njrat | cff17719df8ce62727f832362988829ffc575033ed3baffc32c80bc6781ab5a7

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-02-2025 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Build.exe
Size

303KB
MD5

943f1a9d9d1004f015091cfaef192cfc
SHA1

4c9bd077fd554a2204afe6167af557be5b4d6d98
SHA256

cff17719df8ce62727f832362988829ffc575033ed3baffc32c80bc6781ab5a7
SHA512

95b302b47cbcd8464768a71b23374c4bb4dbb593bfdd07f725f173724e040914ea50172c2545c0f51bd698aaf98150a4d0e9babf7acef3defb81ffa04074141e
SSDEEP

6144:nW91vhKkCj65dFAiS6Gya/wJy4iyp8XMTqu+KBWMEVoldfda4V:WvvhXLyi8F/wyxORtsVo3fD

Score

10^/10

njrat umbral xworm hacked defense_evasion discovery execution persistence privilege_escalation rat stealer trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

so-cells.gl.at.ply.gg:9008

Mutex

79c62821fd77ed668d0ed2a55c141bb5

Attributes

reg_key
79c62821fd77ed668d0ed2a55c141bb5
splitter
|'|'|

Extracted

Family

xworm

global-bibliographic.gl.at.ply.gg:9002

Attributes

Install_directory
%AppData%
install_file
svhost.exe
telegram
https://api.telegram.org/bot7081348414:AAEQqhREW9-Pc1-aeS5a2NxfTFybIlvMOhk/sendMessage?chat_id=6426180826

Extracted

Family

umbral

https://discord.com/api/webhooks/1339322912536002621/cjxWA57MCZ9WLm3vYoHg8wnWFObRXMZVP6sbXKeSW43gVq_r2MVkefXJJqanTXSxTcE8

Signatures

Detect Umbral payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000019467-24.dat	family_umbral
behavioral1/memory/2704-26-0x00000000011A0000-0x00000000011E0000-memory.dmp	family_umbral
behavioral1/memory/1748-131-0x0000000001110000-0x0000000001150000-memory.dmp	family_umbral
behavioral1/memory/2300-135-0x0000000000A30000-0x0000000000A70000-memory.dmp	family_umbral

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0008000000019438-11.dat	family_xworm
behavioral1/memory/2644-16-0x0000000001320000-0x0000000001336000-memory.dmp	family_xworm
behavioral1/files/0x0006000000019496-23.dat	family_xworm
behavioral1/memory/2752-27-0x0000000000380000-0x0000000000396000-memory.dmp	family_xworm
behavioral1/memory/2260-125-0x0000000001340000-0x0000000001356000-memory.dmp	family_xworm

Njrat family
njrat
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1312	powershell.exe
3060	powershell.exe
3056	powershell.exe
1180	powershell.exe
2648	powershell.exe
2524	powershell.exe
2596	powershell.exe
1456	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2624	netsh.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	XClientfff.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	XClientfff.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	XClient43434324342.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79c62821fd77ed668d0ed2a55c141bb5.exe	svgost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79c62821fd77ed668d0ed2a55c141bb5.exe	svgost.exe

Executes dropped EXE 64 IoCs

pid	Process
2488	Server.exe
2644	XClient43434324342.exe
2704	Umbral.exe
2752	XClientfff.exe
2580	Server.exe
1136	XClient43434324342.exe
2812	Umbral.exe
2588	XClientfff.exe
940	Server.exe
2088	XClient43434324342.exe
1000	Umbral.exe
1536	XClientfff.exe
2784	Server.exe
2080	XClient43434324342.exe
2776	Umbral.exe
3044	XClientfff.exe
2568	svgost.exe
1608	Server.exe
1504	XClient43434324342.exe
2936	Umbral.exe
2660	XClientfff.exe
2244	Server.exe
1204	XClient43434324342.exe
912	Umbral.exe
920	XClientfff.exe
1648	svgost.exe
1076	Server.exe
2604	XClient43434324342.exe
3052	Umbral.exe
2600	XClientfff.exe
2808	Server.exe
2708	XClient43434324342.exe
2300	XClientfff.exe
1864	Umbral.exe
2084	Server.exe
1596	XClient43434324342.exe
2224	Umbral.exe
2912	XClientfff.exe
1740	Server.exe
1208	XClient43434324342.exe
2916	Umbral.exe
1752	XClientfff.exe
988	Server.exe
2560	XClient43434324342.exe
1176	XClientfff.exe
2672	Umbral.exe
1772	Server.exe
1896	XClient43434324342.exe
2140	Umbral.exe
3064	XClientfff.exe
1136	Server.exe
2836	XClient43434324342.exe
1984	Umbral.exe
2040	XClientfff.exe
2936	Server.exe
2680	XClient43434324342.exe
2152	XClientfff.exe
1264	Umbral.exe
2260	svhost.exe
1224	Server.exe
2380	XClient43434324342.exe
684	Umbral.exe
2800	XClientfff.exe
1328	Server.exe

Loads dropped DLL 2 IoCs

pid	Process
2488	Server.exe
2784	Server.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe"	XClientfff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe"	XClient43434324342.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\79c62821fd77ed668d0ed2a55c141bb5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svgost.exe\" .."	svgost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\79c62821fd77ed668d0ed2a55c141bb5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svgost.exe\" .."	svgost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com
26	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svgost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svgost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2960	schtasks.exe
2240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3056	powershell.exe
3060	powershell.exe
1180	powershell.exe
2648	powershell.exe
2596	powershell.exe
2524	powershell.exe
1456	powershell.exe
1312	powershell.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe
1648	svgost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1648	svgost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	XClient43434324342.exe
Token: SeDebugPrivilege	2752	XClientfff.exe
Token: SeDebugPrivilege	2704	Umbral.exe
Token: SeDebugPrivilege	1136	XClient43434324342.exe
Token: SeDebugPrivilege	2588	XClientfff.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	2088	XClient43434324342.exe
Token: SeDebugPrivilege	1536	XClientfff.exe
Token: SeDebugPrivilege	2752	XClientfff.exe
Token: SeDebugPrivilege	2644	XClient43434324342.exe
Token: SeDebugPrivilege	2080	XClient43434324342.exe
Token: SeDebugPrivilege	3044	XClientfff.exe
Token: SeDebugPrivilege	2660	XClientfff.exe
Token: SeDebugPrivilege	1504	XClient43434324342.exe
Token: SeDebugPrivilege	1204	XClient43434324342.exe
Token: SeDebugPrivilege	920	XClientfff.exe
Token: SeDebugPrivilege	2604	XClient43434324342.exe
Token: SeDebugPrivilege	2600	XClientfff.exe
Token: SeDebugPrivilege	2708	XClient43434324342.exe
Token: SeDebugPrivilege	2300	XClientfff.exe
Token: SeDebugPrivilege	1596	XClient43434324342.exe
Token: SeDebugPrivilege	2912	XClientfff.exe
Token: SeDebugPrivilege	1648	svgost.exe
Token: SeDebugPrivilege	1208	XClient43434324342.exe
Token: SeDebugPrivilege	1752	XClientfff.exe
Token: SeDebugPrivilege	1176	XClientfff.exe
Token: SeDebugPrivilege	2560	XClient43434324342.exe
Token: SeDebugPrivilege	1896	XClient43434324342.exe
Token: SeDebugPrivilege	3064	XClientfff.exe
Token: 33	1648	svgost.exe
Token: SeIncBasePriorityPrivilege	1648	svgost.exe
Token: SeDebugPrivilege	2040	XClientfff.exe
Token: SeDebugPrivilege	2836	XClient43434324342.exe
Token: SeDebugPrivilege	2680	XClient43434324342.exe
Token: SeDebugPrivilege	2152	XClientfff.exe
Token: SeDebugPrivilege	2260	svhost.exe
Token: SeDebugPrivilege	2380	XClient43434324342.exe
Token: SeDebugPrivilege	2800	XClientfff.exe
Token: 33	1648	svgost.exe
Token: SeIncBasePriorityPrivilege	1648	svgost.exe
Token: SeDebugPrivilege	996	XClient43434324342.exe
Token: SeDebugPrivilege	1964	XClientfff.exe
Token: SeDebugPrivilege	696	XClient43434324342.exe
Token: SeDebugPrivilege	1740	XClientfff.exe
Token: SeDebugPrivilege	2376	XClient43434324342.exe
Token: SeDebugPrivilege	1312	XClientfff.exe
Token: SeDebugPrivilege	2648	XClient43434324342.exe
Token: SeDebugPrivilege	1884	XClientfff.exe
Token: 33	1648	svgost.exe
Token: SeIncBasePriorityPrivilege	1648	svgost.exe
Token: SeDebugPrivilege	860	XClient43434324342.exe
Token: SeDebugPrivilege	580	XClientfff.exe
Token: SeDebugPrivilege	1752	XClientfff.exe
Token: SeDebugPrivilege	1196	XClient43434324342.exe
Token: SeDebugPrivilege	2416	XClient43434324342.exe
Token: SeDebugPrivilege	2392	XClientfff.exe
Token: SeDebugPrivilege	1896	XClient43434324342.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2488	2324	Build.exe	31
PID 2324 wrote to memory of 2488	2324	Build.exe	31
PID 2324 wrote to memory of 2488	2324	Build.exe	31
PID 2324 wrote to memory of 2488	2324	Build.exe	31
PID 2324 wrote to memory of 2644	2324	Build.exe	32
PID 2324 wrote to memory of 2644	2324	Build.exe	32
PID 2324 wrote to memory of 2644	2324	Build.exe	32
PID 2324 wrote to memory of 2836	2324	Build.exe	33
PID 2324 wrote to memory of 2836	2324	Build.exe	33
PID 2324 wrote to memory of 2836	2324	Build.exe	33
PID 2324 wrote to memory of 2704	2324	Build.exe	34
PID 2324 wrote to memory of 2704	2324	Build.exe	34
PID 2324 wrote to memory of 2704	2324	Build.exe	34
PID 2324 wrote to memory of 2752	2324	Build.exe	35
PID 2324 wrote to memory of 2752	2324	Build.exe	35
PID 2324 wrote to memory of 2752	2324	Build.exe	35
PID 2836 wrote to memory of 2580	2836	Build.exe	36
PID 2836 wrote to memory of 2580	2836	Build.exe	36
PID 2836 wrote to memory of 2580	2836	Build.exe	36
PID 2836 wrote to memory of 2580	2836	Build.exe	36
PID 2836 wrote to memory of 1136	2836	Build.exe	37
PID 2836 wrote to memory of 1136	2836	Build.exe	37
PID 2836 wrote to memory of 1136	2836	Build.exe	37
PID 2836 wrote to memory of 2764	2836	Build.exe	38
PID 2836 wrote to memory of 2764	2836	Build.exe	38
PID 2836 wrote to memory of 2764	2836	Build.exe	38
PID 2836 wrote to memory of 2812	2836	Build.exe	39
PID 2836 wrote to memory of 2812	2836	Build.exe	39
PID 2836 wrote to memory of 2812	2836	Build.exe	39
PID 2836 wrote to memory of 2588	2836	Build.exe	40
PID 2836 wrote to memory of 2588	2836	Build.exe	40
PID 2836 wrote to memory of 2588	2836	Build.exe	40
PID 2644 wrote to memory of 3056	2644	XClient43434324342.exe	41
PID 2644 wrote to memory of 3056	2644	XClient43434324342.exe	41
PID 2644 wrote to memory of 3056	2644	XClient43434324342.exe	41
PID 2752 wrote to memory of 3060	2752	XClientfff.exe	42
PID 2752 wrote to memory of 3060	2752	XClientfff.exe	42
PID 2752 wrote to memory of 3060	2752	XClientfff.exe	42
PID 2752 wrote to memory of 2648	2752	XClientfff.exe	45
PID 2752 wrote to memory of 2648	2752	XClientfff.exe	45
PID 2752 wrote to memory of 2648	2752	XClientfff.exe	45
PID 2644 wrote to memory of 1180	2644	XClient43434324342.exe	47
PID 2644 wrote to memory of 1180	2644	XClient43434324342.exe	47
PID 2644 wrote to memory of 1180	2644	XClient43434324342.exe	47
PID 2644 wrote to memory of 2596	2644	XClient43434324342.exe	49
PID 2644 wrote to memory of 2596	2644	XClient43434324342.exe	49
PID 2644 wrote to memory of 2596	2644	XClient43434324342.exe	49
PID 2752 wrote to memory of 2524	2752	XClientfff.exe	51
PID 2752 wrote to memory of 2524	2752	XClientfff.exe	51
PID 2752 wrote to memory of 2524	2752	XClientfff.exe	51
PID 2644 wrote to memory of 1456	2644	XClient43434324342.exe	53
PID 2644 wrote to memory of 1456	2644	XClient43434324342.exe	53
PID 2644 wrote to memory of 1456	2644	XClient43434324342.exe	53
PID 2752 wrote to memory of 1312	2752	XClientfff.exe	55
PID 2752 wrote to memory of 1312	2752	XClientfff.exe	55
PID 2752 wrote to memory of 1312	2752	XClientfff.exe	55
PID 2764 wrote to memory of 940	2764	Build.exe	57
PID 2764 wrote to memory of 940	2764	Build.exe	57
PID 2764 wrote to memory of 940	2764	Build.exe	57
PID 2764 wrote to memory of 940	2764	Build.exe	57
PID 2764 wrote to memory of 2088	2764	Build.exe	58
PID 2764 wrote to memory of 2088	2764	Build.exe	58
PID 2764 wrote to memory of 2088	2764	Build.exe	58
PID 2764 wrote to memory of 1888	2764	Build.exe	59

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Build.exe
"C:\Users\Admin\AppData\Local\Temp\Build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\svgost.exe
    "C:\Users\Admin\AppData\Local\Temp\svgost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2568
- C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient43434324342.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2960
- C:\Users\Admin\AppData\Local\Temp\Build.exe
  "C:\Users\Admin\AppData\Local\Temp\Build.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\Build.exe
    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Build.exe
      "C:\Users\Admin\AppData\Local\Temp\Build.exe"
      4⤵
      PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\svgost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svgost.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svgost.exe" "svgost.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        6⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        8⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        9⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        10⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        11⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        12⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        13⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        14⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        15⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        16⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        17⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        18⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        18⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        19⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        20⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        20⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        21⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        22⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        22⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        23⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        24⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        24⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        25⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        25⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        26⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        26⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        27⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        27⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        28⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        28⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        29⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        29⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        30⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        30⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        31⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        31⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        32⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        32⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        33⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        33⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        34⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        34⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        35⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        35⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        36⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        36⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        37⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        37⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        38⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        38⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        39⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        39⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        40⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        40⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        41⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        41⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        42⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        42⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        43⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        43⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        43⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        44⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        44⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        44⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        45⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        45⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        45⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        46⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        46⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        47⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        47⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        47⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        48⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        48⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        48⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        49⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        49⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        49⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        50⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        50⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        50⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        51⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        51⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        51⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        52⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        52⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        53⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        53⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        53⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        54⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        54⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        55⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        55⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        55⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        56⤵
        System Location Discovery: System Language Discovery
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        56⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        56⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        57⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        57⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        57⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        58⤵
        System Location Discovery: System Language Discovery
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        58⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        58⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        59⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        59⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        59⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        60⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        60⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        60⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        61⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        61⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        61⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        62⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        62⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        62⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        63⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        63⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        63⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        64⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        64⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        64⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        65⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        65⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        65⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        66⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        66⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        67⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        67⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        68⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        68⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        69⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        69⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        70⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        70⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        70⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        71⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        71⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        71⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        71⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        70⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        70⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        69⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        69⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        68⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        68⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        67⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        67⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        66⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        66⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        65⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        65⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        64⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        64⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        63⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        63⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        62⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        62⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        61⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        61⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        60⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        60⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        59⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        59⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        58⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        58⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        57⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        57⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        56⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        56⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        55⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        55⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        54⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        54⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        53⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        53⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        52⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        52⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        51⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        51⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        50⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        50⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        49⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        49⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        48⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        48⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        47⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        47⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        46⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        46⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        45⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        45⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        44⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        44⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        43⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        43⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        42⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        42⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        41⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        41⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        40⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        40⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        39⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        39⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        38⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        38⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        37⤵
        
        PID:2300
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        38⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        37⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        36⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        36⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        35⤵
        
        PID:1748
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        36⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        35⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        34⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        34⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        33⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        33⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        32⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        32⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        31⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        31⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        30⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        30⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        29⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        29⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        28⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        28⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        27⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        27⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        26⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        26⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        25⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        25⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        24⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        24⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        23⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        22⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        22⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        21⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        20⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        20⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        19⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        18⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        18⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        17⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        16⤵
        Executes dropped EXE
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        15⤵
        Executes dropped EXE
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        14⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        13⤵
        Executes dropped EXE
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        12⤵
        Executes dropped EXE
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        11⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        10⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        9⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        8⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        7⤵
        Executes dropped EXE
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        6⤵
        Executes dropped EXE
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        5⤵
        Executes dropped EXE
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      Executes dropped EXE
      PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Executes dropped EXE
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
    "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:1396
- C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClientfff.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClientfff.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2240

C:\Windows\system32\taskeng.exe
taskeng.exe {FEF8A0EF-DD3D-433D-975C-710D336693C6} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
PID:2812
- C:\Users\Admin\AppData\Roaming\svhost.exe
  C:\Users\Admin\AppData\Roaming\svhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Users\Admin\AppData\Roaming\svhost.exe
  C:\Users\Admin\AppData\Roaming\svhost.exe
  2⤵
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
37KB

MD5
06433fb629fe16ede789daf4cc9672fc

SHA1
3f50ab14968ca4a27d829879ed6401d702e07a95

SHA256
236ed2db1b36f9df626588a75c1175f9682acb5e8bd805ee03e95288ce6a0773

SHA512
adc41e0449d03cdbaeb37f77a82460e603c2bb3e6928bce26eb8619b55e6787f6e6b310b8243d0af1c6f91f0f0169577e6a75c905e818ba5c404316d5aa04f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
229KB

MD5
ff5f421f7aa82659d3634f37a7d7b11f

SHA1
ac6452bb8b7ff9e7a512633479a2f96f8edee0e3

SHA256
1fc234388fd421b35d6c2e7191aa28bf11878d4eccd4d6c832d3c42d5031d1ae

SHA512
05567755ccdef960ae9350a2a74a609e0337b7a870288d7bf10aeb582276a35a833b5c997cff99304f061ba56ab5d7c9a3fb86e3e990ba488e82fda4d7d0e293

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe

Filesize
66KB

MD5
5d4c47f2a4d4db8cd124dc5d6b4dbf41

SHA1
880e388eec83002ee9a647da67d2fcd48f942e58

SHA256
542809249b09dd0d3d00cfbf56275aa19ed02452ab2f57a0cd8521be87878c45

SHA512
cc7739f0163cb4f197821bd72882dabe5a48a088c42da41c7f3e44f3ac0caf9940c5408e832f41eca30b505291ddb131b70e00dec1b36d71e70bfdfab3c068c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClientfff.exe

Filesize
64KB

MD5
82a04b7c0c8c2870b409994e4894d240

SHA1
af9761264db29c14b7328ca336fc7c9921ce3c88

SHA256
3a2ac9aa83781a596819a4c6cd3087b32e8c70a2518cbd2f69499243e38723f2

SHA512
a5dbd672971121954522a8f1f9fe30c80ee65e70f3dd602e20e1b88d3c4e365953ef21cbe0d75438b49a14957242ede26f2ce508170d37aee99920f45556db97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5bf77f5099638a42a113cc85f075afa9

SHA1
8e5ba51a1e77e7af794555a34293fa16f1bce4e7

SHA256
8031f0f9922d41da0fd66b1880b2bc7aa324568a5224958ddb3c7ecbb9896a3e

SHA512
44443bc71402ca29170a1270eb86a1bee38a2aab657b322293c320ff164e2d92205e92ca204292b460f3c33844039dca710032d8fccb26a299694fbf3c08328a

Download Submit
memory/1180-52-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/1180-51-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/1748-131-0x0000000001110000-0x0000000001150000-memory.dmp

Filesize
256KB

Download
memory/2260-125-0x0000000001340000-0x0000000001356000-memory.dmp

Filesize
88KB

Download
memory/2300-135-0x0000000000A30000-0x0000000000A70000-memory.dmp

Filesize
256KB

Download
memory/2324-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/2324-28-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-12-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-1-0x000000013F6C0000-0x000000013F710000-memory.dmp

Filesize
320KB

Download
memory/2644-14-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-97-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-16-0x0000000001320000-0x0000000001336000-memory.dmp

Filesize
88KB

Download
memory/2704-26-0x00000000011A0000-0x00000000011E0000-memory.dmp

Filesize
256KB

Download
memory/2752-27-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/3056-43-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/3060-42-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download