njrat | 38b3df0a5adac78245d2f4ea0411623537a8c354025617a91fbf3c9c92fe3c80

Analysis

max time kernel
149s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Equilotl.exe
Size 11.4MB
Sample261024-md58cayv3j
SHA256 38b3df0a5adac78245d2f4ea0411623537a8c354025617a91fbf3c9c92fe3c80
MD5 f2a7b629ac3c3d3196c624df9bc9081e
SHA1 7d59f476ecdb870d8a52cf03545bc20dce6e87b7
SHA512 95fc7540b23fe329f4f5fe1645e0b3faa933787733a14d0467ce3736f31b97f3ee417d6d18d98d24a37d0f12eeefca11b686aa04c24bb545b477b73d770cd38d
SSDEEP 98304:wgiE4Uz0FsinTWTMFcXmOZKWTz7yMcZSF7qAyLjUTEqdDuGG3pPVmryRIMdFR51A:wgA5R6HtZKWTDSUfdkDbfYL
TLSH
T138C66B87E8A614E8C1AAE5708573A633BB317C490B2527D71B90F6342F76FD05EBA710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hello discovery njrat trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

hello

127.0.0.1:3456

Mutex

system.exe

Attributes

reg_key
system.exe
splitter
|Ghost|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
1476	New Client_protected.exe
2040	New Client_protected.exe
2644	New Client_protected.exe
592	New Client_protected.exe
3152	New Client_protected.exe
2904	New Client_protected.exe
1052	New Client_protected.exe
1884	New Client_protected.exe
1888	New Client_protected.exe
3912	New Client_protected.exe
4168	New Client_protected.exe
3724	New Client_protected.exe
3920	New Client_protected.exe
3932	New Client_protected.exe
4768	New Client_protected.exe
5060	New Client_protected.exe
1236	New Client_protected.exe
1784	New Client_protected.exe
3800	New Client_protected.exe
3224	New Client_protected.exe
4220	New Client_protected.exe
1620	New Client_protected.exe
4296	New Client_protected.exe
2604	New Client_protected.exe
908	New Client_protected.exe
2452	New Client_protected.exe
2440	New Client_protected.exe
3972	New Client_protected.exe
344	New Client_protected.exe
4916	New Client_protected.exe
3200	New Client_protected.exe
1936	New Client_protected.exe
2996	New Client_protected.exe
3132	New Client_protected.exe
2076	New Client_protected.exe
4024	New Client_protected.exe
2960	New Client_protected.exe
1172	New Client_protected.exe
2544	New Client_protected.exe
2932	New Client_protected.exe
3932	New Client_protected.exe
2528	New Client_protected.exe
3396	New Client_protected.exe
1808	New Client_protected.exe
2028	New Client_protected.exe
1896	New Client_protected.exe
4364	New Client_protected.exe
4744	New Client_protected.exe
1152	New Client_protected.exe
4152	New Client_protected.exe
1476	New Client_protected.exe
540	New Client_protected.exe
2452	New Client_protected.exe
2932	New Client_protected.exe
2512	New Client_protected.exe
1532	New Client_protected.exe
4128	New Client_protected.exe
2924	New Client_protected.exe
2028	New Client_protected.exe
1592	New Client_protected.exe
4172	New Client_protected.exe
1564	New Client_protected.exe
4592	New Client_protected.exe
1308	New Client_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 1476	3560	Equilotl.exe	82
PID 3560 wrote to memory of 1976	3560	Equilotl.exe	83
PID 1976 wrote to memory of 2040	1976	Equilotl.exe	84
PID 1976 wrote to memory of 1316	1976	Equilotl.exe	85
PID 1316 wrote to memory of 2644	1316	Equilotl.exe	86
PID 1316 wrote to memory of 3312	1316	Equilotl.exe	87
PID 3312 wrote to memory of 592	3312	Equilotl.exe	88
PID 3312 wrote to memory of 244	3312	Equilotl.exe	89
PID 244 wrote to memory of 3152	244	Equilotl.exe	90
PID 244 wrote to memory of 964	244	Equilotl.exe	91
PID 964 wrote to memory of 2904	964	Equilotl.exe	92
PID 964 wrote to memory of 8	964	Equilotl.exe	93
PID 8 wrote to memory of 1052	8	Equilotl.exe	94
PID 8 wrote to memory of 4588	8	Equilotl.exe	95
PID 4588 wrote to memory of 1884	4588	Equilotl.exe	96
PID 4588 wrote to memory of 4968	4588	Equilotl.exe	97
PID 4968 wrote to memory of 1888	4968	Equilotl.exe	98
PID 4968 wrote to memory of 2888	4968	Equilotl.exe	99
PID 2888 wrote to memory of 3912	2888	Equilotl.exe	100
PID 2888 wrote to memory of 4480	2888	Equilotl.exe	101
PID 4480 wrote to memory of 4168	4480	Equilotl.exe	102
PID 4480 wrote to memory of 3400	4480	Equilotl.exe	103
PID 3400 wrote to memory of 3724	3400	Equilotl.exe	104
PID 3400 wrote to memory of 772	3400	Equilotl.exe	105
PID 772 wrote to memory of 3920	772	Equilotl.exe	106
PID 772 wrote to memory of 3844	772	Equilotl.exe	107
PID 3844 wrote to memory of 3932	3844	Equilotl.exe	108
PID 3844 wrote to memory of 3516	3844	Equilotl.exe	109
PID 3516 wrote to memory of 4768	3516	Equilotl.exe	110
PID 3516 wrote to memory of 3060	3516	Equilotl.exe	111
PID 3060 wrote to memory of 5060	3060	Equilotl.exe	112
PID 3060 wrote to memory of 1908	3060	Equilotl.exe	113
PID 1908 wrote to memory of 1236	1908	Equilotl.exe	114
PID 1908 wrote to memory of 4972	1908	Equilotl.exe	115
PID 4972 wrote to memory of 1784	4972	Equilotl.exe	116
PID 4972 wrote to memory of 4116	4972	Equilotl.exe	117
PID 4116 wrote to memory of 3800	4116	Equilotl.exe	118
PID 4116 wrote to memory of 2292	4116	Equilotl.exe	119
PID 2292 wrote to memory of 3224	2292	Equilotl.exe	120
PID 2292 wrote to memory of 1696	2292	Equilotl.exe	121
PID 1696 wrote to memory of 4220	1696	Equilotl.exe	122
PID 1696 wrote to memory of 4500	1696	Equilotl.exe	123
PID 4500 wrote to memory of 1620	4500	Equilotl.exe	124
PID 4500 wrote to memory of 4496	4500	Equilotl.exe	125
PID 4496 wrote to memory of 4296	4496	Equilotl.exe	126
PID 4496 wrote to memory of 1156	4496	Equilotl.exe	127
PID 1156 wrote to memory of 2604	1156	Equilotl.exe	128
PID 1156 wrote to memory of 3840	1156	Equilotl.exe	129
PID 3840 wrote to memory of 908	3840	Equilotl.exe	130
PID 3840 wrote to memory of 3408	3840	Equilotl.exe	131
PID 3408 wrote to memory of 2452	3408	Equilotl.exe	132
PID 3408 wrote to memory of 4320	3408	Equilotl.exe	133
PID 4320 wrote to memory of 2440	4320	Equilotl.exe	134
PID 4320 wrote to memory of 3632	4320	Equilotl.exe	135
PID 3632 wrote to memory of 3972	3632	Equilotl.exe	136
PID 3632 wrote to memory of 3760	3632	Equilotl.exe	137
PID 3760 wrote to memory of 344	3760	Equilotl.exe	138
PID 3760 wrote to memory of 128	3760	Equilotl.exe	139
PID 128 wrote to memory of 4916	128	Equilotl.exe	140
PID 128 wrote to memory of 4832	128	Equilotl.exe	141
PID 4832 wrote to memory of 3200	4832	Equilotl.exe	142
PID 4832 wrote to memory of 1900	4832	Equilotl.exe	143
PID 1900 wrote to memory of 1936	1900	Equilotl.exe	144
PID 1900 wrote to memory of 4660	1900	Equilotl.exe	145

C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
"C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
  "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
    "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
      "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        6⤵
        Executes dropped EXE
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        7⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        9⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        10⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        11⤵
        Executes dropped EXE
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        12⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        14⤵
        Executes dropped EXE
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        15⤵
        Executes dropped EXE
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        17⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        18⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        19⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        21⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        23⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        26⤵
        Executes dropped EXE
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        27⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        28⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        29⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        30⤵
        Executes dropped EXE
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:128
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        31⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        32⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        33⤵
        Executes dropped EXE
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        33⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        34⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        35⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        35⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        36⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        36⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        37⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        37⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        38⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        39⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        39⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        40⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        41⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        41⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        42⤵
        Executes dropped EXE
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        42⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        43⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        43⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        44⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        44⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        45⤵
        Executes dropped EXE
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        45⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        46⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        47⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        47⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        48⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        49⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        49⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        50⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        51⤵
        Executes dropped EXE
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        51⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        52⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        52⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        53⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        54⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        54⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        55⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        55⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        56⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        56⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        57⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        57⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        58⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        58⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        59⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        59⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        60⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        61⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        61⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        62⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        63⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        63⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        64⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        64⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        65⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        65⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        66⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        67⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        68⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        69⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        70⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        70⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        71⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        71⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        72⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        72⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        73⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        73⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        74⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        75⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        76⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        77⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        78⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        78⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        79⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        80⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        81⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        81⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        82⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        83⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        83⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        84⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        85⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        85⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        86⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        86⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        87⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        87⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        88⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        88⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        89⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        89⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        90⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        91⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        92⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        92⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        93⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        93⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:492
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        94⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        95⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        96⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        97⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        98⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        98⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        99⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        99⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        100⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        100⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        101⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        101⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        102⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        102⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        103⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        103⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        104⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        104⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        105⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        106⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        107⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        108⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        108⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        109⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        110⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        111⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        112⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        113⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        113⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        114⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        114⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        115⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        115⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        116⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        116⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        117⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        117⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        118⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        119⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        120⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        120⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        121⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        121⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        122⤵
        
        PID:72
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        122⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        123⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        124⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        124⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        125⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        126⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        126⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        127⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        127⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        128⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        129⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        129⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        130⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        130⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        131⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        132⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        132⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        133⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        133⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        134⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        135⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        135⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        136⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        136⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        137⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        137⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        138⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        138⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        139⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        140⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        141⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        142⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        142⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        143⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        143⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        144⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        145⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        146⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        147⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        148⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        148⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        149⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        150⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        150⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        151⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        151⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        152⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        153⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        153⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        154⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        154⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        155⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        156⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        157⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        157⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        158⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        158⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        159⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        159⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        160⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        160⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        161⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        162⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        163⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        163⤵
        
        PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Equilotl.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Equilotl.exe.log
Size 594B
SHA256 940a773e48b39e5986e29d7b7ff9f8d92318495d18192ffe80a4c8e9988def15
MD5 17d54af051d6e2279756e0394df4e94f
SHA1 c781de77a9d3f733c873e692288fdb28f0979d31
SHA512 2fc05b403c74d1a3fbd8f45a625b6d454abfb08e317fabf210b4a8fc1e0d08376fc781819e4feec4254bb5b84ab355e3cef524f93710fc0e1625c2e8f178fb77
TLSH
T146F02B303562A5D90D101B510C107FCAA3EF475ABBB88F0CBA65535CDD2B457D7126E7
MD5 SHA1 SHA512 TLSH

Submit Download

New Client_protected.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Client_protected.exe.log
Size 418B
SHA256 5180fcf7402ced58140b920bf818eab64613a0e0ded1091eebf14cb57a80590a
MD5 be0f156c1e85296aedb6a369aecaad79
SHA1 c6bf4a0ca9dedc89d3e5c80dc719b192a7fb2d68
SHA512 4968dd9c9647f15c9623736e207788e2a48bdd35419ef88b0a0563314baa373132093444280cb050c28ace657a22db703b55ba0803b1cb63232692cc6d3f0d2d
TLSH
T1D8E022303236A0D948123F910C093ACA91EF0787BB789F1D2A55675DCC35157AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

New Client_protected.exe

Path C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
Size 68KB
SHA256 8f34d1dc9ff476c5832e1a10a3266d0ff91eed84739bd8e77946601972f63de5
MD5 36e49fbc5138bf558c9b279b6702608e
SHA1 b466877cda3705fad5a3b7fe0af5e6112b908fb7
SHA512 cff1b8fea6efcee3c90b500e7626820535d01b09720b1efc369999432d1b8dc92438599077398566f13a923027bb1660ba041a77397fcef89643abcd769e2ad3
SSDEEP 1536:wKKzAaLPkYN7dqCjoDAbYX3A4xEMwLcv/RRPRJ33xprLXYiF9kTeVioILNaI:wKKzAab0Cjy3TxErLcHf3HrNF6yyRaI
TLSH
T1BF63F14CD6D64763FD0945F7B02052B35EAE86283E70CB97CBE15A0808DA6297343DF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-314-0x0000000000560000-0x0000000000576000-memory.dmp

Download

memory/344-315-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/540-502-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/592-74-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/592-73-0x0000000000530000-0x0000000000546000-memory.dmp

Download

memory/908-277-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1052-105-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1052-103-0x0000000000530000-0x0000000000546000-memory.dmp

Download

memory/1052-104-0x0000000000530000-0x0000000000546000-memory.dmp

Download

memory/1152-480-0x0000000000580000-0x0000000000596000-memory.dmp

Download

memory/1152-481-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1172-392-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1172-391-0x00000000005D0000-0x00000000005E6000-memory.dmp

Download

memory/1236-201-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1308-597-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1308-596-0x0000000002080000-0x0000000002096000-memory.dmp

Download

memory/1476-30-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1476-25-0x0000000002080000-0x0000000002096000-memory.dmp

Download

memory/1476-495-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1476-27-0x0000000004A80000-0x0000000005026000-memory.dmp

Download

memory/1476-26-0x0000000004880000-0x000000000491C000-memory.dmp

Download

memory/1532-534-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1532-533-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/1532-532-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/1564-580-0x0000000000520000-0x0000000000536000-memory.dmp

Download

memory/1564-581-0x0000000000520000-0x0000000000536000-memory.dmp

Download

memory/1564-582-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1592-566-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1620-680-0x0000000000500000-0x0000000000516000-memory.dmp

Download

memory/1620-681-0x0000000000500000-0x0000000000516000-memory.dmp

Download

memory/1620-248-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1784-210-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1792-649-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/1808-441-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1808-440-0x0000000000500000-0x0000000000516000-memory.dmp

Download

memory/1884-115-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1884-114-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/1888-124-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/1888-125-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1896-457-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1936-340-0x00000000005B0000-0x00000000005C6000-memory.dmp

Download

memory/1936-341-0x00000000005B0000-0x00000000005C6000-memory.dmp

Download

memory/1936-342-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1976-31-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-28-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-32-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-33-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-34-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-53-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-35-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-36-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-37-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-38-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-40-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/1976-39-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/2028-559-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2028-558-0x0000000000460000-0x0000000000476000-memory.dmp

Download

memory/2028-557-0x0000000000460000-0x0000000000476000-memory.dmp

Download

memory/2028-449-0x0000000000530000-0x0000000000546000-memory.dmp

Download

memory/2028-448-0x0000000000530000-0x0000000000546000-memory.dmp

Download

memory/2028-450-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2040-52-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2040-51-0x0000000001F40000-0x0000000001F56000-memory.dmp

Download

memory/2076-368-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2076-367-0x0000000002080000-0x0000000002096000-memory.dmp

Download

memory/2340-713-0x0000000000580000-0x0000000000596000-memory.dmp

Download

memory/2440-295-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2452-286-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2452-509-0x0000000001F40000-0x0000000001F56000-memory.dmp

Download

memory/2452-510-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2512-524-0x0000000000530000-0x0000000000546000-memory.dmp

Download

memory/2512-525-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2528-425-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2528-424-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/2544-400-0x0000000000460000-0x0000000000476000-memory.dmp

Download

memory/2544-401-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2544-399-0x0000000000460000-0x0000000000476000-memory.dmp

Download

memory/2604-267-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/2604-266-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/2604-268-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2644-62-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/2644-63-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/2644-64-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2904-94-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2924-549-0x0000000000540000-0x0000000000556000-memory.dmp

Download

memory/2924-550-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2932-408-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2932-517-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2960-384-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2996-351-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2996-349-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/2996-350-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/3004-657-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/3004-658-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/3132-358-0x0000000000490000-0x00000000004A6000-memory.dmp

Download

memory/3132-360-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3132-359-0x0000000000490000-0x00000000004A6000-memory.dmp

Download

memory/3152-84-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/3152-83-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/3152-85-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3168-626-0x0000000000560000-0x0000000000576000-memory.dmp

Download

memory/3168-627-0x0000000000560000-0x0000000000576000-memory.dmp

Download

memory/3200-333-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3224-230-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3396-433-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3396-432-0x00000000005D0000-0x00000000005E6000-memory.dmp

Download

memory/3560-22-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-6-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-1-0x000000001C130000-0x000000001C1D6000-memory.dmp

Download

memory/3560-2-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-3-0x000000001C7C0000-0x000000001CC8E000-memory.dmp

Download

memory/3560-4-0x000000001CD30000-0x000000001CDCC000-memory.dmp

Download

memory/3560-5-0x0000000000A60000-0x0000000000A68000-memory.dmp

Download

memory/3560-0-0x00007FFB5C4A5000-0x00007FFB5C4A6000-memory.dmp

Download

memory/3560-7-0x000000001CF10000-0x000000001CF5C000-memory.dmp

Download

memory/3560-8-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-24-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-9-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-13-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-12-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-11-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3560-10-0x00007FFB5C1F0000-0x00007FFB5CB91000-memory.dmp

Download

memory/3724-153-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3800-221-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3800-219-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/3800-220-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/3912-134-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3920-163-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3920-162-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/3932-172-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3932-415-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/3932-417-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3932-416-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/3972-304-0x0000000002080000-0x0000000002096000-memory.dmp

Download

memory/3972-305-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4024-377-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4024-375-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/4024-376-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/4076-689-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/4128-542-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4128-541-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/4152-488-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4168-144-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4168-143-0x0000000000490000-0x00000000004A6000-memory.dmp

Download

memory/4172-573-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4220-239-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4296-257-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4340-697-0x0000000000530000-0x0000000000546000-memory.dmp

Download

memory/4364-464-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4380-705-0x0000000000580000-0x0000000000596000-memory.dmp

Download

memory/4592-589-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4712-618-0x0000000002080000-0x0000000002096000-memory.dmp

Download

memory/4744-471-0x00000000006B0000-0x00000000006C6000-memory.dmp

Download

memory/4744-472-0x00000000006B0000-0x00000000006C6000-memory.dmp

Download

memory/4744-473-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4768-182-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4768-181-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/4916-324-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5060-191-0x0000000000540000-0x0000000000556000-memory.dmp

Download

memory/5060-192-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads