lockergoga | 07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1

Analysis

max time kernel
154s
max time network
118s
platform
windows7_x64
resource
win7-en-20211208
submitted
01/02/2022, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe
Size

1.2MB
MD5

744124ba8d0c7469e93dfd513de8e69f
SHA1

caf0e85e4574000639f1695e8d5cf4d87e1278f6
SHA256

07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1
SHA512

ce178ab37f4c06088f3a440e359d4d72e5d5719c00d701064409fa1b9cd083d84c42affe87d9f24554e3be42384be189aad5b0f3de3d798ecba22f54f9cb3a45

Score

10^/10

lockergoga banker ransomware trojan

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

LockerGoga
LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.
trojan banker lockergoga

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	tgytutrc9933.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\ChessMCE.png	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6	tgytutrc9933.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPDMCCore.dll.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png	tgytutrc9933.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar	tgytutrc9933.exe
File opened for modification	C:\Program Files\MergeDismount.DVR	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Malta	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau	tgytutrc9933.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fi.pak	tgytutrc9933.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	tgytutrc9933.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPSideShowGadget.exe.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	tgytutrc9933.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\WMPDMCCore.dll.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\README.txt	tgytutrc9933.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\bin\wsdetect.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Montevideo	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Monterrey	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\content-types.properties	tgytutrc9933.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\bin\msvcr100.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml	tgytutrc9933.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen	tgytutrc9933.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll	tgytutrc9933.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
524	tgytutrc9933.exe
524	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe
1724	tgytutrc9933.exe
1724	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
808	tgytutrc9933.exe
524	tgytutrc9933.exe
524	tgytutrc9933.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1868	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe
Token: SeBackupPrivilege	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe
Token: SeRestorePrivilege	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe
Token: SeLockMemoryPrivilege	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe
Token: SeCreateGlobalPrivilege	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe
Token: SeDebugPrivilege	2040	tgytutrc9933.exe
Token: SeBackupPrivilege	2040	tgytutrc9933.exe
Token: SeRestorePrivilege	2040	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	2040	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	2040	tgytutrc9933.exe
Token: SeDebugPrivilege	808	tgytutrc9933.exe
Token: SeBackupPrivilege	808	tgytutrc9933.exe
Token: SeRestorePrivilege	808	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	808	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	808	tgytutrc9933.exe
Token: SeDebugPrivilege	1724	tgytutrc9933.exe
Token: SeBackupPrivilege	1724	tgytutrc9933.exe
Token: SeRestorePrivilege	1724	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	1724	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	1724	tgytutrc9933.exe
Token: SeDebugPrivilege	524	tgytutrc9933.exe
Token: SeBackupPrivilege	524	tgytutrc9933.exe
Token: SeRestorePrivilege	524	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	524	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	524	tgytutrc9933.exe
Token: SeDebugPrivilege	280	tgytutrc9933.exe
Token: SeBackupPrivilege	280	tgytutrc9933.exe
Token: SeRestorePrivilege	280	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	280	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	280	tgytutrc9933.exe
Token: SeDebugPrivilege	1932	tgytutrc9933.exe
Token: SeBackupPrivilege	1932	tgytutrc9933.exe
Token: SeRestorePrivilege	1932	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	1932	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	1932	tgytutrc9933.exe
Token: SeDebugPrivilege	1432	tgytutrc9933.exe
Token: SeBackupPrivilege	1432	tgytutrc9933.exe
Token: SeRestorePrivilege	1432	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	1432	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	1432	tgytutrc9933.exe
Token: SeDebugPrivilege	1656	tgytutrc9933.exe
Token: SeBackupPrivilege	1656	tgytutrc9933.exe
Token: SeRestorePrivilege	1656	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	1656	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	1656	tgytutrc9933.exe
Token: SeDebugPrivilege	616	tgytutrc9933.exe
Token: SeBackupPrivilege	616	tgytutrc9933.exe
Token: SeRestorePrivilege	616	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	616	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	616	tgytutrc9933.exe
Token: SeDebugPrivilege	568	tgytutrc9933.exe
Token: SeBackupPrivilege	568	tgytutrc9933.exe
Token: SeRestorePrivilege	568	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	568	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	568	tgytutrc9933.exe
Token: SeDebugPrivilege	564	tgytutrc9933.exe
Token: SeBackupPrivilege	564	tgytutrc9933.exe
Token: SeRestorePrivilege	564	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	564	tgytutrc9933.exe
Token: SeCreateGlobalPrivilege	564	tgytutrc9933.exe
Token: SeDebugPrivilege	780	tgytutrc9933.exe
Token: SeBackupPrivilege	780	tgytutrc9933.exe
Token: SeRestorePrivilege	780	tgytutrc9933.exe
Token: SeLockMemoryPrivilege	780	tgytutrc9933.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1868	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	27
PID 1632 wrote to memory of 1868	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	27
PID 1632 wrote to memory of 1868	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	27
PID 1632 wrote to memory of 1868	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	27
PID 1632 wrote to memory of 2040	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	29
PID 1632 wrote to memory of 2040	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	29
PID 1632 wrote to memory of 2040	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	29
PID 1632 wrote to memory of 2040	1632	07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe	29
PID 2040 wrote to memory of 468	2040	tgytutrc9933.exe	30
PID 2040 wrote to memory of 468	2040	tgytutrc9933.exe	30
PID 2040 wrote to memory of 468	2040	tgytutrc9933.exe	30
PID 2040 wrote to memory of 468	2040	tgytutrc9933.exe	30
PID 2040 wrote to memory of 668	2040	tgytutrc9933.exe	31
PID 2040 wrote to memory of 668	2040	tgytutrc9933.exe	31
PID 2040 wrote to memory of 668	2040	tgytutrc9933.exe	31
PID 2040 wrote to memory of 668	2040	tgytutrc9933.exe	31
PID 2040 wrote to memory of 1112	2040	tgytutrc9933.exe	32
PID 2040 wrote to memory of 1112	2040	tgytutrc9933.exe	32
PID 2040 wrote to memory of 1112	2040	tgytutrc9933.exe	32
PID 2040 wrote to memory of 1112	2040	tgytutrc9933.exe	32
PID 2040 wrote to memory of 1596	2040	tgytutrc9933.exe	38
PID 2040 wrote to memory of 1596	2040	tgytutrc9933.exe	38
PID 2040 wrote to memory of 1596	2040	tgytutrc9933.exe	38
PID 2040 wrote to memory of 1596	2040	tgytutrc9933.exe	38
PID 2040 wrote to memory of 1640	2040	tgytutrc9933.exe	33
PID 2040 wrote to memory of 1640	2040	tgytutrc9933.exe	33
PID 2040 wrote to memory of 1640	2040	tgytutrc9933.exe	33
PID 2040 wrote to memory of 1640	2040	tgytutrc9933.exe	33
PID 2040 wrote to memory of 1812	2040	tgytutrc9933.exe	40
PID 2040 wrote to memory of 1812	2040	tgytutrc9933.exe	40
PID 2040 wrote to memory of 1812	2040	tgytutrc9933.exe	40
PID 2040 wrote to memory of 1812	2040	tgytutrc9933.exe	40
PID 1812 wrote to memory of 640	1812	net.exe	42
PID 1812 wrote to memory of 640	1812	net.exe	42
PID 1812 wrote to memory of 640	1812	net.exe	42
PID 2040 wrote to memory of 1360	2040	tgytutrc9933.exe	44
PID 2040 wrote to memory of 1360	2040	tgytutrc9933.exe	44
PID 2040 wrote to memory of 1360	2040	tgytutrc9933.exe	44
PID 2040 wrote to memory of 1360	2040	tgytutrc9933.exe	44
PID 1360 wrote to memory of 1984	1360	net.exe	46
PID 1360 wrote to memory of 1984	1360	net.exe	46
PID 1360 wrote to memory of 1984	1360	net.exe	46
PID 2040 wrote to memory of 524	2040	tgytutrc9933.exe	47
PID 2040 wrote to memory of 524	2040	tgytutrc9933.exe	47
PID 2040 wrote to memory of 524	2040	tgytutrc9933.exe	47
PID 2040 wrote to memory of 524	2040	tgytutrc9933.exe	47
PID 2040 wrote to memory of 808	2040	tgytutrc9933.exe	49
PID 2040 wrote to memory of 808	2040	tgytutrc9933.exe	49
PID 2040 wrote to memory of 808	2040	tgytutrc9933.exe	49
PID 2040 wrote to memory of 808	2040	tgytutrc9933.exe	49
PID 2040 wrote to memory of 1724	2040	tgytutrc9933.exe	48
PID 2040 wrote to memory of 1724	2040	tgytutrc9933.exe	48
PID 2040 wrote to memory of 1724	2040	tgytutrc9933.exe	48
PID 2040 wrote to memory of 1724	2040	tgytutrc9933.exe	48
PID 2040 wrote to memory of 280	2040	tgytutrc9933.exe	50
PID 2040 wrote to memory of 280	2040	tgytutrc9933.exe	50
PID 2040 wrote to memory of 280	2040	tgytutrc9933.exe	50
PID 2040 wrote to memory of 280	2040	tgytutrc9933.exe	50
PID 2040 wrote to memory of 1932	2040	tgytutrc9933.exe	51
PID 2040 wrote to memory of 1932	2040	tgytutrc9933.exe	51
PID 2040 wrote to memory of 1932	2040	tgytutrc9933.exe	51
PID 2040 wrote to memory of 1932	2040	tgytutrc9933.exe	51
PID 2040 wrote to memory of 1432	2040	tgytutrc9933.exe	52
PID 2040 wrote to memory of 1432	2040	tgytutrc9933.exe	52

C:\Users\Admin\AppData\Local\Temp\07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe
"C:\Users\Admin\AppData\Local\Temp\07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\07f0cf878de3df525c97fa894c2165ed502ed5be4714b1ae07a0f48b5bfe16b1.exe C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
  C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:468
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:668
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:1112
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:1640
- - C:\Windows\system32\logoff.exe
    C:\Windows\system32\logoff.exe 0
    3⤵
    PID:1596
- - C:\Windows\system32\net.exe
    C:\Windows\system32\net.exe user Admin HuHuHUHoHo283283@dJD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin HuHuHUHoHo283283@dJD
      4⤵
      PID:640
- - C:\Windows\system32\net.exe
    C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Administrator HuHuHUHoHo283283@dJD
      4⤵
      PID:1984
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:524
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:280
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:780
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1440
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:876
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops desktop.ini file(s)
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:280
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:808
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    - Drops file in Program Files directory
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe
    C:\Users\Admin\AppData\Local\Temp\tgytutrc9933.exe -i SM-tgytutrc -s
    3⤵
    PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download