Hi man, I'm writing to you about the forensic emo challenge. I saw that you solved it, and i'would like to have few hints. I run in a VM in order to understand what was going on. I saw few DNS request towards htb sites but I think its a rabbit hole. Moreover, I saw a powershell with hidden and -ECOD. I was able to run it and I have seen also a file created under admin but it disappear almost immediately. I'm a bit stuck and I need some hints. could you please help me_