NEW ORDER EXPO_51052 IMG00239876 SCANNED DOC_PDF.exe "C:\Users\test22\AppData\Local\Temp\NEW ORDER EXPO_51052 IMG00239876 SCANNED DOC_PDF.exe"
2100powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\NEW ORDER EXPO_51052 IMG00239876 SCANNED DOC_PDF.exe"
2200schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DAcGNoptwvSQI" /XML "C:\Users\test22\AppData\Local\Temp\tmp2A4.tmp"
508NEW ORDER EXPO_51052 IMG00239876 SCANNED DOC_PDF.exe "C:\Users\test22\AppData\Local\Temp\NEW ORDER EXPO_51052 IMG00239876 SCANNED DOC_PDF.exe"
1624schtasks.exe "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp4A7.tmp"
2712schtasks.exe "schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp5B2.tmp"
2604