resource	yara_rule
behavioral2/memory/2512-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-21-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral2/memory/2512-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-125_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxLargeTile.scale-150.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2875_20x20x32.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Bing.Immersive\Shaders\SimpleCubeShader.ps	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\12.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\iheart-radio.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PeopleMedTile.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Deal\New-Deal-over.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Styling\css\ContentDark.css	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-400.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ru_16x11.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsLargeTile.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashSquareTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7316_20x20x32.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-48_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-unplated_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedSplash.scale-100_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\logo.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-96_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\TimerSmallTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\io_16x11.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\3416_24x24x32.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_1d.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7656_48x48x32.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-40.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\mask\11d.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Background.html	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim1.smile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\192.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-400.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\StoreLogo.contrast-white_scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-fullcolor.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\smoking.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100_contrast-high.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxAccountsStoreLogo.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Themes\beach.mobile.jpg	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\Animation\coins out burst_00018.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\XMLOffKeys\Keys_OffVer11.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-24.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\challenge\Gimme_Five_Unearned_small.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-48_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\SplashScreen.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-100_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore\Resources\Assets\RT_Icons_Fresh_16.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xeccf.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

pid	Process
2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

description	pid	Process
Token: SeBackupPrivilege	1736	vssvc.exe
Token: SeRestorePrivilege	1736	vssvc.exe
Token: SeAuditPrivilege	1736	vssvc.exe
Token: SeShutdownPrivilege	3256	explorer.exe
Token: SeCreatePagefilePrivilege	3256	explorer.exe
Token: SeShutdownPrivilege	3256	explorer.exe
Token: SeCreatePagefilePrivilege	3256	explorer.exe
Token: SeShutdownPrivilege	3256	explorer.exe
Token: SeCreatePagefilePrivilege	3256	explorer.exe
Token: SeShutdownPrivilege	3256	explorer.exe
Token: SeCreatePagefilePrivilege	3256	explorer.exe
Token: SeShutdownPrivilege	3256	explorer.exe
Token: SeCreatePagefilePrivilege	3256	explorer.exe

description	pid	Process	procid_target
PID 2512 wrote to memory of 2328	2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	72
PID 2512 wrote to memory of 2328	2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	72
PID 2512 wrote to memory of 1700	2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	76
PID 2512 wrote to memory of 1700	2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	76
PID 2512 wrote to memory of 2032	2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	78
PID 2512 wrote to memory of 2032	2512	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	78

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads