pony | 2ae61c5010ea6574360661917b2a2a519898ce20063d0ca0b30b7c0e7c4f054d

Analysis

max time kernel
116s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
Size

2.2MB
MD5

239dda5139c39cc1a3933efe2f4cdde3
SHA1

3a04e8b8f44169d6a9130ff1d87fe35a86987aca
SHA256

2ae61c5010ea6574360661917b2a2a519898ce20063d0ca0b30b7c0e7c4f054d
SHA512

337946aa347e45ceb5c3bfc9cf6b0c5666bd21da6fe60b6e2105c6a8fc767b88abce910876b398cce9bfbc0b3cc0e6d8c0c5df3c007e3bc81de4e7029112a037
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwr

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4824	explorer.exe
1512	explorer.exe
3888	spoolsv.exe
456	spoolsv.exe
4816	spoolsv.exe
1076	spoolsv.exe
656	spoolsv.exe
4964	spoolsv.exe
2208	spoolsv.exe
3984	spoolsv.exe
796	spoolsv.exe
3252	spoolsv.exe
1164	spoolsv.exe
4276	spoolsv.exe
4808	spoolsv.exe
4232	spoolsv.exe
4900	spoolsv.exe
4116	spoolsv.exe
4344	spoolsv.exe
1120	spoolsv.exe
4660	spoolsv.exe
4304	spoolsv.exe
3584	spoolsv.exe
4108	spoolsv.exe
2860	spoolsv.exe
3860	spoolsv.exe
3380	spoolsv.exe
4328	spoolsv.exe
4216	spoolsv.exe
4384	spoolsv.exe
3168	spoolsv.exe
2132	spoolsv.exe
5032	spoolsv.exe
2956	spoolsv.exe
452	spoolsv.exe
3896	explorer.exe
3276	spoolsv.exe
408	spoolsv.exe
4224	spoolsv.exe
3448	spoolsv.exe
1236	spoolsv.exe
1560	spoolsv.exe
1064	spoolsv.exe
5020	explorer.exe
216	spoolsv.exe
4348	spoolsv.exe
4932	spoolsv.exe
3200	spoolsv.exe
4404	spoolsv.exe
5048	explorer.exe
428	spoolsv.exe
2336	spoolsv.exe
1228	spoolsv.exe
1312	spoolsv.exe
3060	spoolsv.exe
2844	spoolsv.exe
2420	spoolsv.exe
1736	spoolsv.exe
2112	spoolsv.exe
1876	spoolsv.exe
3644	spoolsv.exe
1092	spoolsv.exe
4972	spoolsv.exe
1404	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 35 IoCs

description	pid	Process	procid_target
PID 3368 set thread context of 3288	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	96
PID 4824 set thread context of 1512	4824	explorer.exe	100
PID 3888 set thread context of 452	3888	spoolsv.exe	138
PID 456 set thread context of 3276	456	spoolsv.exe	140
PID 4816 set thread context of 4224	4816	spoolsv.exe	142
PID 1076 set thread context of 3448	1076	spoolsv.exe	143
PID 656 set thread context of 1236	656	spoolsv.exe	144
PID 4964 set thread context of 1560	4964	spoolsv.exe	145
PID 2208 set thread context of 1064	2208	spoolsv.exe	146
PID 3984 set thread context of 216	3984	spoolsv.exe	148
PID 796 set thread context of 4348	796	spoolsv.exe	149
PID 3252 set thread context of 3200	3252	spoolsv.exe	151
PID 1164 set thread context of 4404	1164	spoolsv.exe	152
PID 4276 set thread context of 428	4276	spoolsv.exe	154
PID 4808 set thread context of 2336	4808	spoolsv.exe	155
PID 4232 set thread context of 1228	4232	spoolsv.exe	156
PID 4900 set thread context of 1312	4900	spoolsv.exe	157
PID 4116 set thread context of 3060	4116	spoolsv.exe	158
PID 4344 set thread context of 2844	4344	spoolsv.exe	159
PID 1120 set thread context of 2420	1120	spoolsv.exe	160
PID 4660 set thread context of 1736	4660	spoolsv.exe	161
PID 4304 set thread context of 1876	4304	spoolsv.exe	163
PID 3584 set thread context of 3644	3584	spoolsv.exe	165
PID 4108 set thread context of 1092	4108	spoolsv.exe	166
PID 2860 set thread context of 4972	2860	spoolsv.exe	167
PID 3860 set thread context of 1404	3860	spoolsv.exe	168
PID 3380 set thread context of 2340	3380	spoolsv.exe	169
PID 4328 set thread context of 1208	4328	spoolsv.exe	171
PID 4216 set thread context of 3476	4216	spoolsv.exe	173
PID 4384 set thread context of 2968	4384	spoolsv.exe	174
PID 3168 set thread context of 2220	3168	spoolsv.exe	177
PID 2132 set thread context of 3868	2132	spoolsv.exe	178
PID 5032 set thread context of 3208	5032	spoolsv.exe	180
PID 2956 set thread context of 740	2956	spoolsv.exe	185
PID 3896 set thread context of 1004	3896	explorer.exe	193

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3288	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
3288	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3288	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
3288	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
1512	explorer.exe
452	spoolsv.exe
452	spoolsv.exe
3276	spoolsv.exe
3276	spoolsv.exe
4224	spoolsv.exe
4224	spoolsv.exe
3448	spoolsv.exe
3448	spoolsv.exe
1236	spoolsv.exe
1236	spoolsv.exe
1560	spoolsv.exe
1560	spoolsv.exe
1064	spoolsv.exe
1064	spoolsv.exe
216	spoolsv.exe
216	spoolsv.exe
4348	spoolsv.exe
4348	spoolsv.exe
3200	spoolsv.exe
3200	spoolsv.exe
4404	spoolsv.exe
4404	spoolsv.exe
428	spoolsv.exe
428	spoolsv.exe
2336	spoolsv.exe
2336	spoolsv.exe
1228	spoolsv.exe
1228	spoolsv.exe
1312	spoolsv.exe
1312	spoolsv.exe
3060	spoolsv.exe
3060	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
2420	spoolsv.exe
2420	spoolsv.exe
1736	spoolsv.exe
1736	spoolsv.exe
1876	spoolsv.exe
1876	spoolsv.exe
3644	spoolsv.exe
3644	spoolsv.exe
1092	spoolsv.exe
1092	spoolsv.exe
4972	spoolsv.exe
4972	spoolsv.exe
1404	spoolsv.exe
1404	spoolsv.exe
2340	spoolsv.exe
2340	spoolsv.exe
1208	spoolsv.exe
1208	spoolsv.exe
3476	spoolsv.exe
3476	spoolsv.exe
2968	spoolsv.exe
2968	spoolsv.exe
2220	spoolsv.exe
2220	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3468	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	84
PID 3368 wrote to memory of 3468	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	84
PID 3368 wrote to memory of 3288	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	96
PID 3368 wrote to memory of 3288	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	96
PID 3368 wrote to memory of 3288	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	96
PID 3368 wrote to memory of 3288	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	96
PID 3368 wrote to memory of 3288	3368	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	96
PID 3288 wrote to memory of 4824	3288	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	97
PID 3288 wrote to memory of 4824	3288	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	97
PID 3288 wrote to memory of 4824	3288	239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe	97
PID 4824 wrote to memory of 1512	4824	explorer.exe	100
PID 4824 wrote to memory of 1512	4824	explorer.exe	100
PID 4824 wrote to memory of 1512	4824	explorer.exe	100
PID 4824 wrote to memory of 1512	4824	explorer.exe	100
PID 4824 wrote to memory of 1512	4824	explorer.exe	100
PID 1512 wrote to memory of 3888	1512	explorer.exe	101
PID 1512 wrote to memory of 3888	1512	explorer.exe	101
PID 1512 wrote to memory of 3888	1512	explorer.exe	101
PID 1512 wrote to memory of 456	1512	explorer.exe	102
PID 1512 wrote to memory of 456	1512	explorer.exe	102
PID 1512 wrote to memory of 456	1512	explorer.exe	102
PID 1512 wrote to memory of 4816	1512	explorer.exe	103
PID 1512 wrote to memory of 4816	1512	explorer.exe	103
PID 1512 wrote to memory of 4816	1512	explorer.exe	103
PID 1512 wrote to memory of 1076	1512	explorer.exe	104
PID 1512 wrote to memory of 1076	1512	explorer.exe	104
PID 1512 wrote to memory of 1076	1512	explorer.exe	104
PID 1512 wrote to memory of 656	1512	explorer.exe	105
PID 1512 wrote to memory of 656	1512	explorer.exe	105
PID 1512 wrote to memory of 656	1512	explorer.exe	105
PID 1512 wrote to memory of 4964	1512	explorer.exe	106
PID 1512 wrote to memory of 4964	1512	explorer.exe	106
PID 1512 wrote to memory of 4964	1512	explorer.exe	106
PID 1512 wrote to memory of 2208	1512	explorer.exe	107
PID 1512 wrote to memory of 2208	1512	explorer.exe	107
PID 1512 wrote to memory of 2208	1512	explorer.exe	107
PID 1512 wrote to memory of 3984	1512	explorer.exe	108
PID 1512 wrote to memory of 3984	1512	explorer.exe	108
PID 1512 wrote to memory of 3984	1512	explorer.exe	108
PID 1512 wrote to memory of 796	1512	explorer.exe	109
PID 1512 wrote to memory of 796	1512	explorer.exe	109
PID 1512 wrote to memory of 796	1512	explorer.exe	109
PID 1512 wrote to memory of 3252	1512	explorer.exe	110
PID 1512 wrote to memory of 3252	1512	explorer.exe	110
PID 1512 wrote to memory of 3252	1512	explorer.exe	110
PID 1512 wrote to memory of 1164	1512	explorer.exe	111
PID 1512 wrote to memory of 1164	1512	explorer.exe	111
PID 1512 wrote to memory of 1164	1512	explorer.exe	111
PID 1512 wrote to memory of 4276	1512	explorer.exe	112
PID 1512 wrote to memory of 4276	1512	explorer.exe	112
PID 1512 wrote to memory of 4276	1512	explorer.exe	112
PID 1512 wrote to memory of 4808	1512	explorer.exe	114
PID 1512 wrote to memory of 4808	1512	explorer.exe	114
PID 1512 wrote to memory of 4808	1512	explorer.exe	114
PID 1512 wrote to memory of 4232	1512	explorer.exe	115
PID 1512 wrote to memory of 4232	1512	explorer.exe	115
PID 1512 wrote to memory of 4232	1512	explorer.exe	115
PID 1512 wrote to memory of 4900	1512	explorer.exe	117
PID 1512 wrote to memory of 4900	1512	explorer.exe	117
PID 1512 wrote to memory of 4900	1512	explorer.exe	117
PID 1512 wrote to memory of 4116	1512	explorer.exe	121
PID 1512 wrote to memory of 4116	1512	explorer.exe	121
PID 1512 wrote to memory of 4116	1512	explorer.exe	121
PID 1512 wrote to memory of 4344	1512	explorer.exe	122

C:\Users\Admin\AppData\Local\Temp\239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\239dda5139c39cc1a3933efe2f4cdde3_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3288
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3896
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5020
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5048
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:704
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3484
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:740
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:748
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:60
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2188
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5824
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5988
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
7591fa2940876286451e4c758ad3abaf

SHA1
bb7e63f6ffbae09c9ac095357ce8554b325c7846

SHA256
f7d5c3980e20d8d6a1b6a6175c76a1cb65276bc230c0dfa4c2708b7f1e7d03c2

SHA512
8e2f132961e01ab2a64add64d88f0d6dc99b7a1e1b8ab0a3978adae3b69d8c7e4f7d9192d1f720432fd0f6f9badc2685e97f0cf26f1480c2132916d952b359f9

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
65597ab739b96338dad408e5ab604522

SHA1
d6d0cee73fe7b5eb68f30e9d837166a68cece6a0

SHA256
98e5c9cd29444fb1a8705534879febd624d944365f36529518a4d2ecb0b6eca8

SHA512
90edcc0671cf57698aa00dd9aa979aad22d93ee217baa68d04284f37e9107f2e12c449882e0aa60c59f34f134237bff1f83f2f9825d87214b7c806426fda90e1

Download Submit
memory/60-5374-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-2240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-2031-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-2208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/456-2041-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/456-1115-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/656-1293-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/740-3230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/796-1477-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1004-3619-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1004-3617-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1064-2232-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1064-2391-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1076-1117-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1092-2604-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1120-1954-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1144-5405-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1164-1621-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1208-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1208-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1228-2440-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1236-2141-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1312-2448-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1312-2452-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1404-2622-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1512-838-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1512-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1560-2153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1876-2586-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2188-4589-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2188-4662-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2208-1295-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2220-2860-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2336-2431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2420-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2420-2481-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2844-2469-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-2039-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2968-2843-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2968-2906-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3060-2461-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3200-2331-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3208-2964-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3208-3082-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3252-1478-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3276-2040-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3288-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3288-72-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3288-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3288-46-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3368-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3368-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3368-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3368-43-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3448-2134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3460-5421-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3476-2715-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3584-2029-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3644-2594-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3672-5228-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3708-3907-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3708-3813-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3816-5381-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3860-2121-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3868-2873-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3868-2870-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3888-839-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3888-2032-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3984-1476-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4108-2030-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4116-1754-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4224-2122-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4232-1752-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4276-1622-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4292-5349-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4304-1956-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4344-1755-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4348-2287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4404-2636-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4404-2410-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4660-1955-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4808-1623-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4816-2118-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4816-1116-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4824-80-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4824-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4900-1753-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4964-1294-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4972-2615-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5036-5217-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5264-3998-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5264-3994-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5424-4964-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5436-5245-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5540-5253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5604-5278-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5748-4868-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5824-5011-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5824-4877-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5988-5175-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6084-5208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download