---

Write-Host "`n===== STARTUP ====="
Get-CimInstance Win32_StartupCommand |
Select-Object Name, Command, Location, User | Format-List

Write-Host "`n===== SUSPICIOUS SERVICES ====="
Get-CimInstance Win32_Service |
Where-Object { $_.PathName -match 'AppData|Temp|WindowsOptions|powershell|wscript|mshta' } |
Select-Object Name, State, StartMode, PathName | Format-List

Write-Host "`n===== SUSPICIOUS SCHEDULED TASKS ====="
Get-ScheduledTask | ForEach-Object {
    $t = $_
    foreach ($a in $t.Actions) {
        if ("$($a.Execute) $($a.Arguments)" -match 'AppData|Temp|WindowsOptions|-EncodedCommand|FromBase64String') {
            [PSCustomObject]@{
                Task = "$($t.TaskPath)$($t.TaskName)"
                Execute = $a.Execute
                Arguments = $a.Arguments
            }
        }
    }
} | Format-List

Write-Host "`n===== DONE ====="