Powershell starts after every restart of the computer excluding rundll32.exe in behaviourmonitoring an exclusion extension dll
I will help you!
https://greatis.com/unhackme/help/kb/removal/what-is-the-help-in-removal-service.htm