powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\.rree.txt.ps1
2596powershell.exe PowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\updata.ps1
152powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file C:\ProgramData\inst.ps1
2776schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 5 /tn updatarunom /tr C:\ProgramData\run.vbs
1456