utility-inst.tmp "C:\Users\test22\AppData\Local\Temp\is-PE1DL.tmp\utility-inst.tmp" /SL5="$6012C,922170,832512,C:\Users\test22\AppData\Local\Temp\utility-inst.exe"
2620cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\do.bat""
2776powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1
2840explorer.exe C:\Windows\Explorer.EXE
1452