docyo20230926.exe "C:\Users\test22\AppData\Local\Temp\docyo20230926.exe"
2816svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
544RedLineClipperStub.exe "C:\Users\test22\AppData\Local\Temp\RedLineClipperStub.exe"
1852cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost"
2288cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
1848schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
2856cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\svchost.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
1380cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost"
2944cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
2996schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
2112cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\docyo20230926.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
3040