njrat | 38b3df0a5adac78245d2f4ea0411623537a8c354025617a91fbf3c9c92fe3c80

Analysis

max time kernel
113s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Equilotl.exe
Size 11.4MB
Sample261024-md58cayv3j
SHA256 38b3df0a5adac78245d2f4ea0411623537a8c354025617a91fbf3c9c92fe3c80
MD5 f2a7b629ac3c3d3196c624df9bc9081e
SHA1 7d59f476ecdb870d8a52cf03545bc20dce6e87b7
SHA512 95fc7540b23fe329f4f5fe1645e0b3faa933787733a14d0467ce3736f31b97f3ee417d6d18d98d24a37d0f12eeefca11b686aa04c24bb545b477b73d770cd38d
SSDEEP 98304:wgiE4Uz0FsinTWTMFcXmOZKWTz7yMcZSF7qAyLjUTEqdDuGG3pPVmryRIMdFR51A:wgA5R6HtZKWTDSUfdkDbfYL
TLSH
T138C66B87E8A614E8C1AAE5708573A633BB317C490B2527D71B90F6342F76FD05EBA710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hello discovery njrat trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

hello

127.0.0.1:3456

Mutex

system.exe

Attributes

reg_key
system.exe
splitter
|Ghost|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
5780	New Client_protected.exe
4628	New Client_protected.exe
5884	New Client_protected.exe
264	New Client_protected.exe
2840	New Client_protected.exe
3156	New Client_protected.exe
4372	New Client_protected.exe
5792	New Client_protected.exe
6016	New Client_protected.exe
5748	New Client_protected.exe
3752	New Client_protected.exe
4620	New Client_protected.exe
4280	New Client_protected.exe
5800	New Client_protected.exe
5096	New Client_protected.exe
5456	New Client_protected.exe
3988	New Client_protected.exe
4932	New Client_protected.exe
5740	New Client_protected.exe
868	New Client_protected.exe
200	New Client_protected.exe
2252	New Client_protected.exe
1616	New Client_protected.exe
2396	New Client_protected.exe
1884	New Client_protected.exe
4344	New Client_protected.exe
2152	New Client_protected.exe
3572	New Client_protected.exe
5140	New Client_protected.exe
3684	New Client_protected.exe
2596	New Client_protected.exe
5680	New Client_protected.exe
1812	New Client_protected.exe
5056	New Client_protected.exe
4792	New Client_protected.exe
6056	New Client_protected.exe
868	New Client_protected.exe
4772	New Client_protected.exe
1900	New Client_protected.exe
1816	New Client_protected.exe
2924	New Client_protected.exe
2060	New Client_protected.exe
3732	New Client_protected.exe
3192	New Client_protected.exe
3348	New Client_protected.exe
1836	New Client_protected.exe
5200	New Client_protected.exe
124	New Client_protected.exe
3528	New Client_protected.exe
3900	New Client_protected.exe
3440	New Client_protected.exe
5056	New Client_protected.exe
4792	New Client_protected.exe
5836	New Client_protected.exe
5964	New Client_protected.exe
2252	New Client_protected.exe
1816	New Client_protected.exe
3108	New Client_protected.exe
2040	New Client_protected.exe
5980	New Client_protected.exe
4344	New Client_protected.exe
3348	New Client_protected.exe
4376	New Client_protected.exe
4348	New Client_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client_protected.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5780	4728	Equilotl.exe	89
PID 4728 wrote to memory of 4568	4728	Equilotl.exe	90
PID 4568 wrote to memory of 4628	4568	Equilotl.exe	91
PID 4568 wrote to memory of 4340	4568	Equilotl.exe	92
PID 4340 wrote to memory of 5884	4340	Equilotl.exe	93
PID 4340 wrote to memory of 1152	4340	Equilotl.exe	94
PID 1152 wrote to memory of 264	1152	Equilotl.exe	95
PID 1152 wrote to memory of 2556	1152	Equilotl.exe	96
PID 2556 wrote to memory of 2840	2556	Equilotl.exe	97
PID 2556 wrote to memory of 6060	2556	Equilotl.exe	98
PID 6060 wrote to memory of 3156	6060	Equilotl.exe	99
PID 6060 wrote to memory of 5340	6060	Equilotl.exe	100
PID 5340 wrote to memory of 4372	5340	Equilotl.exe	101
PID 5340 wrote to memory of 2964	5340	Equilotl.exe	102
PID 2964 wrote to memory of 5792	2964	Equilotl.exe	103
PID 2964 wrote to memory of 904	2964	Equilotl.exe	104
PID 904 wrote to memory of 6016	904	Equilotl.exe	105
PID 904 wrote to memory of 2100	904	Equilotl.exe	106
PID 2100 wrote to memory of 5748	2100	Equilotl.exe	107
PID 2100 wrote to memory of 4896	2100	Equilotl.exe	108
PID 4896 wrote to memory of 3752	4896	Equilotl.exe	110
PID 4896 wrote to memory of 5156	4896	Equilotl.exe	111
PID 5156 wrote to memory of 4620	5156	Equilotl.exe	112
PID 5156 wrote to memory of 1672	5156	Equilotl.exe	113
PID 1672 wrote to memory of 4280	1672	Equilotl.exe	114
PID 1672 wrote to memory of 3196	1672	Equilotl.exe	115
PID 3196 wrote to memory of 5800	3196	Equilotl.exe	116
PID 3196 wrote to memory of 2856	3196	Equilotl.exe	117
PID 2856 wrote to memory of 5096	2856	Equilotl.exe	118
PID 2856 wrote to memory of 772	2856	Equilotl.exe	119
PID 772 wrote to memory of 5456	772	Equilotl.exe	120
PID 772 wrote to memory of 3224	772	Equilotl.exe	121
PID 3224 wrote to memory of 3988	3224	Equilotl.exe	122
PID 3224 wrote to memory of 4504	3224	Equilotl.exe	123
PID 4504 wrote to memory of 4932	4504	Equilotl.exe	124
PID 4504 wrote to memory of 2008	4504	Equilotl.exe	125
PID 2008 wrote to memory of 5740	2008	Equilotl.exe	126
PID 2008 wrote to memory of 1524	2008	Equilotl.exe	127
PID 1524 wrote to memory of 868	1524	Equilotl.exe	128
PID 1524 wrote to memory of 1380	1524	Equilotl.exe	129
PID 1380 wrote to memory of 200	1380	Equilotl.exe	130
PID 1380 wrote to memory of 2180	1380	Equilotl.exe	131
PID 2180 wrote to memory of 2252	2180	Equilotl.exe	132
PID 2180 wrote to memory of 3512	2180	Equilotl.exe	133
PID 3512 wrote to memory of 1616	3512	Equilotl.exe	134
PID 3512 wrote to memory of 916	3512	Equilotl.exe	135
PID 916 wrote to memory of 2396	916	Equilotl.exe	136
PID 916 wrote to memory of 1172	916	Equilotl.exe	137
PID 1172 wrote to memory of 1884	1172	Equilotl.exe	138
PID 1172 wrote to memory of 3444	1172	Equilotl.exe	139
PID 3444 wrote to memory of 4344	3444	Equilotl.exe	140
PID 3444 wrote to memory of 3560	3444	Equilotl.exe	141
PID 3560 wrote to memory of 2152	3560	Equilotl.exe	142
PID 3560 wrote to memory of 2324	3560	Equilotl.exe	143
PID 2324 wrote to memory of 3572	2324	Equilotl.exe	144
PID 2324 wrote to memory of 5944	2324	Equilotl.exe	145
PID 5944 wrote to memory of 5140	5944	Equilotl.exe	146
PID 5944 wrote to memory of 4000	5944	Equilotl.exe	147
PID 4000 wrote to memory of 3684	4000	Equilotl.exe	148
PID 4000 wrote to memory of 4232	4000	Equilotl.exe	149
PID 4232 wrote to memory of 2596	4232	Equilotl.exe	150
PID 4232 wrote to memory of 1772	4232	Equilotl.exe	151
PID 1772 wrote to memory of 5680	1772	Equilotl.exe	152
PID 1772 wrote to memory of 5388	1772	Equilotl.exe	153

C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
"C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
  2⤵
  - Executes dropped EXE
  PID:5780
- C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
  "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
    "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
      "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        5⤵
        Executes dropped EXE
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        9⤵
        Executes dropped EXE
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        11⤵
        Executes dropped EXE
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        12⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        14⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        20⤵
        Executes dropped EXE
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        25⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        29⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        33⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        34⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        35⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        35⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        36⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        37⤵
        Executes dropped EXE
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        37⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        38⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        39⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        40⤵
        Executes dropped EXE
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        40⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        41⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        42⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        43⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        43⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        44⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        45⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        46⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        47⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        48⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        49⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        50⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        51⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        52⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        53⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        54⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        55⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        56⤵
        Executes dropped EXE
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        56⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        57⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        58⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        59⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        60⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        61⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        62⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        63⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        64⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        65⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        65⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        66⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        67⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        68⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        68⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        69⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        70⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        71⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        71⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        72⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        72⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        73⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        74⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        75⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        76⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        77⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        78⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        79⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        80⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        81⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        82⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        82⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        83⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        83⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        84⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        85⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        85⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        86⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        86⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        87⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        88⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        88⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        89⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        89⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        90⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        90⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        91⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        91⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        92⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        92⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        93⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        93⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        94⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        94⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        95⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        95⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        96⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        96⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        97⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        97⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        98⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        98⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        99⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        99⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        100⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        100⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        101⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        101⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        102⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        102⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        103⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        103⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        104⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        104⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        105⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        105⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        106⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        106⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        107⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        107⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        108⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        108⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        109⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        109⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        110⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        110⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        111⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        111⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        112⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        112⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        113⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        113⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        114⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        114⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        115⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        115⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        116⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        116⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        117⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        117⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        118⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        118⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        119⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        119⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        120⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        120⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        121⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        121⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        122⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        122⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        123⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        123⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        124⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        124⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        125⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        125⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe"
        126⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Equilotl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Equilotl.exe"
        126⤵
        
        PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

New Client_protected.exe

Path C:\Users\Admin\AppData\Local\Temp\New Client_protected.exe
Size 68KB
SHA256 8f34d1dc9ff476c5832e1a10a3266d0ff91eed84739bd8e77946601972f63de5
MD5 36e49fbc5138bf558c9b279b6702608e
SHA1 b466877cda3705fad5a3b7fe0af5e6112b908fb7
SHA512 cff1b8fea6efcee3c90b500e7626820535d01b09720b1efc369999432d1b8dc92438599077398566f13a923027bb1660ba041a77397fcef89643abcd769e2ad3
SSDEEP 1536:wKKzAaLPkYN7dqCjoDAbYX3A4xEMwLcv/RRPRJ33xprLXYiF9kTeVioILNaI:wKKzAab0Cjy3TxErLcHf3HrNF6yyRaI
TLSH
T1BF63F14CD6D64763FD0945F7B02052B35EAE86283E70CB97CBE15A0808DA6297343DF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-473-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/124-472-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/200-245-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/200-243-0x00000000004A0000-0x00000000004B6000-memory.dmp

Download

memory/200-244-0x00000000004A0000-0x00000000004B6000-memory.dmp

Download

memory/264-71-0x00000000006F0000-0x0000000000706000-memory.dmp

Download

memory/264-72-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/868-389-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/868-234-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/868-233-0x0000000001FE0000-0x0000000001FF6000-memory.dmp

Download

memory/1616-265-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1616-264-0x0000000000510000-0x0000000000526000-memory.dmp

Download

memory/1812-358-0x00000000004F0000-0x0000000000506000-memory.dmp

Download

memory/1812-359-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1816-543-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/1816-413-0x0000000000550000-0x0000000000566000-memory.dmp

Download

memory/1816-414-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1816-544-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1836-458-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1884-283-0x0000000001FA0000-0x0000000001FB6000-memory.dmp

Download

memory/1884-284-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1900-404-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/1900-406-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1900-405-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/1996-616-0x0000000000630000-0x0000000000646000-memory.dmp

Download

memory/2040-561-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2040-559-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/2040-560-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/2060-428-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2152-302-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/2152-303-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2252-534-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/2252-535-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/2252-536-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2252-254-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/2252-255-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2396-274-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2596-340-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2840-81-0x00000000004A0000-0x00000000004B6000-memory.dmp

Download

memory/2840-83-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2840-82-0x00000000004A0000-0x00000000004B6000-memory.dmp

Download

memory/2924-421-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3108-551-0x0000000000730000-0x0000000000746000-memory.dmp

Download

memory/3108-552-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3156-92-0x0000000001FA0000-0x0000000001FB6000-memory.dmp

Download

memory/3156-93-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3192-443-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3348-450-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/3348-451-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3348-583-0x0000000000500000-0x0000000000516000-memory.dmp

Download

memory/3348-584-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3440-494-0x0000000000630000-0x0000000000646000-memory.dmp

Download

memory/3440-495-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3528-480-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3572-312-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3684-331-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3684-330-0x0000000001FA0000-0x0000000001FB6000-memory.dmp

Download

memory/3732-435-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/3732-436-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3752-143-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3752-142-0x0000000001FB0000-0x0000000001FC6000-memory.dmp

Download

memory/3900-487-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3988-203-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/3988-204-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4200-631-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/4200-632-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/4280-161-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4344-576-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4344-293-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4344-575-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/4348-599-0x00000000006F0000-0x0000000000706000-memory.dmp

Download

memory/4348-600-0x00000000006F0000-0x0000000000706000-memory.dmp

Download

memory/4348-601-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4356-641-0x0000000000710000-0x0000000000726000-memory.dmp

Download

memory/4356-640-0x0000000000710000-0x0000000000726000-memory.dmp

Download

memory/4372-103-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4372-102-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/4376-591-0x0000000001FA0000-0x0000000001FB6000-memory.dmp

Download

memory/4376-592-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4568-36-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-33-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-39-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-38-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-34-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-27-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-31-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-52-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-28-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-37-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4568-40-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4620-152-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4628-51-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4628-50-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/4728-17-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-14-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-4-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-9-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-8-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-41-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-0-0x00007FF9CAF6A000-0x00007FF9CAF6B000-memory.dmp

Download

memory/4728-11-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-16-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-15-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-7-0x000000001CAA0000-0x000000001CAEC000-memory.dmp

Download

memory/4728-12-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-13-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-1-0x000000001BCA0000-0x000000001BD46000-memory.dmp

Download

memory/4728-10-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-26-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-6-0x0000000002F50000-0x0000000002F58000-memory.dmp

Download

memory/4728-5-0x000000001C800000-0x000000001C89C000-memory.dmp

Download

memory/4728-2-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/4728-3-0x000000001C290000-0x000000001C75E000-memory.dmp

Download

memory/4772-397-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4772-396-0x00000000020F0000-0x0000000002106000-memory.dmp

Download

memory/4792-511-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4792-510-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/4792-374-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4792-373-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/4932-214-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4932-213-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/5056-503-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5056-502-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/5056-366-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5096-183-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5096-182-0x00000000005C0000-0x00000000005D6000-memory.dmp

Download

memory/5096-181-0x00000000005C0000-0x00000000005D6000-memory.dmp

Download

memory/5140-321-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5200-465-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5456-194-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5456-192-0x00000000004F0000-0x0000000000506000-memory.dmp

Download

memory/5456-193-0x00000000004F0000-0x0000000000506000-memory.dmp

Download

memory/5476-608-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/5680-349-0x00000000006F0000-0x0000000000706000-memory.dmp

Download

memory/5680-351-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5680-350-0x00000000006F0000-0x0000000000706000-memory.dmp

Download

memory/5740-224-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5740-223-0x0000000001FE0000-0x0000000001FF6000-memory.dmp

Download

memory/5748-132-0x0000000001FA0000-0x0000000001FB6000-memory.dmp

Download

memory/5748-133-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5780-30-0x0000000004860000-0x00000000048FC000-memory.dmp

Download

memory/5780-29-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/5780-35-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5780-32-0x0000000004950000-0x0000000004F0A000-memory.dmp

Download

memory/5792-113-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5792-112-0x00000000020E0000-0x00000000020F6000-memory.dmp

Download

memory/5800-172-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5800-170-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/5800-171-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/5836-519-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5836-518-0x0000000000550000-0x0000000000566000-memory.dmp

Download

memory/5884-62-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5884-61-0x00000000005A0000-0x00000000005B6000-memory.dmp

Download

memory/5964-527-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5964-526-0x0000000000550000-0x0000000000566000-memory.dmp

Download

memory/5980-568-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/6016-122-0x0000000001FA0000-0x0000000001FB6000-memory.dmp

Download

memory/6016-123-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/6056-381-0x0000000001F80000-0x0000000001F96000-memory.dmp

Download

memory/6056-382-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads