pid	process
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe
2028	PAP46E1UkZ.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589247876362834"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

pid	process
432	chrome.exe
432	chrome.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe

description	pid	process
Token: SeDebugPrivilege	2028	PAP46E1UkZ.exe
Token: SeIncreaseQuotaPrivilege	2416	wmic.exe
Token: SeSecurityPrivilege	2416	wmic.exe
Token: SeTakeOwnershipPrivilege	2416	wmic.exe
Token: SeLoadDriverPrivilege	2416	wmic.exe
Token: SeSystemProfilePrivilege	2416	wmic.exe
Token: SeSystemtimePrivilege	2416	wmic.exe
Token: SeProfSingleProcessPrivilege	2416	wmic.exe
Token: SeIncBasePriorityPrivilege	2416	wmic.exe
Token: SeCreatePagefilePrivilege	2416	wmic.exe
Token: SeBackupPrivilege	2416	wmic.exe
Token: SeRestorePrivilege	2416	wmic.exe
Token: SeShutdownPrivilege	2416	wmic.exe
Token: SeDebugPrivilege	2416	wmic.exe
Token: SeSystemEnvironmentPrivilege	2416	wmic.exe
Token: SeRemoteShutdownPrivilege	2416	wmic.exe
Token: SeUndockPrivilege	2416	wmic.exe
Token: SeManageVolumePrivilege	2416	wmic.exe
Token: 33	2416	wmic.exe
Token: 34	2416	wmic.exe
Token: 35	2416	wmic.exe
Token: 36	2416	wmic.exe
Token: SeIncreaseQuotaPrivilege	2416	wmic.exe
Token: SeSecurityPrivilege	2416	wmic.exe
Token: SeTakeOwnershipPrivilege	2416	wmic.exe
Token: SeLoadDriverPrivilege	2416	wmic.exe
Token: SeSystemProfilePrivilege	2416	wmic.exe
Token: SeSystemtimePrivilege	2416	wmic.exe
Token: SeProfSingleProcessPrivilege	2416	wmic.exe
Token: SeIncBasePriorityPrivilege	2416	wmic.exe
Token: SeCreatePagefilePrivilege	2416	wmic.exe
Token: SeBackupPrivilege	2416	wmic.exe
Token: SeRestorePrivilege	2416	wmic.exe
Token: SeShutdownPrivilege	2416	wmic.exe
Token: SeDebugPrivilege	2416	wmic.exe
Token: SeSystemEnvironmentPrivilege	2416	wmic.exe
Token: SeRemoteShutdownPrivilege	2416	wmic.exe
Token: SeUndockPrivilege	2416	wmic.exe
Token: SeManageVolumePrivilege	2416	wmic.exe
Token: 33	2416	wmic.exe
Token: 34	2416	wmic.exe
Token: 35	2416	wmic.exe
Token: 36	2416	wmic.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe

pid	process
5024	MiniSearchHost.exe
2436	WINWORD.EXE
2436	WINWORD.EXE
2436	WINWORD.EXE
2436	WINWORD.EXE
2436	WINWORD.EXE
2436	WINWORD.EXE
2436	WINWORD.EXE

description	pid	process	target process
PID 4080 wrote to memory of 2028	4080	PAP46E1UkZ.exe	PAP46E1UkZ.exe
PID 4080 wrote to memory of 2028	4080	PAP46E1UkZ.exe	PAP46E1UkZ.exe
PID 2028 wrote to memory of 3788	2028	PAP46E1UkZ.exe	cmd.exe
PID 2028 wrote to memory of 3788	2028	PAP46E1UkZ.exe	cmd.exe
PID 2028 wrote to memory of 2416	2028	PAP46E1UkZ.exe	wmic.exe
PID 2028 wrote to memory of 2416	2028	PAP46E1UkZ.exe	wmic.exe
PID 432 wrote to memory of 5312	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5312	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 3476	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5352	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5352	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe
PID 432 wrote to memory of 5332	432	chrome.exe	chrome.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads