resource	yara_rule
behavioral3/memory/4180-1-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-2-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-3-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-4-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-5-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-9-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-10-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-11-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-12-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-13-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-16-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-17-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-18-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-19-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-20-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-21-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-22-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-23-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-24-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-25-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-26-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-27-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-28-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-29-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-30-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-31-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-32-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-33-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-34-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-35-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-36-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-37-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-38-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-39-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-40-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-41-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-42-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-43-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-44-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-45-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-46-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-47-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-48-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-49-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-50-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-51-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-52-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-53-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-54-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-55-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-56-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-57-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-58-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-59-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-60-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-61-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-62-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-63-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-64-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-65-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-66-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-67-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-68-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral3/memory/4180-69-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	095b7c9aafb975f3732092b03b97ff4f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	095b7c9aafb975f3732092b03b97ff4f.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-125.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-125.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\THMBNAIL.PNG	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-125.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_permission_android.gif	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-lightunplated.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-white_scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-125_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-125_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-125_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-125.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\PREVIEW.GIF	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phones-small.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-400.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-36.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\SmallTile.scale-125.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\MedTile.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-200.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-200.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextLight.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-30.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\BuildInfo.xml	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-400.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-400.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-unplated_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-125.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-200.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateVertically.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-100_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-light\Settings.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\chats_emptystate_v3.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookMedTile.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Moonlight.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-60.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-125_contrast-black.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_bg.json	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Campfire.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-125.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-256_altform-unplated_contrast-white.png	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\32.jpg	095b7c9aafb975f3732092b03b97ff4f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-150.png	095b7c9aafb975f3732092b03b97ff4f.exe

pid	Process
4180	095b7c9aafb975f3732092b03b97ff4f.exe
4180	095b7c9aafb975f3732092b03b97ff4f.exe
4180	095b7c9aafb975f3732092b03b97ff4f.exe
4180	095b7c9aafb975f3732092b03b97ff4f.exe

description	pid	Process
Token: SeBackupPrivilege	4820	vssvc.exe
Token: SeRestorePrivilege	4820	vssvc.exe
Token: SeAuditPrivilege	4820	vssvc.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe

description	pid	Process	procid_target
PID 4180 wrote to memory of 4816	4180	095b7c9aafb975f3732092b03b97ff4f.exe	94
PID 4180 wrote to memory of 4816	4180	095b7c9aafb975f3732092b03b97ff4f.exe	94
PID 4180 wrote to memory of 3704	4180	095b7c9aafb975f3732092b03b97ff4f.exe	98
PID 4180 wrote to memory of 3704	4180	095b7c9aafb975f3732092b03b97ff4f.exe	98
PID 4180 wrote to memory of 2056	4180	095b7c9aafb975f3732092b03b97ff4f.exe	100
PID 4180 wrote to memory of 2056	4180	095b7c9aafb975f3732092b03b97ff4f.exe	100

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads