  In this case, the process tomcat.exe spawned multiple reconnaissance commands such as: whoami, systeminfo, arp, ipconfig, etc.  On top of that, a Base64-encoded PowerShell command was executed and retrieved a ransomware binary.