resource	yara_rule
behavioral3/memory/4252-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-8-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-19-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/4252-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Snooze.scale-80.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-white_scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteReplay_white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-lightunplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-150.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-16_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\splashscreen.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-400.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-80_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailLargeTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\8041_48x48x32.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLogoExtensions.scale-32.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SpotlightCalendar_2017-03.gif	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\ReadResize.vsx	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\Unipulator.mp4	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-96_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-256_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-16.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-400.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\VideoWhatsNewItems.json	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-200_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-48_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-white_scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\MessagesXboxLogo.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-150_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreSmallTile.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-256.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

pid	Process
4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

description	pid	Process
Token: SeBackupPrivilege	5112	vssvc.exe
Token: SeRestorePrivilege	5112	vssvc.exe
Token: SeAuditPrivilege	5112	vssvc.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe
Token: SeShutdownPrivilege	4848	explorer.exe
Token: SeCreatePagefilePrivilege	4848	explorer.exe

description	pid	Process	procid_target
PID 4252 wrote to memory of 4448	4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	88
PID 4252 wrote to memory of 4448	4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	88
PID 4252 wrote to memory of 2644	4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	92
PID 4252 wrote to memory of 2644	4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	92
PID 4252 wrote to memory of 4408	4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	94
PID 4252 wrote to memory of 4408	4252	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	94

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads