'
4368new.exe C:\Users\test22\AppData\Local\Temp\new.exe
7664