resource	yara_rule
behavioral3/memory/532-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-6-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-21-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/532-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-72_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-BR\View3d\3DViewerProductDescription-universal.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-48.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\commerce\taster_post_call_illustration.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\Logo.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-125_contrast-high.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\WordCapabilities.json	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Connecting_Loud.m4a	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-200_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-125.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\progress.gif	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch-Dark.scale-400.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-40_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\PREVIEW.GIF	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Flight_Light.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_scale-125.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\EssentialResume.dotx	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-96_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7dd.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-64.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-100_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\LargeTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_bg.json	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-200_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-lightunplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-white_scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-250.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-32_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\THMBNAIL.PNG	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe

description	pid	Process
Token: SeBackupPrivilege	1660	vssvc.exe
Token: SeRestorePrivilege	1660	vssvc.exe
Token: SeAuditPrivilege	1660	vssvc.exe
Token: SeShutdownPrivilege	1732	explorer.exe
Token: SeCreatePagefilePrivilege	1732	explorer.exe
Token: SeShutdownPrivilege	1732	explorer.exe
Token: SeCreatePagefilePrivilege	1732	explorer.exe
Token: SeShutdownPrivilege	1732	explorer.exe
Token: SeCreatePagefilePrivilege	1732	explorer.exe
Token: SeShutdownPrivilege	1732	explorer.exe
Token: SeCreatePagefilePrivilege	1732	explorer.exe
Token: SeShutdownPrivilege	1732	explorer.exe
Token: SeCreatePagefilePrivilege	1732	explorer.exe
Token: SeShutdownPrivilege	1732	explorer.exe
Token: SeCreatePagefilePrivilege	1732	explorer.exe

description	pid	Process	procid_target
PID 532 wrote to memory of 3268	532	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	91
PID 532 wrote to memory of 3268	532	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	91
PID 532 wrote to memory of 3440	532	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	95
PID 532 wrote to memory of 3440	532	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	95
PID 532 wrote to memory of 2532	532	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	97
PID 532 wrote to memory of 2532	532	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	97

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads