powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\XtmkLSmftnsk6TlB.exe"
2084powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\hcKaeuO.exe"
2416schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hcKaeuO" /XML "C:\Users\test22\AppData\Local\Temp\tmp18D6.tmp"
2948powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\hcKaeuO.exe"
2780powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\XtmkLSmftnsk6TlB.exe" -Force
2364powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d40985x850f7J2xq4181rcOfck8XYgbzLp35d2z94kn059G.exe" -Force
1124powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d40985x850f7J2xq4181rcOfck8XYgbzLp35d2z94kn059G.exe" -Force
3032d40985x850f7J2xq4181rcOfck8XYgbzLp35d2z94kn059G.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d40985x850f7J2xq4181rcOfck8XYgbzLp35d2z94kn059G.exe"
236powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\XtmkLSmftnsk6TlB.exe" -Force
1364powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\nbc38S293k9c4Rf2Yac\svchost.exe" -Force
604powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\XtmkLSmftnsk6TlB.exe" -Force
1556powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\nbc38S293k9c4Rf2Yac\svchost.exe" -Force
2164