DarkPacked.tmp "C:\Users\test22\AppData\Local\Temp\is-9S7CV.tmp\DarkPacked.tmp" /SL5="$30028,2611883,845824,C:\Users\test22\AppData\Local\Temp\DarkPacked.exe"
2052cmd.exe "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\hcabfhf\bkfchbh
2188WMIC.exe wmic ComputerSystem get domain
2248