resource	yara_rule
behavioral4/memory/512-0-0x0000000000400000-0x000000000062A000-memory.dmp	upx
behavioral4/memory/512-3-0x0000000000400000-0x000000000062A000-memory.dmp	upx
behavioral4/memory/4804-7-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-9-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/512-8-0x0000000000400000-0x000000000062A000-memory.dmp	upx
behavioral4/memory/4804-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-19-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-20-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-21-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-72-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-73-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/4804-74-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-150.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Campfire.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\178.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-200.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-150.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Dismiss.scale-64.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\8041_40x40x32.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sqlpdw.xsl	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-200.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PaySquare44x44Logo.scale-200.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\DemoModeInk.dat	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-24_contrast-black.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\SmallTile.scale-125.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\BadgeLogo.scale-100_contrast-black.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-36_altform-lightunplated.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125_contrast-black.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-unplated.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileLargeSquare.scale-100.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\WideTile.scale-125.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-64_contrast-black.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\TagAlbumDefinitions\B6D67B96-7485-47C3-86B5-53EBE626BF73.json	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_SadMouth.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W5.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\8080_20x20x32.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxManifest.xml	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-200.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-150_contrast-white.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\MedTile.scale-200.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_altform-lightunplated.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\AppxManifest.xml	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-20.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-200.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-white.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-150.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\View3d\3DViewerProductDescription-universal.xml	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-125.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCacheMini.scale-100.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Resource\Xbox.Smartglass.Loc.xml	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\WideTile.scale-100.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewMailList.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-125.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-30_altform-unplated_contrast-high.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-400.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100_contrast-white.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ExploreButtonGradientLight.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-200_contrast-black.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-150.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_contrast-white.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-16_altform-unplated.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

pid	Process
4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

description	pid	Process
Token: SeShutdownPrivilege	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Token: SeCreatePagefilePrivilege	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Token: SeShutdownPrivilege	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Token: SeCreatePagefilePrivilege	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Token: SeBackupPrivilege	4156	vssvc.exe
Token: SeRestorePrivilege	4156	vssvc.exe
Token: SeAuditPrivilege	4156	vssvc.exe
Token: SeShutdownPrivilege	2180	explorer.exe
Token: SeCreatePagefilePrivilege	2180	explorer.exe
Token: SeShutdownPrivilege	2180	explorer.exe
Token: SeCreatePagefilePrivilege	2180	explorer.exe
Token: SeShutdownPrivilege	2180	explorer.exe
Token: SeCreatePagefilePrivilege	2180	explorer.exe

description	pid	Process	procid_target
PID 512 wrote to memory of 4804	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	92
PID 512 wrote to memory of 4804	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	92
PID 512 wrote to memory of 4804	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	92
PID 512 wrote to memory of 4804	512	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	92
PID 4804 wrote to memory of 4692	4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	93
PID 4804 wrote to memory of 4692	4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	93
PID 4804 wrote to memory of 4028	4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	97
PID 4804 wrote to memory of 4028	4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	97
PID 4804 wrote to memory of 3532	4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	99
PID 4804 wrote to memory of 3532	4804	94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe	99

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads