resource	yara_rule
behavioral3/memory/3416-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-7-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-13-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-19-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/3416-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	ce7104bc850c5a07a867cadb8f4bfa59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	ce7104bc850c5a07a867cadb8f4bfa59.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-200_contrast-white.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-150.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-80_altform-unplated.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\dark.gif	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-400.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-150_contrast-black.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_contrast-black.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-96_altform-unplated.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-200_contrast-black.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\video.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.html	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-100.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-24.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-400.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-16_altform-unplated.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-100.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-150.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-white_scale-100.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_myGames.targetsize-48.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppStoreLogo.scale-100.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-125.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30_altform-unplated.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-150.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-24.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter_light.css	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-400.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-100.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-unplated.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_contrast-white.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.scale-125.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\185.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-400.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-150.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-256.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phones-small.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-200.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\onenote.x-none.msi.16.x-none.vreg.dat	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-200.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-24_altform-unplated_contrast-black.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-unplated.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Spotlight_WinterGames.gif	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-72.png	ce7104bc850c5a07a867cadb8f4bfa59.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl	ce7104bc850c5a07a867cadb8f4bfa59.exe

pid	Process
3416	ce7104bc850c5a07a867cadb8f4bfa59.exe
3416	ce7104bc850c5a07a867cadb8f4bfa59.exe
3416	ce7104bc850c5a07a867cadb8f4bfa59.exe
3416	ce7104bc850c5a07a867cadb8f4bfa59.exe

description	pid	Process
Token: SeBackupPrivilege	688	vssvc.exe
Token: SeRestorePrivilege	688	vssvc.exe
Token: SeAuditPrivilege	688	vssvc.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeCreatePagefilePrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeCreatePagefilePrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeCreatePagefilePrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeCreatePagefilePrivilege	2356	explorer.exe

description	pid	Process	procid_target
PID 3416 wrote to memory of 1732	3416	ce7104bc850c5a07a867cadb8f4bfa59.exe	94
PID 3416 wrote to memory of 1732	3416	ce7104bc850c5a07a867cadb8f4bfa59.exe	94
PID 3416 wrote to memory of 4812	3416	ce7104bc850c5a07a867cadb8f4bfa59.exe	98
PID 3416 wrote to memory of 4812	3416	ce7104bc850c5a07a867cadb8f4bfa59.exe	98
PID 3416 wrote to memory of 4124	3416	ce7104bc850c5a07a867cadb8f4bfa59.exe	100
PID 3416 wrote to memory of 4124	3416	ce7104bc850c5a07a867cadb8f4bfa59.exe	100

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads