lockergoga | 46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8

Analysis

max time kernel
154s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
01/02/2022, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe
Size

1.2MB
MD5

b87ec964ef135f5c93c279e4e8121b15
SHA1

7f8b55e5702ee4dea1e24a0fd8db4e1312c66b90
SHA256

46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8
SHA512

49c6198e67cc1b2cfdc9b1d0247d9111f6b3e1e2cb030cbcd46bd8d5f463cb48e0dd2dc4ce625303b1c13fb0ed5954939d6aef0f98bb74b518fa4243be5d4421

Score

10^/10

lockergoga banker ransomware trojan

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

LockerGoga
LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.
trojan banker lockergoga

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	tgytutrc4035.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\fr-FR\Sidebar.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\MeasureConvert.vssx	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfxrt.jar	tgytutrc4035.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock	tgytutrc4035.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\splash.gif	tgytutrc4035.exe
File opened for modification	C:\Program Files\MountEdit.mp2v	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\ChessMCE.png	tgytutrc4035.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk	tgytutrc4035.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Mail\wabimp.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\UTC	tgytutrc4035.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Araguaina	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul	tgytutrc4035.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationTypes.resources.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png	tgytutrc4035.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoViewer.dll	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui	tgytutrc4035.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js	tgytutrc4035.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml	tgytutrc4035.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
928	tgytutrc4035.exe
928	tgytutrc4035.exe
2020	tgytutrc4035.exe
2020	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
2020	tgytutrc4035.exe
2020	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
928	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
2020	tgytutrc4035.exe
2020	tgytutrc4035.exe
2020	tgytutrc4035.exe
2020	tgytutrc4035.exe
1912	tgytutrc4035.exe
1912	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
2020	tgytutrc4035.exe
2020	tgytutrc4035.exe
1912	tgytutrc4035.exe
1912	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
1912	tgytutrc4035.exe
1912	tgytutrc4035.exe
1912	tgytutrc4035.exe
1912	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
1828	tgytutrc4035.exe
2020	tgytutrc4035.exe
2020	tgytutrc4035.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1620	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe
Token: SeBackupPrivilege	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe
Token: SeRestorePrivilege	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe
Token: SeLockMemoryPrivilege	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe
Token: SeCreateGlobalPrivilege	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe
Token: SeDebugPrivilege	268	tgytutrc4035.exe
Token: SeBackupPrivilege	268	tgytutrc4035.exe
Token: SeRestorePrivilege	268	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	268	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	268	tgytutrc4035.exe
Token: SeDebugPrivilege	928	tgytutrc4035.exe
Token: SeBackupPrivilege	928	tgytutrc4035.exe
Token: SeRestorePrivilege	928	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	928	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	928	tgytutrc4035.exe
Token: SeDebugPrivilege	2020	tgytutrc4035.exe
Token: SeBackupPrivilege	2020	tgytutrc4035.exe
Token: SeRestorePrivilege	2020	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	2020	tgytutrc4035.exe
Token: SeDebugPrivilege	1828	tgytutrc4035.exe
Token: SeBackupPrivilege	1828	tgytutrc4035.exe
Token: SeRestorePrivilege	1828	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	1828	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	1828	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	2020	tgytutrc4035.exe
Token: SeDebugPrivilege	1912	tgytutrc4035.exe
Token: SeBackupPrivilege	1912	tgytutrc4035.exe
Token: SeRestorePrivilege	1912	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	1912	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	1912	tgytutrc4035.exe
Token: SeDebugPrivilege	1688	tgytutrc4035.exe
Token: SeBackupPrivilege	1688	tgytutrc4035.exe
Token: SeRestorePrivilege	1688	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	1688	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	1688	tgytutrc4035.exe
Token: SeDebugPrivilege	616	tgytutrc4035.exe
Token: SeBackupPrivilege	616	tgytutrc4035.exe
Token: SeRestorePrivilege	616	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	616	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	616	tgytutrc4035.exe
Token: SeDebugPrivilege	1716	tgytutrc4035.exe
Token: SeBackupPrivilege	1716	tgytutrc4035.exe
Token: SeRestorePrivilege	1716	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	1716	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	1716	tgytutrc4035.exe
Token: SeDebugPrivilege	1148	tgytutrc4035.exe
Token: SeBackupPrivilege	1148	tgytutrc4035.exe
Token: SeRestorePrivilege	1148	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	1148	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	1148	tgytutrc4035.exe
Token: SeDebugPrivilege	1604	tgytutrc4035.exe
Token: SeBackupPrivilege	1604	tgytutrc4035.exe
Token: SeRestorePrivilege	1604	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	1604	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	1604	tgytutrc4035.exe
Token: SeDebugPrivilege	1636	tgytutrc4035.exe
Token: SeBackupPrivilege	1636	tgytutrc4035.exe
Token: SeRestorePrivilege	1636	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	1636	tgytutrc4035.exe
Token: SeCreateGlobalPrivilege	1636	tgytutrc4035.exe
Token: SeDebugPrivilege	656	tgytutrc4035.exe
Token: SeBackupPrivilege	656	tgytutrc4035.exe
Token: SeRestorePrivilege	656	tgytutrc4035.exe
Token: SeLockMemoryPrivilege	656	tgytutrc4035.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1620	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	27
PID 1656 wrote to memory of 1620	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	27
PID 1656 wrote to memory of 1620	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	27
PID 1656 wrote to memory of 1620	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	27
PID 1656 wrote to memory of 268	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	29
PID 1656 wrote to memory of 268	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	29
PID 1656 wrote to memory of 268	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	29
PID 1656 wrote to memory of 268	1656	46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe	29
PID 268 wrote to memory of 752	268	tgytutrc4035.exe	32
PID 268 wrote to memory of 752	268	tgytutrc4035.exe	32
PID 268 wrote to memory of 752	268	tgytutrc4035.exe	32
PID 268 wrote to memory of 752	268	tgytutrc4035.exe	32
PID 268 wrote to memory of 272	268	tgytutrc4035.exe	31
PID 268 wrote to memory of 272	268	tgytutrc4035.exe	31
PID 268 wrote to memory of 272	268	tgytutrc4035.exe	31
PID 268 wrote to memory of 272	268	tgytutrc4035.exe	31
PID 268 wrote to memory of 884	268	tgytutrc4035.exe	37
PID 268 wrote to memory of 884	268	tgytutrc4035.exe	37
PID 268 wrote to memory of 884	268	tgytutrc4035.exe	37
PID 268 wrote to memory of 884	268	tgytutrc4035.exe	37
PID 268 wrote to memory of 1604	268	tgytutrc4035.exe	33
PID 268 wrote to memory of 1604	268	tgytutrc4035.exe	33
PID 268 wrote to memory of 1604	268	tgytutrc4035.exe	33
PID 268 wrote to memory of 1604	268	tgytutrc4035.exe	33
PID 268 wrote to memory of 1716	268	tgytutrc4035.exe	36
PID 268 wrote to memory of 1716	268	tgytutrc4035.exe	36
PID 268 wrote to memory of 1716	268	tgytutrc4035.exe	36
PID 268 wrote to memory of 1716	268	tgytutrc4035.exe	36
PID 268 wrote to memory of 968	268	tgytutrc4035.exe	40
PID 268 wrote to memory of 968	268	tgytutrc4035.exe	40
PID 268 wrote to memory of 968	268	tgytutrc4035.exe	40
PID 268 wrote to memory of 968	268	tgytutrc4035.exe	40
PID 968 wrote to memory of 1920	968	net.exe	42
PID 968 wrote to memory of 1920	968	net.exe	42
PID 968 wrote to memory of 1920	968	net.exe	42
PID 268 wrote to memory of 1316	268	tgytutrc4035.exe	44
PID 268 wrote to memory of 1316	268	tgytutrc4035.exe	44
PID 268 wrote to memory of 1316	268	tgytutrc4035.exe	44
PID 268 wrote to memory of 1316	268	tgytutrc4035.exe	44
PID 1316 wrote to memory of 1196	1316	net.exe	46
PID 1316 wrote to memory of 1196	1316	net.exe	46
PID 1316 wrote to memory of 1196	1316	net.exe	46
PID 268 wrote to memory of 1828	268	tgytutrc4035.exe	47
PID 268 wrote to memory of 1828	268	tgytutrc4035.exe	47
PID 268 wrote to memory of 1828	268	tgytutrc4035.exe	47
PID 268 wrote to memory of 1828	268	tgytutrc4035.exe	47
PID 268 wrote to memory of 928	268	tgytutrc4035.exe	49
PID 268 wrote to memory of 928	268	tgytutrc4035.exe	49
PID 268 wrote to memory of 928	268	tgytutrc4035.exe	49
PID 268 wrote to memory of 928	268	tgytutrc4035.exe	49
PID 268 wrote to memory of 2020	268	tgytutrc4035.exe	48
PID 268 wrote to memory of 2020	268	tgytutrc4035.exe	48
PID 268 wrote to memory of 2020	268	tgytutrc4035.exe	48
PID 268 wrote to memory of 2020	268	tgytutrc4035.exe	48
PID 268 wrote to memory of 1912	268	tgytutrc4035.exe	50
PID 268 wrote to memory of 1912	268	tgytutrc4035.exe	50
PID 268 wrote to memory of 1912	268	tgytutrc4035.exe	50
PID 268 wrote to memory of 1912	268	tgytutrc4035.exe	50
PID 268 wrote to memory of 1688	268	tgytutrc4035.exe	51
PID 268 wrote to memory of 1688	268	tgytutrc4035.exe	51
PID 268 wrote to memory of 1688	268	tgytutrc4035.exe	51
PID 268 wrote to memory of 1688	268	tgytutrc4035.exe	51
PID 268 wrote to memory of 616	268	tgytutrc4035.exe	55
PID 268 wrote to memory of 616	268	tgytutrc4035.exe	55

C:\Users\Admin\AppData\Local\Temp\46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe
"C:\Users\Admin\AppData\Local\Temp\46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\46cf2fdc445858a66152c550e16858754320963a06fd90bcab56e1d287fa48d8.exe C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
  C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:272
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:752
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:1604
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:1716
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:884
- - C:\Windows\system32\net.exe
    C:\Windows\system32\net.exe user Admin HuHuHUHoHo283283@dJD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin HuHuHUHoHo283283@dJD
      4⤵
      PID:1920
- - C:\Windows\system32\net.exe
    C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Administrator HuHuHUHoHo283283@dJD
      4⤵
      PID:1196
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:656
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:108
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:656
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc4035.exe -i SM-tgytutrc -s
    3⤵
    PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download