ScriptBlockText:$env\:APPDATA* ScriptBlockText:function\ MainPayload* ScriptBlockText:\:\:WriteAllBytes* ScriptBlockText:wscript.exe*