resource	yara_rule
behavioral3/memory/4792-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-21-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4792-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	ca13f4913d90017fd5cd552b30c25349.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	ca13f4913d90017fd5cd552b30c25349.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\MedTile.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare-Dark.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-white_scale-200.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-150.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\THMBNAIL.PNG	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-30_altform-lightunplated.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg6.jpg	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200_contrast-white.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewCalendar.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-250.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-256_altform-unplated.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\View3d\3DViewerProductDescription-universal.xml	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-white.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-24_contrast-white.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\PREVIEW.GIF	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-48.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-125.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-48_altform-unplated.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb\Images\fb_blank_profile_portrait.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1949_32x32x32.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-150_contrast-black.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_altform-unplated_contrast-black.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteSmallTile.scale-200.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\IsoRight.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Silhouette.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as80.xsl	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-200.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-48.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalStoreLogo.scale-200_contrast-black.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_4.m4a	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-200.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_32x32x32.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-125.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80_altform-unplated.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-300.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-black.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\LargeTile.scale-125.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Flight_Light.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-unplated.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_4_Loud.m4a	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_altform-lightunplated.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-150.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-100.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-200.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_0_Loud.m4a	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md	ca13f4913d90017fd5cd552b30c25349.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat	ca13f4913d90017fd5cd552b30c25349.exe

pid	Process
4792	ca13f4913d90017fd5cd552b30c25349.exe
4792	ca13f4913d90017fd5cd552b30c25349.exe
4792	ca13f4913d90017fd5cd552b30c25349.exe
4792	ca13f4913d90017fd5cd552b30c25349.exe

description	pid	Process
Token: SeBackupPrivilege	1344	vssvc.exe
Token: SeRestorePrivilege	1344	vssvc.exe
Token: SeAuditPrivilege	1344	vssvc.exe
Token: SeShutdownPrivilege	4452	explorer.exe
Token: SeCreatePagefilePrivilege	4452	explorer.exe
Token: SeShutdownPrivilege	4452	explorer.exe
Token: SeCreatePagefilePrivilege	4452	explorer.exe

description	pid	Process	procid_target
PID 4792 wrote to memory of 4448	4792	ca13f4913d90017fd5cd552b30c25349.exe	94
PID 4792 wrote to memory of 4448	4792	ca13f4913d90017fd5cd552b30c25349.exe	94
PID 4792 wrote to memory of 2768	4792	ca13f4913d90017fd5cd552b30c25349.exe	98
PID 4792 wrote to memory of 2768	4792	ca13f4913d90017fd5cd552b30c25349.exe	98
PID 4792 wrote to memory of 4132	4792	ca13f4913d90017fd5cd552b30c25349.exe	100
PID 4792 wrote to memory of 4132	4792	ca13f4913d90017fd5cd552b30c25349.exe	100

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads