Check the url.
/powershell-suspicious-script-with-screenshot-capabilities.html