0153747ea9100eb2aa8d2b76a5ddf73d51a770c8c2f88e1430a8434dcaf3160a

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ST_Internal_Loader.exe
Size 15.0MB
Sample260809-wqredsbm2y
SHA256 0153747ea9100eb2aa8d2b76a5ddf73d51a770c8c2f88e1430a8434dcaf3160a
MD5 119e179c4c9cbaaa1bb21c7157dc6822
SHA1 9c740f35e9bdcf65f1b5e3e9e1156fb381519f95
SHA512 e59f3414c54b293308aad33ed87637f98e489a01f049707619448453ab9030a2aeda19ad4854be52464b7510544a94aab7026667e10ab0d468e28bd834cd5bd5
SSDEEP 393216:fD90+wLedGJlCTKVwLGg/1Xo6gMxLPhpfE7vE0akDyPo:r6+wLk2CT4QGg9XnHxTnc7vE0aKyPo
TLSH
T17CF633804F533D64ED9C237559AC956C220E81AB04FDC7B59A3639FF6EC9E6D010A8CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ST_Internal_Loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ST_Internal_Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ST_Internal_Loader.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ST_Internal_Loader.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ST_Internal_Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4228	cmd.exe
1884	cmd.exe
2544	cmd.exe
1988	cmd.exe
3876	cmd.exe
4108	cmd.exe
3284	cmd.exe
4440	cmd.exe
3508	cmd.exe
5884	cmd.exe
6044	cmd.exe
5736	cmd.exe
2156	cmd.exe
360	cmd.exe
1220	cmd.exe
5324	cmd.exe
2224	cmd.exe
3284	cmd.exe
5364	cmd.exe
1448	cmd.exe
4712	cmd.exe
1300	cmd.exe
3908	cmd.exe
484	cmd.exe
1088	cmd.exe
5508	cmd.exe
3564	cmd.exe
5908	cmd.exe
5760	cmd.exe
3868	cmd.exe
2608	cmd.exe
2092	cmd.exe
716	cmd.exe
4376	cmd.exe
1456	cmd.exe
6044	cmd.exe
5876	cmd.exe
2840	cmd.exe
2512	cmd.exe
4284	cmd.exe
3380	cmd.exe
5980	cmd.exe
5332	cmd.exe
4496	cmd.exe
3216	cmd.exe
4280	cmd.exe
5388	cmd.exe
2680	cmd.exe
4180	cmd.exe
5700	cmd.exe
1296	cmd.exe
5648	cmd.exe
1436	cmd.exe
2788	cmd.exe
4868	cmd.exe
4564	cmd.exe
2492	cmd.exe
4924	cmd.exe
1956	cmd.exe
1628	cmd.exe
2512	cmd.exe
3044	cmd.exe
4212	cmd.exe
4688	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe
5824	ST_Internal_Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 3588	5824	ST_Internal_Loader.exe	90
PID 5824 wrote to memory of 5704	5824	ST_Internal_Loader.exe	91
PID 5824 wrote to memory of 912	5824	ST_Internal_Loader.exe	93
PID 5824 wrote to memory of 1712	5824	ST_Internal_Loader.exe	94
PID 5824 wrote to memory of 5956	5824	ST_Internal_Loader.exe	96
PID 5824 wrote to memory of 2692	5824	ST_Internal_Loader.exe	98
PID 5824 wrote to memory of 5320	5824	ST_Internal_Loader.exe	100
PID 5824 wrote to memory of 1112	5824	ST_Internal_Loader.exe	102
PID 5824 wrote to memory of 1628	5824	ST_Internal_Loader.exe	104
PID 5824 wrote to memory of 5876	5824	ST_Internal_Loader.exe	106
PID 5824 wrote to memory of 5516	5824	ST_Internal_Loader.exe	108
PID 5824 wrote to memory of 5324	5824	ST_Internal_Loader.exe	110
PID 5824 wrote to memory of 4440	5824	ST_Internal_Loader.exe	112
PID 5824 wrote to memory of 3328	5824	ST_Internal_Loader.exe	114
PID 5824 wrote to memory of 256	5824	ST_Internal_Loader.exe	116
PID 5824 wrote to memory of 836	5824	ST_Internal_Loader.exe	118
PID 5824 wrote to memory of 5736	5824	ST_Internal_Loader.exe	120
PID 5824 wrote to memory of 4844	5824	ST_Internal_Loader.exe	122
PID 5824 wrote to memory of 4584	5824	ST_Internal_Loader.exe	124
PID 5824 wrote to memory of 5944	5824	ST_Internal_Loader.exe	126
PID 5824 wrote to memory of 5356	5824	ST_Internal_Loader.exe	128
PID 5824 wrote to memory of 1880	5824	ST_Internal_Loader.exe	130
PID 5824 wrote to memory of 4172	5824	ST_Internal_Loader.exe	132
PID 5824 wrote to memory of 3868	5824	ST_Internal_Loader.exe	134
PID 5824 wrote to memory of 1564	5824	ST_Internal_Loader.exe	136
PID 5824 wrote to memory of 2384	5824	ST_Internal_Loader.exe	138
PID 5824 wrote to memory of 5280	5824	ST_Internal_Loader.exe	140
PID 5824 wrote to memory of 3536	5824	ST_Internal_Loader.exe	142
PID 5824 wrote to memory of 3484	5824	ST_Internal_Loader.exe	144
PID 5824 wrote to memory of 1768	5824	ST_Internal_Loader.exe	146
PID 5824 wrote to memory of 4252	5824	ST_Internal_Loader.exe	148
PID 5824 wrote to memory of 1296	5824	ST_Internal_Loader.exe	150
PID 5824 wrote to memory of 5292	5824	ST_Internal_Loader.exe	152
PID 5824 wrote to memory of 4200	5824	ST_Internal_Loader.exe	154
PID 5824 wrote to memory of 3508	5824	ST_Internal_Loader.exe	156
PID 5824 wrote to memory of 1956	5824	ST_Internal_Loader.exe	158
PID 5824 wrote to memory of 1972	5824	ST_Internal_Loader.exe	160
PID 5824 wrote to memory of 2984	5824	ST_Internal_Loader.exe	162
PID 5824 wrote to memory of 4208	5824	ST_Internal_Loader.exe	164
PID 5824 wrote to memory of 5720	5824	ST_Internal_Loader.exe	166
PID 5824 wrote to memory of 3164	5824	ST_Internal_Loader.exe	168
PID 5824 wrote to memory of 4956	5824	ST_Internal_Loader.exe	170
PID 5824 wrote to memory of 4780	5824	ST_Internal_Loader.exe	172
PID 5824 wrote to memory of 4796	5824	ST_Internal_Loader.exe	174
PID 5824 wrote to memory of 1088	5824	ST_Internal_Loader.exe	176
PID 5824 wrote to memory of 5712	5824	ST_Internal_Loader.exe	178
PID 5824 wrote to memory of 1828	5824	ST_Internal_Loader.exe	180
PID 5824 wrote to memory of 1436	5824	ST_Internal_Loader.exe	182
PID 5824 wrote to memory of 4264	5824	ST_Internal_Loader.exe	184
PID 5824 wrote to memory of 2500	5824	ST_Internal_Loader.exe	186
PID 5824 wrote to memory of 4076	5824	ST_Internal_Loader.exe	188
PID 5824 wrote to memory of 4396	5824	ST_Internal_Loader.exe	190
PID 5824 wrote to memory of 3192	5824	ST_Internal_Loader.exe	192
PID 5824 wrote to memory of 828	5824	ST_Internal_Loader.exe	194
PID 5824 wrote to memory of 4548	5824	ST_Internal_Loader.exe	196
PID 5824 wrote to memory of 2164	5824	ST_Internal_Loader.exe	198
PID 5824 wrote to memory of 3216	5824	ST_Internal_Loader.exe	200
PID 5824 wrote to memory of 5700	5824	ST_Internal_Loader.exe	202
PID 5824 wrote to memory of 3516	5824	ST_Internal_Loader.exe	204
PID 5824 wrote to memory of 2932	5824	ST_Internal_Loader.exe	206
PID 5824 wrote to memory of 3424	5824	ST_Internal_Loader.exe	208
PID 5824 wrote to memory of 4516	5824	ST_Internal_Loader.exe	210
PID 5824 wrote to memory of 5668	5824	ST_Internal_Loader.exe	212
PID 5824 wrote to memory of 5956	5824	ST_Internal_Loader.exe	214

C:\Users\Admin\AppData\Local\Temp\ST_Internal_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\ST_Internal_Loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:6044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:8
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:52
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:6044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5824-0-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-3-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-2-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-4-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-5-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-6-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-7-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-8-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-9-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-10-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-11-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-12-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-13-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-14-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-15-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-16-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-17-0x0000000140000000-0x0000000142641000-memory.dmp

Download

memory/5824-18-0x0000000140000000-0x0000000142641000-memory.dmp

Download