docnic20230913.exe "C:\Users\test22\AppData\Local\Temp\docnic20230913.exe"
2592cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost"
2656cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
2692schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
2840cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\docnic20230913.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
2744