Overview

overview

10

Static

static

3

Build.exe

windows7-x64

10

Build.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-02-2025 15:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Build.exe

  • Size

    303KB

  • MD5

    943f1a9d9d1004f015091cfaef192cfc

  • SHA1

    4c9bd077fd554a2204afe6167af557be5b4d6d98

  • SHA256

    cff17719df8ce62727f832362988829ffc575033ed3baffc32c80bc6781ab5a7

  • SHA512

    95b302b47cbcd8464768a71b23374c4bb4dbb593bfdd07f725f173724e040914ea50172c2545c0f51bd698aaf98150a4d0e9babf7acef3defb81ffa04074141e

  • SSDEEP

    6144:nW91vhKkCj65dFAiS6Gya/wJy4iyp8XMTqu+KBWMEVoldfda4V:WvvhXLyi8F/wyxORtsVo3fD

Score
10/10
umbralxwormdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratstealertrojan

Malware Config

Extracted

Family

xworm

C2

global-bibliographic.gl.at.ply.gg:9002

Attributes
  • Install_directory

    %AppData%

  • install_file

    svhost.exe

  • telegram

    https://api.telegram.org/bot7081348414:AAEQqhREW9-Pc1-aeS5a2NxfTFybIlvMOhk/sendMessage?chat_id=6426180826

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 4 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Build.exe
    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Users\Admin\AppData\Local\Temp\svgost.exe
        "C:\Users\Admin\AppData\Local\Temp\svgost.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        PID:4036
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svgost.exe" "svgost.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1452
    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient43434324342.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1896
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4968
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4104
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4548
    • C:\Users\Admin\AppData\Local\Temp\Build.exe
      "C:\Users\Admin\AppData\Local\Temp\Build.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Users\Admin\AppData\Local\Temp\Server.exe
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3496
      • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2936
      • C:\Users\Admin\AppData\Local\Temp\Build.exe
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Users\Admin\AppData\Local\Temp\Server.exe
          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1660
        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4336
        • C:\Users\Admin\AppData\Local\Temp\Build.exe
          "C:\Users\Admin\AppData\Local\Temp\Build.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:388
          • C:\Users\Admin\AppData\Local\Temp\Server.exe
            "C:\Users\Admin\AppData\Local\Temp\Server.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2320
          • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
            "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:972
          • C:\Users\Admin\AppData\Local\Temp\Build.exe
            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
            5⤵
            • Checks computer location settings
            PID:4804
            • C:\Users\Admin\AppData\Local\Temp\Server.exe
              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2496
            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3528
            • C:\Users\Admin\AppData\Local\Temp\Build.exe
              "C:\Users\Admin\AppData\Local\Temp\Build.exe"
              6⤵
              • Checks computer location settings
              PID:2392
              • C:\Users\Admin\AppData\Local\Temp\Server.exe
                "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4332
              • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                7⤵
                • Executes dropped EXE
                PID:4124
              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                7⤵
                • Checks computer location settings
                PID:1932
                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2356
                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:3496
                • C:\Users\Admin\AppData\Local\Temp\Build.exe
                  "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                  8⤵
                  • Checks computer location settings
                  PID:1628
                  • C:\Users\Admin\AppData\Local\Temp\Server.exe
                    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1708
                  • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                    "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                    9⤵
                    • Executes dropped EXE
                    PID:956
                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                    9⤵
                    • Checks computer location settings
                    PID:4648
                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4224
                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                      10⤵
                      • Executes dropped EXE
                      PID:2172
                    • C:\Users\Admin\AppData\Local\Temp\Build.exe
                      "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                      10⤵
                      • Checks computer location settings
                      PID:1492
                      • C:\Users\Admin\AppData\Local\Temp\Server.exe
                        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3632
                      • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                        11⤵
                        • Executes dropped EXE
                        PID:1084
                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                        11⤵
                        • Checks computer location settings
                        PID:2828
                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1224
                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                          12⤵
                          • Executes dropped EXE
                          PID:4748
                        • C:\Users\Admin\AppData\Local\Temp\Build.exe
                          "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                          12⤵
                          • Checks computer location settings
                          PID:2880
                          • C:\Users\Admin\AppData\Local\Temp\Server.exe
                            "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4256
                          • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                            "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                            13⤵
                            • Executes dropped EXE
                            PID:828
                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                            13⤵
                            • Checks computer location settings
                            PID:2300
                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                              14⤵
                              • Executes dropped EXE
                              PID:4736
                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                              14⤵
                              • Executes dropped EXE
                              PID:2200
                            • C:\Users\Admin\AppData\Local\Temp\Build.exe
                              "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                              14⤵
                              • Checks computer location settings
                              PID:856
                              • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2688
                              • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                15⤵
                                • Executes dropped EXE
                                PID:2408
                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                15⤵
                                • Checks computer location settings
                                PID:2624
                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:4336
                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  PID:4624
                                • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                  16⤵
                                  • Checks computer location settings
                                  PID:4900
                                  • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:3188
                                  • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                    "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    PID:3972
                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                    17⤵
                                    • Checks computer location settings
                                    PID:968
                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3604
                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                      18⤵
                                        PID:2360
                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                        18⤵
                                        • Checks computer location settings
                                        PID:2440
                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4016
                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                          19⤵
                                            PID:828
                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                            19⤵
                                            • Checks computer location settings
                                            PID:4756
                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                              20⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2284
                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                              20⤵
                                                PID:4648
                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                20⤵
                                                • Checks computer location settings
                                                PID:2300
                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                  21⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3088
                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                  21⤵
                                                    PID:1808
                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                    21⤵
                                                    • Checks computer location settings
                                                    PID:3188
                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                      22⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3164
                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                      22⤵
                                                        PID:1860
                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                        22⤵
                                                        • Checks computer location settings
                                                        PID:3276
                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                          23⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:828
                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                          23⤵
                                                            PID:1876
                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                            23⤵
                                                            • Checks computer location settings
                                                            PID:4716
                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                              24⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1556
                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                              24⤵
                                                                PID:4640
                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                24⤵
                                                                • Checks computer location settings
                                                                PID:4544
                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                  25⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4368
                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                  25⤵
                                                                    PID:1532
                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                    25⤵
                                                                    • Checks computer location settings
                                                                    PID:4812
                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                      26⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1596
                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                      26⤵
                                                                        PID:4396
                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                        26⤵
                                                                        • Checks computer location settings
                                                                        PID:1544
                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                          27⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2412
                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                          27⤵
                                                                            PID:1272
                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                            27⤵
                                                                            • Checks computer location settings
                                                                            PID:1864
                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                              28⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2708
                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                              28⤵
                                                                                PID:4968
                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                28⤵
                                                                                • Checks computer location settings
                                                                                PID:1392
                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                  29⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3652
                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                  29⤵
                                                                                    PID:4336
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                    29⤵
                                                                                    • Checks computer location settings
                                                                                    PID:1556
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                      30⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4148
                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                      30⤵
                                                                                        PID:772
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                        30⤵
                                                                                        • Checks computer location settings
                                                                                        PID:1488
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                          31⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1004
                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                          31⤵
                                                                                            PID:3128
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                            31⤵
                                                                                            • Checks computer location settings
                                                                                            PID:932
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                              32⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2720
                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                              32⤵
                                                                                                PID:3164
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                32⤵
                                                                                                • Checks computer location settings
                                                                                                PID:4576
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                  33⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2916
                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                  33⤵
                                                                                                    PID:2372
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                    33⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:3316
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                      34⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3216
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                      34⤵
                                                                                                        PID:4560
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                        34⤵
                                                                                                        • Checks computer location settings
                                                                                                        PID:4012
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                          35⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2072
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                          35⤵
                                                                                                            PID:3816
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                            35⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:564
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                              36⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:5020
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                              36⤵
                                                                                                                PID:3556
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                36⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:3080
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                  37⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4428
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                  37⤵
                                                                                                                    PID:2348
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                    37⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:2392
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                      38⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4896
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                      38⤵
                                                                                                                        PID:516
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                        38⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:4560
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                          39⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:564
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                          39⤵
                                                                                                                            PID:4612
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                            39⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:3896
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                              40⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1900
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                              40⤵
                                                                                                                                PID:960
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                40⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:772
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                  41⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1168
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                  41⤵
                                                                                                                                    PID:1868
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                    41⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    PID:5056
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                      42⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2348
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                      42⤵
                                                                                                                                        PID:1848
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                        42⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:5012
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                          43⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1612
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                          43⤵
                                                                                                                                            PID:4336
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                            43⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            PID:824
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                              44⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2412
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                              44⤵
                                                                                                                                                PID:2300
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                44⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:3676
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                  45⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4600
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                  45⤵
                                                                                                                                                    PID:1220
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                    45⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:3460
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                      46⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4964
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                      46⤵
                                                                                                                                                        PID:2720
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                        46⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        PID:1760
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                          47⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:828
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                          47⤵
                                                                                                                                                            PID:2876
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                            47⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            PID:2708
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                              48⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4868
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                              48⤵
                                                                                                                                                                PID:2988
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                48⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                PID:2164
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                  49⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5020
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                  49⤵
                                                                                                                                                                    PID:208
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                    49⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    PID:2744
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                      50⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1664
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                      50⤵
                                                                                                                                                                        PID:4520
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                        50⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        PID:1272
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                          51⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3196
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                          51⤵
                                                                                                                                                                            PID:4884
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                            51⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            PID:1596
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                              52⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1200
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                              52⤵
                                                                                                                                                                                PID:4868
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                52⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                PID:2688
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                  53⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4176
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                  53⤵
                                                                                                                                                                                    PID:4276
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                    53⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    PID:4064
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                      54⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:2720
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                      54⤵
                                                                                                                                                                                        PID:1472
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                        54⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        PID:2440
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                          55⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4792
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                          55⤵
                                                                                                                                                                                            PID:3336
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                            55⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            PID:1164
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                              56⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4528
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                              56⤵
                                                                                                                                                                                                PID:960
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                56⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                PID:2164
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3152
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                      PID:3612
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                            PID:3744
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:828
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                PID:2076
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                PID:3204
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:388
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    PID:3912
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2916
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                            PID:3376
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                              PID:856
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              PID:452
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                  PID:4688
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  PID:1624
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3768
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe"
                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                      PID:1536
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Build.exe"
                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                        PID:960
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                          PID:4016
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                            PID:2496
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                            PID:1528
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                              PID:4904
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                PID:5060
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                  PID:3216
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                  PID:1864
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                    PID:412
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                    PID:2596
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                      PID:2124
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                          PID:2392
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                            PID:3096
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                              PID:388
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                              PID:1120
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                                PID:5060
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                PID:2232
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                  PID:908
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                    PID:1864
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                    PID:3208
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                      PID:1888
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                      PID:908
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                        PID:1584
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                                                          PID:2348
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                            PID:2972
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                              PID:4016
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                PID:388
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                PID:1164
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                                      PID:3892
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                        PID:2900
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                                                          PID:1392
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                          PID:2588
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                                            PID:1928
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                                                                            PID:972
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                              PID:644
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                PID:412
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                                                                PID:1200
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                  PID:5056
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                    "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                                                                                                      PID:1220
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                                                                                                        PID:3568
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                        PID:3612
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                          "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                            PID:3368
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                          33⤵
                                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                              "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                PID:3792
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                                                                PID:1864
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                PID:1556
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                  "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                                                                    PID:4004
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                    PID:3148
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                    PID:824
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                      "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                        PID:1532
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                        29⤵
                                                                                                                                                                                                                                                                                                                          PID:3616
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                          29⤵
                                                                                                                                                                                                                                                                                                                            PID:3280
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                                              PID:3184
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                                                              PID:3856
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                PID:4608
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                  PID:3828
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                25⤵
                                                                                                                                                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                  25⤵
                                                                                                                                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                    PID:380
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                                                                                                                                        PID:2688
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                        PID:3892
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                          PID:2900
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                            PID:3592
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                              PID:968
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3116
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3180
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  PID:388
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  PID:3804
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                PID:3188
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                PID:2996
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              PID:4180
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              PID:4104
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            PID:1708
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            PID:4772
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          PID:4648
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        PID:3216
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      PID:4988
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      PID:2576
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    PID:688
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                PID:516
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              PID:456
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                              PID:2300
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            PID:1728
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          PID:1040
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                          "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:208
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:932
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                          "wmic.exe" csproduct get uuid
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XClientfff.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                        PID:3492
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClientfff.exe'
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClientfff.exe'
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:4340
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:1852
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:3116
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                          PID:1940
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTQ1MjY3NTAtODc2RS00Q0ZELThFRUEtMDhDMkU1RkU5NDVFfSIgdXNlcmlkPSJ7NTZGRjhBMTAtMjkzNC00MTMxLUFCNkYtNjIxQTU1NDc1MjIyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjZFNEVGMjktN0Y3Mi00OEUxLUE2NkEtQTRBMzg5Qzc2MDA3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI4IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDMxNTUyMTUyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:3792
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:2084

                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1546.007

                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1546.007

                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                                                                        Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1016.001

                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.log
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          319B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          da4fafeffe21b7cb3a8c170ca7911976

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          50ef77e2451ab60f93f4db88325b897d215be5ad

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Build.exe.log
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          654B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Umbral.exe.log
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          8094b248fe3231e48995c2be32aeb08c

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          2fe06e000ebec919bf982d033c5d1219c1f916b6

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          944B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          47605a4dda32c9dff09a9ca441417339

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          4f68c895c35b0dc36257fc8251e70b968c560b62

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          e6254c2bc9846a76a4567ab91b6eae76e937307ff9301b65d577ffe6e15fe40a

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          b6823b6e794a2fe3e4c4ecfb3f0d61a54821de7feb4f9e3e7fd463e7fbb5e6848f59865b487dafebeac431e4f4db81ef56836d94cac67da39852c566ed34a885

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          944B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          da5c82b0e070047f7377042d08093ff4

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          89d05987cd60828cca516c5c40c18935c35e8bd3

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          944B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          37KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          06433fb629fe16ede789daf4cc9672fc

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          3f50ab14968ca4a27d829879ed6401d702e07a95

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          236ed2db1b36f9df626588a75c1175f9682acb5e8bd805ee03e95288ce6a0773

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          adc41e0449d03cdbaeb37f77a82460e603c2bb3e6928bce26eb8619b55e6787f6e6b310b8243d0af1c6f91f0f0169577e6a75c905e818ba5c404316d5aa04f0b

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          229KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          ff5f421f7aa82659d3634f37a7d7b11f

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          ac6452bb8b7ff9e7a512633479a2f96f8edee0e3

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          1fc234388fd421b35d6c2e7191aa28bf11878d4eccd4d6c832d3c42d5031d1ae

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          05567755ccdef960ae9350a2a74a609e0337b7a870288d7bf10aeb582276a35a833b5c997cff99304f061ba56ab5d7c9a3fb86e3e990ba488e82fda4d7d0e293

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClient43434324342.exe
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          66KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          5d4c47f2a4d4db8cd124dc5d6b4dbf41

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          880e388eec83002ee9a647da67d2fcd48f942e58

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          542809249b09dd0d3d00cfbf56275aa19ed02452ab2f57a0cd8521be87878c45

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          cc7739f0163cb4f197821bd72882dabe5a48a088c42da41c7f3e44f3ac0caf9940c5408e832f41eca30b505291ddb131b70e00dec1b36d71e70bfdfab3c068c0

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XClientfff.exe
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          82a04b7c0c8c2870b409994e4894d240

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          af9761264db29c14b7328ca336fc7c9921ce3c88

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          3a2ac9aa83781a596819a4c6cd3087b32e8c70a2518cbd2f69499243e38723f2

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          a5dbd672971121954522a8f1f9fe30c80ee65e70f3dd602e20e1b88d3c4e365953ef21cbe0d75438b49a14957242ede26f2ce508170d37aee99920f45556db97

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_foqxf5ew.qi4.ps1
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          60B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • memory/956-70-0x0000012374300000-0x0000012374322000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/3492-48-0x00000000002A0000-0x00000000002B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/4516-49-0x00007FF9BFEF0000-0x00007FF9C09B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/4516-68-0x00007FF9BFEF0000-0x00007FF9C09B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/4928-44-0x00007FF9BFEF0000-0x00007FF9C09B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/4928-43-0x00000000008C0000-0x00000000008D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/4928-189-0x00007FF9BFEF0000-0x00007FF9C09B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/5072-0-0x00007FF9BFEF3000-0x00007FF9BFEF5000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/5072-50-0x00007FF9BFEF0000-0x00007FF9C09B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/5072-7-0x00007FF9BFEF0000-0x00007FF9C09B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/5072-1-0x00000000008A0000-0x00000000008F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          320KB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/5116-42-0x0000017799DC0000-0x0000017799E00000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          256KB

                                                                                                                                                                                                                                                                                                                          Download