svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
292cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\avast"
2972cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
3044schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
2392cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\svchost.exe" "C:\Users\test22\AppData\Roaming\avast\avast.exe"
2464svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
724cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\avast"
2132cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
2516schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
2780cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\svchost.exe" "C:\Users\test22\AppData\Roaming\avast\avast.exe"
2676cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost"
2708cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
2752schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
2908cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\docjhny20230925.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
2800