resource	yara_rule
behavioral3/memory/3440-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-7-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-19-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3440-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	bb8fce33b3478355c5a6c4f52f6ff83b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	bb8fce33b3478355c5a6c4f52f6ff83b.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\Ringlesscalling_25more_360x120_2x.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-300.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-32_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-200.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-30_altform-unplated_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WideTile.scale-125_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-200_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-72.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-125_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-150_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-80_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.js	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\View3d\3DViewerProductDescription-universal.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-96_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-150.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16_altform-lightunplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosAppList.scale-125.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\179.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-400.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-400.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-96.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.jpg	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogo.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Moustache.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\SuccessDot.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxManifest.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\8041_32x32x32.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-20_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-256.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-200_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SplashScreen.scale-125.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\THMBNAIL.PNG	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\SplashScreen.scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxAccountsSplashLogo.scale-140.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\DemoNotebook.onepkg	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-48.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe

pid	Process
3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe
3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe
3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe
3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe

description	pid	Process
Token: SeBackupPrivilege	3808	vssvc.exe
Token: SeRestorePrivilege	3808	vssvc.exe
Token: SeAuditPrivilege	3808	vssvc.exe
Token: SeShutdownPrivilege	3100	explorer.exe
Token: SeCreatePagefilePrivilege	3100	explorer.exe
Token: SeShutdownPrivilege	3100	explorer.exe
Token: SeCreatePagefilePrivilege	3100	explorer.exe
Token: SeShutdownPrivilege	3100	explorer.exe
Token: SeCreatePagefilePrivilege	3100	explorer.exe
Token: SeShutdownPrivilege	3100	explorer.exe
Token: SeCreatePagefilePrivilege	3100	explorer.exe
Token: SeShutdownPrivilege	3100	explorer.exe
Token: SeCreatePagefilePrivilege	3100	explorer.exe
Token: SeShutdownPrivilege	3100	explorer.exe
Token: SeCreatePagefilePrivilege	3100	explorer.exe

description	pid	Process	procid_target
PID 3440 wrote to memory of 1220	3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe	99
PID 3440 wrote to memory of 1220	3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe	99
PID 3440 wrote to memory of 2232	3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe	103
PID 3440 wrote to memory of 2232	3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe	103
PID 3440 wrote to memory of 4032	3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe	105
PID 3440 wrote to memory of 4032	3440	bb8fce33b3478355c5a6c4f52f6ff83b.exe	105

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads