1234321.exe "C:\Users\test22\AppData\Local\Temp\1234321.exe"
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\RarSFX0\1.bat" "
cmd.exe cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" 3.exe"
3.exe 3.exe
RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n /dde
splwow64.exe C:\Windows\splwow64.exe 12288
No process loaded Click on a process in the tree above to load its data.