wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\run.vbs"
812wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\ex.vbs"
8992wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\note.vbs"
5980cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\RarSFX0\del.bat" "
4716explorer.exe explorer.exe
6568