resource	yara_rule
behavioral4/memory/4032-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-19-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4032-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4041115548-3858121278-1660933110-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	bb8fce33b3478355c5a6c4f52f6ff83b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	bb8fce33b3478355c5a6c4f52f6ff83b.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\KeywordSpotters\en-AU\Cortana.bin	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-150_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintMedTile.scale-200.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-200_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreSplashScreen.scale-100_altform-colorful_theme-light.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-48_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-lightunplated_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\createRef.js	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\BlurredGradientBackground.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-400_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-36_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-72.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\createTheme.js	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-40_altform-lightunplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-125.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-400.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-80_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\common\isConformant.js	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48_altform-unplated_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireSmallTile.scale-125_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\FileWord32x32.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-60_altform-unplated_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Label.js	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\FeedbackHubLargeTile.scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-72_altform-lightunplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-black\MicrosoftSolitaireMedTile.scale-100_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\Xbox_SplashScreen.scale-200_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-48.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-125_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-24_altform-lightunplated_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-125.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DetailsList\DetailsRowFields.types.js	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\FeedbackHubSmallTile.scale-125.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-100.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-125.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateSquare50x50Logo.scale-200.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SmallTile.scale-400.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-lightunplated_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SmallTile.scale-200_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-60.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\AppxManifest.xml	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsWideTile.scale-200_contrast-black.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-16_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-40_altform-unplated_contrast-white.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-400.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\motion\index.js	bb8fce33b3478355c5a6c4f52f6ff83b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-40_altform-unplated.png	bb8fce33b3478355c5a6c4f52f6ff83b.exe

pid	Process
4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe
4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe
4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe
4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe

description	pid	Process
Token: SeBackupPrivilege	1188	vssvc.exe
Token: SeRestorePrivilege	1188	vssvc.exe
Token: SeAuditPrivilege	1188	vssvc.exe
Token: SeShutdownPrivilege	2532	explorer.exe
Token: SeCreatePagefilePrivilege	2532	explorer.exe
Token: SeShutdownPrivilege	2532	explorer.exe
Token: SeCreatePagefilePrivilege	2532	explorer.exe
Token: SeShutdownPrivilege	2532	explorer.exe
Token: SeCreatePagefilePrivilege	2532	explorer.exe
Token: SeShutdownPrivilege	2532	explorer.exe
Token: SeCreatePagefilePrivilege	2532	explorer.exe
Token: SeShutdownPrivilege	2532	explorer.exe
Token: SeCreatePagefilePrivilege	2532	explorer.exe
Token: SeShutdownPrivilege	2532	explorer.exe
Token: SeCreatePagefilePrivilege	2532	explorer.exe

description	pid	Process	procid_target
PID 4032 wrote to memory of 3240	4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe	95
PID 4032 wrote to memory of 3240	4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe	95
PID 4032 wrote to memory of 4272	4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe	99
PID 4032 wrote to memory of 4272	4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe	99
PID 4032 wrote to memory of 3248	4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe	101
PID 4032 wrote to memory of 3248	4032	bb8fce33b3478355c5a6c4f52f6ff83b.exe	101

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads