Image:\\powershell.exe (CommandLine:http\:\/\/127.0.0.1* CommandLine:%\{\(IRM\ $_\)\}* CommandLine:Invoke*)