PS C:\Windows\system32> Get-CimInstance Win32_Process | Where-Object {$_.Name -like "gV1rlcFi" -or $_.CommandLine -like "gV1rlcFi"} | Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLine

ProcessId ParentProcessId ExecutablePath CommandLine

--------- --------------- -------------- -----------

15544 1532 C:\ProgramData\CNajTGHs\gV1rlcFi.exe "C:\ProgramData\CNajTGHs\gV1rlcFi.exe" 1776