resource	yara_rule
behavioral3/memory/876-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-13-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-21-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/876-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-100_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_WorriedEye.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_PigNose.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_altform-unplated_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\179.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_fi.json	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Config\ShellPreviewConfig.json	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-150_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\THMBNAIL.PNG	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreSmallTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-30_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\wordmui.msi.16.en-us.vreg.dat	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-150.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\splashscreen.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-256_altform-unplated_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-150.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\DeleteToastQuickAction.scale-80.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\5.jpg	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewCalendar.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\AppxManifest.xml	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_ro.json	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-unplated_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsMedTile.scale-125.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-250.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_zh-HK.json	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileLargeSquare.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-unplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-400.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-125.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\PREVIEW.GIF	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-lightunplated_devicefamily-colorfulunplated.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\logo.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\SmallTile.scale-125.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb\Images\fb_blank_profile_portrait.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare71x71Logo.scale-200_contrast-white.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_scale-100.png	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe

description	pid	Process
Token: SeBackupPrivilege	3104	vssvc.exe
Token: SeRestorePrivilege	3104	vssvc.exe
Token: SeAuditPrivilege	3104	vssvc.exe
Token: SeShutdownPrivilege	2160	explorer.exe
Token: SeCreatePagefilePrivilege	2160	explorer.exe
Token: SeShutdownPrivilege	2160	explorer.exe
Token: SeCreatePagefilePrivilege	2160	explorer.exe
Token: SeShutdownPrivilege	2160	explorer.exe
Token: SeCreatePagefilePrivilege	2160	explorer.exe
Token: SeShutdownPrivilege	2160	explorer.exe
Token: SeCreatePagefilePrivilege	2160	explorer.exe
Token: SeShutdownPrivilege	2160	explorer.exe
Token: SeCreatePagefilePrivilege	2160	explorer.exe
Token: SeShutdownPrivilege	2160	explorer.exe
Token: SeCreatePagefilePrivilege	2160	explorer.exe

description	pid	Process	procid_target
PID 876 wrote to memory of 4992	876	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	95
PID 876 wrote to memory of 4992	876	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	95
PID 876 wrote to memory of 2600	876	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	99
PID 876 wrote to memory of 2600	876	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	99
PID 876 wrote to memory of 4784	876	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	101
PID 876 wrote to memory of 4784	876	629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe	101

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads