ScriptBlockText:\\SysAidServer\\tomcat\\webapps* ScriptBlockText:Starting\ user.exe* ScriptBlockText:\\usersfiles\\user.exe* ScriptBlockText:Remove\-Item\ \-Force\ \"$wapps* ScriptBlockText:\(Sophos\).*