powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1
2648cmstp.exe "cmstp.exe" C:\Users\Public\user.inf /au
2828csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\itkkqgnw.cmdline"
2876cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESFB0A.tmp" "c:\Users\test22\AppData\Local\Temp\CSCFAFA.tmp"
2924