EmoCheck: start per Powershell und Eventlog

###### EDIT THESE VARIABLES ######
$path = "C:\scripts\emocheck" # without ending \  
$file = "emocheck_x64.exe" # emocheck_x64.exe or emocheck_x86.exe  
##################################

$fileExt = $file.Replace(".exe","")  
$time = Get-Date

#check if Eventlog exists
if ([system.diagnostics.eventlog]::SourceExists("EmoCheck") -eq $False) {  
	New-EventLog -LogName "Application" -Source "EmoCheck"  
}

#start scan
Start-Process -Filepath $path"\"$file -WorkingDirectory $path  

#check if emocheck is running. Otherwhise exit script
if ((Get-Process -name $fileExt) -eq $null){
    Write-EventLog -LogName "Application" -Source "EmoCheck" -EventID "1003" -EntryType "Error" -Message "Couldn't start emocheck. Please check your script." -Category 0  
    exit
}
#wait one seconds, until cmd is open
Start-Sleep -s 1
$cmd = Get-Process cmd | Where StartTime -gt $time | ForEach-Object {$_.ID} | Out-String

#wait few seconds, until the logs are written
Start-Sleep -s 30

#kill process because it waiting for a key input
Stop-Process -Name $fileExt
Stop-Process -Id $cmd

#get latest log file
$logfile = Get-ChildItem -Path $path"\*_emocheck.txt" | Sort-Object LastWriteTime -Descending | Select-Object -First 1  
$logfilePath = Join-Path -Path $path -Childpath $logfile.name
$content = Get-Content -Path $logfilePath
$contentEvent = $content | Out-String

#check if log file is available
if ($content -eq $null){
    Write-EventLog -LogName "Application" -Source "EmoCheck" -EventID "1003" -EntryType "Error" -Message "Couldn't read the log files. Please check your script."  
    exit
}

#check log
if ($content -like "No detection."){  
    Write-EventLog -LogName "Application" -Source "EmoCheck" -EventID "1000" -EntryType "Information" -Message $contentEvent -Category 0  
}
elseif ($content -like "Detected Emotet process."){  
    Write-EventLog -LogName "Application" -Source "EmoCheck" -EventID "1001" -EntryType "Critical" -Message $contentEvent -Category 0  
}
else
{
    $message = "Couldn't interpret the log files. Please check it manually: " + $logfilePath  
    Write-EventLog -LogName "Application" -Source "EmoCheck" -EventID "1002" -EntryType "Warning" -Message $message -Category 0  
}

#delete log files that are older than 30 days
Get-Childitem $path -include "*_emocheck.txt" -recurse | where {$_.lastwritetime -lt (get-date).adddays("-30") -and -not $_.psiscontainer} |% {remove-item $_.fullname -force -whatif}