powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\wlanext.exe"
2760powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\CPxVTUqqImQPm.exe"
2820schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CPxVTUqqImQPm" /XML "C:\Users\test22\AppData\Local\Temp\tmp3B2F.tmp"
2876vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\bzktnpkfbbllxesuyz"
2196vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\ecqenhdhpkdyhkoypkkmx"
2224vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\owdwoaoacsvdkqckyufgaceo"
2552vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\jlrolyamqoaww"
2712vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\tfwhlrlnmwsbgfdu"
884vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\vhjrmjwhaekoilrysus"
1864