pony | db973a347577f82477a0c677805b86c4768e69e96cbfd971742942dac6ade322

Analysis

max time kernel
130s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
Size 2.2MB
Sample240612-24va4avapc
SHA256 db973a347577f82477a0c677805b86c4768e69e96cbfd971742942dac6ade322
MD5 a2daa6749aa744fef5d4864432602db1
SHA1 fafd3d0d84579f7d15cea7eb1a0b51dc1ed11021
SHA512 c84af401f558d932b19040c35c2aa4d96cf2ad8391fd2b3d428f5e2a0043fca3d9fd728991d6b9216687a3a5b794cdfc7c0c498f1c147b2bd488da9c6ad3c930
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZC:0UzeyQMS4DqodCnoe+iitjWwwO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3720	explorer.exe
376	explorer.exe
2676	spoolsv.exe
3132	spoolsv.exe
4660	spoolsv.exe
3808	spoolsv.exe
3832	spoolsv.exe
2960	spoolsv.exe
4464	spoolsv.exe
1744	spoolsv.exe
3676	spoolsv.exe
3540	spoolsv.exe
2080	spoolsv.exe
1624	spoolsv.exe
4628	spoolsv.exe
4596	spoolsv.exe
3268	spoolsv.exe
2432	spoolsv.exe
1520	spoolsv.exe
1496	spoolsv.exe
5096	spoolsv.exe
4716	spoolsv.exe
2200	spoolsv.exe
5232	spoolsv.exe
5552	spoolsv.exe
5876	spoolsv.exe
3124	spoolsv.exe
5316	spoolsv.exe
5720	spoolsv.exe
4432	spoolsv.exe
5452	spoolsv.exe
6048	spoolsv.exe
1148	spoolsv.exe
5784	spoolsv.exe
5216	spoolsv.exe
5364	spoolsv.exe
5520	explorer.exe
5588	spoolsv.exe
4428	spoolsv.exe
3544	spoolsv.exe
464	spoolsv.exe
1804	spoolsv.exe
5368	spoolsv.exe
5128	spoolsv.exe
860	explorer.exe
5584	spoolsv.exe
404	spoolsv.exe
5684	spoolsv.exe
5652	spoolsv.exe
5404	spoolsv.exe
2856	spoolsv.exe
1920	explorer.exe
4008	spoolsv.exe
4444	spoolsv.exe
5900	spoolsv.exe
624	spoolsv.exe
3688	spoolsv.exe
3024	spoolsv.exe
2616	explorer.exe
4072	spoolsv.exe
4136	spoolsv.exe
4332	spoolsv.exe
5804	spoolsv.exe
3060	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 43 IoCs

description	pid	Process	procid_target
PID 1340 set thread context of 4264	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	101
PID 3720 set thread context of 376	3720	explorer.exe	106
PID 2676 set thread context of 5364	2676	spoolsv.exe	141
PID 3132 set thread context of 5588	3132	spoolsv.exe	143
PID 4660 set thread context of 3544	4660	spoolsv.exe	145
PID 3808 set thread context of 464	3808	spoolsv.exe	146
PID 3832 set thread context of 1804	3832	spoolsv.exe	147
PID 2960 set thread context of 5368	2960	spoolsv.exe	148
PID 4464 set thread context of 5128	4464	spoolsv.exe	149
PID 1744 set thread context of 5584	1744	spoolsv.exe	151
PID 3676 set thread context of 404	3676	spoolsv.exe	152
PID 3540 set thread context of 5652	3540	spoolsv.exe	154
PID 2080 set thread context of 5404	2080	spoolsv.exe	155
PID 1624 set thread context of 2856	1624	spoolsv.exe	156
PID 4628 set thread context of 4008	4628	spoolsv.exe	158
PID 4596 set thread context of 4444	4596	spoolsv.exe	159
PID 3268 set thread context of 624	3268	spoolsv.exe	161
PID 2432 set thread context of 3688	2432	spoolsv.exe	162
PID 1520 set thread context of 3024	1520	spoolsv.exe	163
PID 1496 set thread context of 4072	1496	spoolsv.exe	165
PID 5096 set thread context of 4332	5096	spoolsv.exe	176
PID 4716 set thread context of 5804	4716	spoolsv.exe	168
PID 2200 set thread context of 3060	2200	spoolsv.exe	169
PID 5232 set thread context of 396	5232	spoolsv.exe	170
PID 5552 set thread context of 3928	5552	spoolsv.exe	172
PID 5876 set thread context of 5956	5876	spoolsv.exe	174
PID 3124 set thread context of 1212	3124	spoolsv.exe	175
PID 5316 set thread context of 4332	5316	spoolsv.exe	176
PID 5720 set thread context of 1720	5720	spoolsv.exe	178
PID 4432 set thread context of 4484	4432	spoolsv.exe	180
PID 5452 set thread context of 5696	5452	spoolsv.exe	181
PID 6048 set thread context of 5612	6048	spoolsv.exe	182
PID 1148 set thread context of 5068	1148	spoolsv.exe	183
PID 5784 set thread context of 5248	5784	spoolsv.exe	185
PID 5216 set thread context of 3736	5216	spoolsv.exe	190
PID 5520 set thread context of 1324	5520	explorer.exe	195
PID 4428 set thread context of 6088	4428	spoolsv.exe	198
PID 860 set thread context of 740	860	explorer.exe	202
PID 5684 set thread context of 1392	5684	spoolsv.exe	205
PID 1920 set thread context of 5360	1920	explorer.exe	209
PID 5900 set thread context of 5892	5900	spoolsv.exe	211
PID 2616 set thread context of 3008	2616	explorer.exe	216
PID 4136 set thread context of 2164	4136	spoolsv.exe	218

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4264	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
4264	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
376	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4264	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
4264	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
5364	spoolsv.exe
5364	spoolsv.exe
5588	spoolsv.exe
5588	spoolsv.exe
3544	spoolsv.exe
3544	spoolsv.exe
464	spoolsv.exe
464	spoolsv.exe
1804	spoolsv.exe
1804	spoolsv.exe
5368	spoolsv.exe
5368	spoolsv.exe
5128	spoolsv.exe
5128	spoolsv.exe
5584	spoolsv.exe
5584	spoolsv.exe
404	spoolsv.exe
404	spoolsv.exe
5652	spoolsv.exe
5652	spoolsv.exe
5404	spoolsv.exe
5404	spoolsv.exe
2856	spoolsv.exe
2856	spoolsv.exe
4008	spoolsv.exe
4008	spoolsv.exe
4444	spoolsv.exe
4444	spoolsv.exe
624	spoolsv.exe
624	spoolsv.exe
3688	spoolsv.exe
3688	spoolsv.exe
3024	spoolsv.exe
3024	spoolsv.exe
4072	spoolsv.exe
4072	spoolsv.exe
4332	spoolsv.exe
4332	spoolsv.exe
5804	spoolsv.exe
5804	spoolsv.exe
3060	spoolsv.exe
3060	spoolsv.exe
396	spoolsv.exe
396	spoolsv.exe
3928	spoolsv.exe
3928	spoolsv.exe
5956	spoolsv.exe
5956	spoolsv.exe
1212	spoolsv.exe
1212	spoolsv.exe
4332	spoolsv.exe
4332	spoolsv.exe
1720	spoolsv.exe
1720	spoolsv.exe
4484	spoolsv.exe
4484	spoolsv.exe
5696	spoolsv.exe
5696	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 4984	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	92
PID 1340 wrote to memory of 4984	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	92
PID 1340 wrote to memory of 4264	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	101
PID 1340 wrote to memory of 4264	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	101
PID 1340 wrote to memory of 4264	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	101
PID 1340 wrote to memory of 4264	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	101
PID 1340 wrote to memory of 4264	1340	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	101
PID 4264 wrote to memory of 3720	4264	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	102
PID 4264 wrote to memory of 3720	4264	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	102
PID 4264 wrote to memory of 3720	4264	a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe	102
PID 3720 wrote to memory of 376	3720	explorer.exe	106
PID 3720 wrote to memory of 376	3720	explorer.exe	106
PID 3720 wrote to memory of 376	3720	explorer.exe	106
PID 3720 wrote to memory of 376	3720	explorer.exe	106
PID 3720 wrote to memory of 376	3720	explorer.exe	106
PID 376 wrote to memory of 2676	376	explorer.exe	107
PID 376 wrote to memory of 2676	376	explorer.exe	107
PID 376 wrote to memory of 2676	376	explorer.exe	107
PID 376 wrote to memory of 3132	376	explorer.exe	108
PID 376 wrote to memory of 3132	376	explorer.exe	108
PID 376 wrote to memory of 3132	376	explorer.exe	108
PID 376 wrote to memory of 4660	376	explorer.exe	109
PID 376 wrote to memory of 4660	376	explorer.exe	109
PID 376 wrote to memory of 4660	376	explorer.exe	109
PID 376 wrote to memory of 3808	376	explorer.exe	110
PID 376 wrote to memory of 3808	376	explorer.exe	110
PID 376 wrote to memory of 3808	376	explorer.exe	110
PID 376 wrote to memory of 3832	376	explorer.exe	111
PID 376 wrote to memory of 3832	376	explorer.exe	111
PID 376 wrote to memory of 3832	376	explorer.exe	111
PID 376 wrote to memory of 2960	376	explorer.exe	112
PID 376 wrote to memory of 2960	376	explorer.exe	112
PID 376 wrote to memory of 2960	376	explorer.exe	112
PID 376 wrote to memory of 4464	376	explorer.exe	113
PID 376 wrote to memory of 4464	376	explorer.exe	113
PID 376 wrote to memory of 4464	376	explorer.exe	113
PID 376 wrote to memory of 1744	376	explorer.exe	114
PID 376 wrote to memory of 1744	376	explorer.exe	114
PID 376 wrote to memory of 1744	376	explorer.exe	114
PID 376 wrote to memory of 3676	376	explorer.exe	115
PID 376 wrote to memory of 3676	376	explorer.exe	115
PID 376 wrote to memory of 3676	376	explorer.exe	115
PID 376 wrote to memory of 3540	376	explorer.exe	116
PID 376 wrote to memory of 3540	376	explorer.exe	116
PID 376 wrote to memory of 3540	376	explorer.exe	116
PID 376 wrote to memory of 2080	376	explorer.exe	117
PID 376 wrote to memory of 2080	376	explorer.exe	117
PID 376 wrote to memory of 2080	376	explorer.exe	117
PID 376 wrote to memory of 1624	376	explorer.exe	118
PID 376 wrote to memory of 1624	376	explorer.exe	118
PID 376 wrote to memory of 1624	376	explorer.exe	118
PID 376 wrote to memory of 4628	376	explorer.exe	119
PID 376 wrote to memory of 4628	376	explorer.exe	119
PID 376 wrote to memory of 4628	376	explorer.exe	119
PID 376 wrote to memory of 4596	376	explorer.exe	120
PID 376 wrote to memory of 4596	376	explorer.exe	120
PID 376 wrote to memory of 4596	376	explorer.exe	120
PID 376 wrote to memory of 3268	376	explorer.exe	121
PID 376 wrote to memory of 3268	376	explorer.exe	121
PID 376 wrote to memory of 3268	376	explorer.exe	121
PID 376 wrote to memory of 2432	376	explorer.exe	122
PID 376 wrote to memory of 2432	376	explorer.exe	122
PID 376 wrote to memory of 2432	376	explorer.exe	122
PID 376 wrote to memory of 1520	376	explorer.exe	123

C:\Users\Admin\AppData\Local\Temp\a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4984
- C:\Users\Admin\AppData\Local\Temp\a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a2daa6749aa744fef5d4864432602db1_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4264
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5520
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5128
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:860
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1920
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2616
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1948
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:664
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4524
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3736
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2316
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2164
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:6124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:6072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5476
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5284
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4124,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 c871edc535728aa2b481d2faeb2ede18a6aff6ea25e98be5943b48956dd387ea
MD5 a0f4e979d691d0d4ab71638d0936af02
SHA1 888a032c9e663ea82333e644a4486c5aaac402c5
SHA512 d3be97861225026dae1d1b489bf67e8836f2a6da2980602b264c29f3a96fa687ae694ef5e8fa50907faa77f4d6d4b800d6c2efb9197cbd5b5f1f2591dfbbcf2e
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ+:0UzeyQMS4DqodCnoe+iitjWwwy
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 e35f36712b78cc7044c635eaf1672a59665f4ed39079c081c4b0bf57f2b5633f
MD5 7fef13678406302ef4057667e6fae790
SHA1 fde4642560e98d340ce716c34124e5e8dd4cb39c
SHA512 dc287f639b936b8a5020762f20850463b30a3f9a9c03c6284733349969b5e8e252a0981e983578217868cd46f3dc908a03c42ab0a680affa70bb529ab4744800
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-90-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/376-930-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/396-3050-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/396-3226-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/404-2503-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/464-2379-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/464-2375-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/624-2785-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/740-4426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1212-3159-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1324-4022-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1340-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1340-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/1340-43-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/1340-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1392-4585-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1392-4704-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1496-2136-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-2135-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1624-1739-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1720-3329-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1720-3474-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1744-1523-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1804-2386-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1804-2391-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2080-1738-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2164-5257-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2164-5355-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2200-2276-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2432-1936-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2676-931-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2676-2279-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2856-2859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2908-5842-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2932-5576-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2960-1326-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3008-5192-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3024-2876-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3024-3023-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-2975-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3132-2286-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3132-1117-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3268-1935-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3540-1525-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3544-2357-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3660-5452-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3676-1524-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3688-2805-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3720-91-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3720-86-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3736-3741-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3808-1119-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3832-1325-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3928-3062-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4008-2705-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4008-2703-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4072-2887-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-75-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-73-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4264-48-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4332-2958-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4332-3167-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4332-2954-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-2714-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4464-1327-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4480-5824-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-3350-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4596-1934-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4628-1740-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4660-1118-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4660-2358-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4716-2275-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4796-5771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4796-5775-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4864-5785-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-3374-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5096-2137-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5128-2486-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5128-2657-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5232-2277-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5248-3502-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5284-6037-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5360-4776-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5364-2278-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5368-2431-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5380-5762-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5404-2608-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5416-5791-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5416-5796-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5476-6020-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5476-5753-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5552-2354-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5584-2494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5588-2289-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5620-6056-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5652-2598-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5696-3355-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5696-3359-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5876-2356-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5892-4871-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5892-4998-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5956-3147-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5956-3144-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6088-4171-0x0000000000400000-0x000000000043E000-memory.dmp

Download