2927.tmp "C:\Users\test22\AppData\Local\Temp\is-UQTRQ.tmp\2927.tmp" /SL5="$30028,922170,832512,C:\Users\test22\AppData\Local\Temp\2927.exe"
2056cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\test22\AppData\Local\Temp\is-1O625.tmp\my.bat""
2208powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1
2272explorer.exe C:\Windows\Explorer.EXE
1236