powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\doc_00394039424.exe"
2764powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AZjibU.exe"
2824schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\test22\AppData\Local\Temp\tmp26AD.tmp"
2880powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Remcos\remcos.exe"
2204powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AZjibU.exe"
2264schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\test22\AppData\Local\Temp\tmp58C9.tmp"
2488iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2920 CREDAT:145409
2708iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2920 CREDAT:79875
2584svchost.exe svchost.exe
2124svchost.exe svchost.exe
148