resource	yara_rule
behavioral3/memory/1712-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-7-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-20-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-21-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral3/memory/1712-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-96_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-20_altform-unplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg2.jpg	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-150_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-150.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-20.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-24.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewCalendar.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionMedTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_stats_render_sm.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-72.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-black_scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-125.jpg	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\nunit_schema_2.5.xsd	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-colorize.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_altform-lightunplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30_altform-lightunplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-100_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-lightunplated.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.contrast-black_scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100_contrast-high.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-150.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-24_contrast-white.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-white_scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Sun.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\LargeTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-200.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-24.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-400.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-400.png	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

pid	Process
1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe
1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe

description	pid	Process
Token: SeBackupPrivilege	2948	vssvc.exe
Token: SeRestorePrivilege	2948	vssvc.exe
Token: SeAuditPrivilege	2948	vssvc.exe
Token: SeShutdownPrivilege	4896	explorer.exe
Token: SeCreatePagefilePrivilege	4896	explorer.exe
Token: SeShutdownPrivilege	4896	explorer.exe
Token: SeCreatePagefilePrivilege	4896	explorer.exe

description	pid	Process	procid_target
PID 1712 wrote to memory of 4932	1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	96
PID 1712 wrote to memory of 4932	1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	96
PID 1712 wrote to memory of 1828	1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	100
PID 1712 wrote to memory of 1828	1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	100
PID 1712 wrote to memory of 740	1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	102
PID 1712 wrote to memory of 740	1712	cc8a92319d9e60f28bfbcd88451a6fccfa997169ac85a121c710b13235198353.exe	102

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads