findioc.ps1

$users = Get-ChildItem "c:\users" | Select-Object name
$users | ForEach-Object {
  $user = $($_.Name)
  $iocfile = "C:\Users\$($_.Name)\AppData\Roaming\somemalwarefile.tmp"
  if (Test-Path $iocfile){
      $filehash = get-filehash $iocfile | Select-Object -ExpandProperty hash
      $searchresults = "File found!"
         }
  else {
      $filehash = "No file to hash"
      $searchresults = "IOC not found"
       }
$thiscomputer = [system.environment]::MachineName
"$user,$thiscomputer,$searchresults,$filehash"
}