---

Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'AppData|Temp|WindowsOptions|powershell|wscript|mshta'
} | Select-Object Name, State, StartMode, PathName | Format-List