powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\arch.ps1
2564wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AnyClesk.vbs"
2764powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\test22\AppData\Roaming\AnyClesk.ps1"
2848csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\kdcxyvbi.cmdline"
2936cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES22E5.tmp" "c:\Users\test22\AppData\Local\Temp\CSC22D5.tmp"
2980