pony | 5b8dc985ed17848aff0d4db08a593d28c4474b2839dafe607bffa09c7a72fe74

Analysis

max time kernel
83s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
Size 2.6MB
Sample240612-tedcaavcjm
SHA256 5b8dc985ed17848aff0d4db08a593d28c4474b2839dafe607bffa09c7a72fe74
MD5 a13d5374adf400bf521dc004804d0abb
SHA1 334a6ee872fe49f5a98494c93aa39d99c50ee235
SHA512 2b9d10cadd94fe5533c1f095ed84f34f6eb5d9e8d8faf50f1b3bc2817872f8f9b000d7c951d6f69d27ffe2302b7495b9a151387f0113ca46b7df4714e4feae10
SSDEEP 49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2492	explorer.exe
572	explorer.exe
304	explorer.exe
2484	spoolsv.exe
2844	spoolsv.exe
308	spoolsv.exe
2880	spoolsv.exe
568	spoolsv.exe
2088	spoolsv.exe
3056	spoolsv.exe
2312	spoolsv.exe
1360	spoolsv.exe
1628	spoolsv.exe
2240	spoolsv.exe
2632	spoolsv.exe
1324	spoolsv.exe
1264	spoolsv.exe
964	spoolsv.exe
2852	spoolsv.exe
2832	spoolsv.exe
2000	spoolsv.exe
1136	spoolsv.exe
2316	spoolsv.exe
2592	spoolsv.exe
2120	spoolsv.exe
2268	spoolsv.exe
1988	spoolsv.exe
1304	spoolsv.exe
1748	spoolsv.exe
3068	spoolsv.exe
1636	spoolsv.exe
2256	spoolsv.exe
2648	spoolsv.exe
2620	spoolsv.exe
2568	spoolsv.exe
1500	spoolsv.exe
2740	spoolsv.exe
1972	spoolsv.exe
1712	spoolsv.exe
684	spoolsv.exe
1688	spoolsv.exe
1644	spoolsv.exe
1828	spoolsv.exe
2780	spoolsv.exe
1632	spoolsv.exe
2624	spoolsv.exe
2800	spoolsv.exe
2540	spoolsv.exe
2984	spoolsv.exe
1012	spoolsv.exe
3008	spoolsv.exe
2168	spoolsv.exe
1416	spoolsv.exe
568	spoolsv.exe
1996	spoolsv.exe
1424	spoolsv.exe
908	spoolsv.exe
2956	spoolsv.exe
2108	spoolsv.exe
2636	spoolsv.exe
2756	spoolsv.exe
1924	spoolsv.exe
2868	spoolsv.exe
2212	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
304	explorer.exe
304	explorer.exe
2484	spoolsv.exe
304	explorer.exe
304	explorer.exe
308	spoolsv.exe
304	explorer.exe
304	explorer.exe
568	spoolsv.exe
304	explorer.exe
304	explorer.exe
3056	spoolsv.exe
304	explorer.exe
304	explorer.exe
1360	spoolsv.exe
304	explorer.exe
304	explorer.exe
2240	spoolsv.exe
304	explorer.exe
304	explorer.exe
1324	spoolsv.exe
304	explorer.exe
304	explorer.exe
964	spoolsv.exe
304	explorer.exe
304	explorer.exe
2832	spoolsv.exe
304	explorer.exe
304	explorer.exe
1136	spoolsv.exe
304	explorer.exe
304	explorer.exe
2592	spoolsv.exe
304	explorer.exe
304	explorer.exe
2268	spoolsv.exe
304	explorer.exe
304	explorer.exe
1304	spoolsv.exe
304	explorer.exe
304	explorer.exe
3068	spoolsv.exe
304	explorer.exe
304	explorer.exe
2256	spoolsv.exe
304	explorer.exe
304	explorer.exe
2620	spoolsv.exe
304	explorer.exe
304	explorer.exe
1500	spoolsv.exe
304	explorer.exe
304	explorer.exe
1972	spoolsv.exe
304	explorer.exe
304	explorer.exe
684	spoolsv.exe
304	explorer.exe
304	explorer.exe
1644	spoolsv.exe
304	explorer.exe
304	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 1520 set thread context of 2508	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	32
PID 2492 set thread context of 572	2492	explorer.exe	34
PID 572 set thread context of 304	572	explorer.exe	35
PID 2484 set thread context of 2844	2484	spoolsv.exe	37
PID 308 set thread context of 2880	308	spoolsv.exe	39
PID 568 set thread context of 2088	568	spoolsv.exe	41
PID 3056 set thread context of 2312	3056	spoolsv.exe	43
PID 1360 set thread context of 1628	1360	spoolsv.exe	45
PID 2240 set thread context of 2632	2240	spoolsv.exe	47
PID 1324 set thread context of 1264	1324	spoolsv.exe	49
PID 964 set thread context of 2852	964	spoolsv.exe	51
PID 2832 set thread context of 2000	2832	spoolsv.exe	53
PID 1136 set thread context of 2316	1136	spoolsv.exe	55
PID 2592 set thread context of 2120	2592	spoolsv.exe	57
PID 2268 set thread context of 1988	2268	spoolsv.exe	59
PID 1304 set thread context of 1748	1304	spoolsv.exe	61
PID 3068 set thread context of 1636	3068	spoolsv.exe	63
PID 2256 set thread context of 2648	2256	spoolsv.exe	65
PID 2620 set thread context of 2568	2620	spoolsv.exe	67
PID 1500 set thread context of 2740	1500	spoolsv.exe	69
PID 1972 set thread context of 1712	1972	spoolsv.exe	71
PID 684 set thread context of 1688	684	spoolsv.exe	73
PID 1644 set thread context of 1828	1644	spoolsv.exe	75
PID 2780 set thread context of 1632	2780	spoolsv.exe	77
PID 2624 set thread context of 2800	2624	spoolsv.exe	79
PID 2540 set thread context of 2984	2540	spoolsv.exe	81
PID 1012 set thread context of 3008	1012	spoolsv.exe	83
PID 2168 set thread context of 1416	2168	spoolsv.exe	85
PID 568 set thread context of 1996	568	spoolsv.exe	87
PID 1424 set thread context of 908	1424	spoolsv.exe	89
PID 2956 set thread context of 2108	2956	spoolsv.exe	91
PID 2636 set thread context of 2756	2636	spoolsv.exe	93
PID 1924 set thread context of 2868	1924	spoolsv.exe	95
PID 2212 set thread context of 2812	2212	spoolsv.exe	97
PID 2924 set thread context of 612	2924	spoolsv.exe	99
PID 396 set thread context of 772	396	spoolsv.exe	101
PID 2720 set thread context of 2752	2720	spoolsv.exe	105
PID 2808 set thread context of 3012	2808	spoolsv.exe	107
PID 1516 set thread context of 1608	1516	spoolsv.exe	109
PID 1736 set thread context of 3056	1736	spoolsv.exe	111
PID 108 set thread context of 1960	108	spoolsv.exe	113
PID 1660 set thread context of 1504	1660	spoolsv.exe	115
PID 2776 set thread context of 1512	2776	spoolsv.exe	117
PID 1952 set thread context of 2332	1952	spoolsv.exe	119
PID 1400 set thread context of 2268	1400	spoolsv.exe	121
PID 3036 set thread context of 2728	3036	spoolsv.exe	123
PID 2764 set thread context of 2552	2764	spoolsv.exe	125
PID 2612 set thread context of 1676	2612	spoolsv.exe	127
PID 2932 set thread context of 1568	2932	spoolsv.exe	129
PID 1304 set thread context of 2424	1304	spoolsv.exe	131
PID 2600 set thread context of 2892	2600	spoolsv.exe	133
PID 2280 set thread context of 2996	2280	spoolsv.exe	135
PID 780 set thread context of 1164	780	spoolsv.exe	137
PID 2176 set thread context of 2136	2176	spoolsv.exe	139
PID 2720 set thread context of 2876	2720	spoolsv.exe	141
PID 2204 set thread context of 1784	2204	spoolsv.exe	143
PID 1592 set thread context of 3036	1592	spoolsv.exe	145
PID 2500 set thread context of 2584	2500	spoolsv.exe	147
PID 2840 set thread context of 984	2840	spoolsv.exe	149
PID 848 set thread context of 1640	848	spoolsv.exe	151
PID 1708 set thread context of 1928	1708	spoolsv.exe	153
PID 1052 set thread context of 916	1052	spoolsv.exe	155
PID 1604 set thread context of 1760	1604	spoolsv.exe	157

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe
304	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
304	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
2492	explorer.exe
304	explorer.exe
304	explorer.exe
2484	spoolsv.exe
304	explorer.exe
304	explorer.exe
308	spoolsv.exe
568	spoolsv.exe
3056	spoolsv.exe
1360	spoolsv.exe
2240	spoolsv.exe
1324	spoolsv.exe
964	spoolsv.exe
2832	spoolsv.exe
1136	spoolsv.exe
2592	spoolsv.exe
2268	spoolsv.exe
1304	spoolsv.exe
3068	spoolsv.exe
2256	spoolsv.exe
2620	spoolsv.exe
1500	spoolsv.exe
1972	spoolsv.exe
684	spoolsv.exe
1644	spoolsv.exe
2780	spoolsv.exe
2624	spoolsv.exe
2540	spoolsv.exe
1012	spoolsv.exe
2168	spoolsv.exe
568	spoolsv.exe
1424	spoolsv.exe
2956	spoolsv.exe
2636	spoolsv.exe
1924	spoolsv.exe
2212	spoolsv.exe
2924	spoolsv.exe
396	spoolsv.exe
2720	spoolsv.exe
2808	spoolsv.exe
1516	spoolsv.exe
1736	spoolsv.exe
108	spoolsv.exe
1660	spoolsv.exe
2776	spoolsv.exe
1952	spoolsv.exe
1400	spoolsv.exe
3036	spoolsv.exe
2764	spoolsv.exe
2612	spoolsv.exe
2932	spoolsv.exe
1304	spoolsv.exe
2600	spoolsv.exe
2280	spoolsv.exe
780	spoolsv.exe
2176	spoolsv.exe
2720	spoolsv.exe
2204	spoolsv.exe
1592	spoolsv.exe
2500	spoolsv.exe
2840	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	28
PID 1520 wrote to memory of 2384	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	29
PID 1520 wrote to memory of 2384	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	29
PID 1520 wrote to memory of 2384	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	29
PID 1520 wrote to memory of 2384	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	29
PID 1520 wrote to memory of 2508	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	32
PID 1520 wrote to memory of 2508	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	32
PID 1520 wrote to memory of 2508	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	32
PID 1520 wrote to memory of 2508	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	32
PID 1520 wrote to memory of 2508	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	32
PID 1520 wrote to memory of 2508	1520	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2492	2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	33
PID 2508 wrote to memory of 2492	2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	33
PID 2508 wrote to memory of 2492	2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	33
PID 2508 wrote to memory of 2492	2508	a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe	33
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 2492 wrote to memory of 572	2492	explorer.exe	34
PID 572 wrote to memory of 304	572	explorer.exe	35
PID 572 wrote to memory of 304	572	explorer.exe	35
PID 572 wrote to memory of 304	572	explorer.exe	35
PID 572 wrote to memory of 304	572	explorer.exe	35
PID 572 wrote to memory of 304	572	explorer.exe	35
PID 572 wrote to memory of 304	572	explorer.exe	35
PID 304 wrote to memory of 2484	304	explorer.exe	36
PID 304 wrote to memory of 2484	304	explorer.exe	36
PID 304 wrote to memory of 2484	304	explorer.exe	36
PID 304 wrote to memory of 2484	304	explorer.exe	36
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37
PID 2484 wrote to memory of 2844	2484	spoolsv.exe	37

C:\Users\Admin\AppData\Local\Temp\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a13d5374adf400bf521dc004804d0abb_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2492
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:572
      - \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Modifies Installed Components in the registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:304
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2844
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3816
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:308
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2880
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4088
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:568
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2088
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3488
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2312
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3316
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:3380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:3524
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1360
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1628
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:1852
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2632
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:2028
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1264
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3256
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:964
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2852
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:3956
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:4076
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2000
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2316
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2120
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1988
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:5092
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1748
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1636
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:2544
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2648
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2568
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1500
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2740
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1972
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1712
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3388
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:684
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1688
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1828
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1632
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2984
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1012
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3008
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1416
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:568
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1996
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1424
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:908
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2108
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2756
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2868
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2812
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:612
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:772
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3064
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1600
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2752
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:2724
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3012
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:5052
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1608
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3056
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:5108
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:108
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1960
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1504
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:584
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:4132
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:4416
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1512
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2332
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2268
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3336
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2728
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2552
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3744
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:1532
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:4428
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1676
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1568
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4424
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2424
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4588
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2892
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2996
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:780
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1164
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2136
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4324
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2876
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1784
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3036
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2584
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:984
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:1660
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:848
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1640
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4296
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1708
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1928
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1052
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:916
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1604
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1760
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2840
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2540
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2532
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1116
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:852
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2176
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4688
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:1788
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2148
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4348
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:2652
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2396
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4544
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:940
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2320
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:1592
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1836
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2492
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2596
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4252
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2860
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2012
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2476
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:108
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2476
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2992
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1032
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2612
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1956
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2992
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3164
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3224
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3268
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3456
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3516
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4344
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3616
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3696
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3740
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3860
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3888
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3948
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4960
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4060
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3152
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3188
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3304
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:588
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3416
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3508
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4912
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3624
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3692
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3744
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3932
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4080
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3120
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3172
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3244
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3188
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3388
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3476
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3568
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3576
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3632
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3660
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3624
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3708
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3768
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3764
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3840
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4012
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4032
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3148
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:852
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3160
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3220
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3112
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2992
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3252
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3296
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1572
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3472
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2680
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3572
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3776
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3872
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4000
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4008
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3176
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3104
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4184
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4204
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4708
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4724
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:5068
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:5044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4184
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

mxdwdui.BUD

Path C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUD
Size 56KB
SHA256 90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
MD5 bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA1 3fd23d4f14da768da7b8364d74c54932d704e74e
SHA512 72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
SSDEEP 768:s6+48uBjBY1WzOCgM7/FRWtz3zEkoHfsKVxf3OxejJolN01JjyAnqsI+E:l89tyFomkoEKVB+sFjRn9I+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\system\explorer.exe
Size 2.6MB
SHA256 e78813e738e2f2a31ac2f78bdd6c7a1e07368f6af0f7a23f14fc770c5db33415
MD5 6529faa5a49b9a03ea261ab60fd13054
SHA1 c14e7919200145b4bc9d979a23daea655e1df108
SHA512 8eb4b80f5dc2c31db4b7b3979301d4cd22d541df7c8a3cbdc8f804deab720f6c02e72517c68744445fd56991be093320869269d521448990107f618c42873faf
SSDEEP 49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlO:86SIROiFJiwp0xlrlO
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \Windows\system\spoolsv.exe
Size 2.6MB
SHA256 ef92832db25c313327cbf9a1d31865516c9b8ab240fecab1d33494550f68e184
MD5 a8569038ca6717ce7334ae278590bcf2
SHA1 cbd8f4bec5ea856f50389190e08186ffefe48fbe
SHA512 901dc3846e2985c3aba2775debb71747caca0f0fa4c92de3c1253c1533cbacb4274e6b114a5e0582c18c3d3baf1b08c9f85bbb68f696f9014fce91d4bb768648
SSDEEP 49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlU:86SIROiFJiwp0xlrlU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/304-543-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/572-58-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/572-77-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/572-60-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/572-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/584-3741-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1520-4-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-3-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-5-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-35-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-7-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-24-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-6-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2240-2-0x0000000000407000-0x0000000000408000-memory.dmp

Download

memory/2492-55-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2492-51-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2508-59-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2508-30-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-32-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2544-3428-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2844-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3256-3523-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3316-3342-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3316-3351-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3336-3562-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3388-3443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3488-3370-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3744-3553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3744-3663-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3816-3269-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3912-3532-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3912-3395-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4088-3301-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4088-3298-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4296-3581-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4544-3611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4688-3659-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4688-3715-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4912-3641-0x0000000000400000-0x000000000043E000-memory.dmp

Download