AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2372aVUSfm8IjQeFpIY.exe "C:\Users\test22\AppData\Local\Temp\aVUSfm8IjQeFpIY.exe"
2996cmd.exe /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\aVUSfm8IjQeFpIY.exe" /tn "\WindowsAppPool\aVUSfm8IjQeFpIY"
792schtasks.exe schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\aVUSfm8IjQeFpIY.exe" /tn "\WindowsAppPool\aVUSfm8IjQeFpIY"
28483Tp00Kt.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\3Tp00Kt.exe
2600AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2756schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\test22\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
3036cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "test22:N"&&CACLS "explothe.exe" /P "test22:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "test22:N"&&CACLS "..\fefffe8cea" /P "test22:R" /E&&Exit
2104cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
2256cacls.exe CACLS "explothe.exe" /P "test22:N"
2520cacls.exe CACLS "explothe.exe" /P "test22:R" /E
2692cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
2752cacls.exe CACLS "..\fefffe8cea" /P "test22:N"
2864cacls.exe CACLS "..\fefffe8cea" /P "test22:R" /E
2968rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
15326kH8UT7.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\6kH8UT7.exe
2948cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\is64.bat" "
2400