Behavioral Analysis

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\85.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\_Sandboxie\lsass.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\logs\pw.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\pw.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\tmpvmqcut\lib\SearchIndexer.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\wininit.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Python27\click\click_image\sdclt.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\winlogon.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\KMSAuto_Net_2015_v1.4.2\readme\taskhost.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\tmp6o6lvv\modules\auxiliary\__pycache__\pw.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\mobsync.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\GPKI\dwm.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\audiodg.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\Idle.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\SystemRestore\explorer.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Python27\tcl\tcl8.5\http1.0\pw.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Sandbox\test22\DefaultBox\user\all\Microsoft\Windows\taskhost.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\pw.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\conhost.exe'

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\tmpvmqcut\modules\auxiliary\__pycache__\SearchIndexer.exe'

cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\test22\AppData\Local\Temp\G8We10AKzS.bat"