pony | c3d4d847368b9cc8630ae01763f71a75f2fa9b28afd713464eb2d42e1e6e0bbe

Analysis

max time kernel
117s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
Size 2.2MB
Sample240613-2cvsjssgkb
SHA256 c3d4d847368b9cc8630ae01763f71a75f2fa9b28afd713464eb2d42e1e6e0bbe
MD5 a6e0059d46ab66c2e4e8283d860fc5bc
SHA1 7aa6f4c5eb3c343cccee59327af44902c1553f08
SHA512 b65cb32c2312d904c5312fe1b11a31989bf58201c7f64c3bab266ab311bacf0bf2fca1c9ff22a7bd11583f1cf9020ca935dc2515cc8531c5c77ed2e6e2c04078
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZo:0UzeyQMS4DqodCnoe+iitjWwwE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
5072	explorer.exe
2584	explorer.exe
4340	spoolsv.exe
2720	spoolsv.exe
2936	spoolsv.exe
4252	spoolsv.exe
512	spoolsv.exe
2108	spoolsv.exe
4376	spoolsv.exe
2288	spoolsv.exe
3956	spoolsv.exe
2332	spoolsv.exe
5080	spoolsv.exe
4896	spoolsv.exe
636	spoolsv.exe
4484	spoolsv.exe
5020	spoolsv.exe
3492	spoolsv.exe
4696	spoolsv.exe
716	spoolsv.exe
3816	spoolsv.exe
4920	spoolsv.exe
1588	spoolsv.exe
4992	spoolsv.exe
5076	spoolsv.exe
4880	spoolsv.exe
3124	spoolsv.exe
3272	spoolsv.exe
4004	spoolsv.exe
4712	spoolsv.exe
4464	spoolsv.exe
4656	spoolsv.exe
4496	spoolsv.exe
2536	spoolsv.exe
1560	explorer.exe
3396	spoolsv.exe
3692	spoolsv.exe
4148	spoolsv.exe
1440	spoolsv.exe
712	explorer.exe
4320	spoolsv.exe
2240	spoolsv.exe
3712	spoolsv.exe
2364	spoolsv.exe
3496	spoolsv.exe
624	explorer.exe
3972	spoolsv.exe
1656	spoolsv.exe
2608	spoolsv.exe
2912	spoolsv.exe
1824	explorer.exe
4708	spoolsv.exe
4792	spoolsv.exe
1436	spoolsv.exe
1424	spoolsv.exe
5008	spoolsv.exe
2796	explorer.exe
2020	spoolsv.exe
3648	spoolsv.exe
3120	spoolsv.exe
1512	spoolsv.exe
2072	spoolsv.exe
224	explorer.exe
2752	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 36 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 1388	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	86
PID 5072 set thread context of 2584	5072	explorer.exe	95
PID 4340 set thread context of 2536	4340	spoolsv.exe	127
PID 2720 set thread context of 3396	2720	spoolsv.exe	129
PID 2936 set thread context of 3692	2936	spoolsv.exe	130
PID 4252 set thread context of 1440	4252	spoolsv.exe	132
PID 512 set thread context of 4320	512	spoolsv.exe	134
PID 2108 set thread context of 2240	2108	spoolsv.exe	135
PID 4376 set thread context of 3712	4376	spoolsv.exe	136
PID 2288 set thread context of 3496	2288	spoolsv.exe	138
PID 3956 set thread context of 3972	3956	spoolsv.exe	140
PID 2332 set thread context of 1656	2332	spoolsv.exe	141
PID 5080 set thread context of 2912	5080	spoolsv.exe	143
PID 4896 set thread context of 4708	4896	spoolsv.exe	145
PID 636 set thread context of 4792	636	spoolsv.exe	146
PID 4484 set thread context of 1436	4484	spoolsv.exe	147
PID 5020 set thread context of 5008	5020	spoolsv.exe	149
PID 3492 set thread context of 2020	3492	spoolsv.exe	151
PID 4696 set thread context of 3648	4696	spoolsv.exe	152
PID 716 set thread context of 3120	716	spoolsv.exe	153
PID 3816 set thread context of 2072	3816	spoolsv.exe	155
PID 4920 set thread context of 2752	4920	spoolsv.exe	157
PID 1588 set thread context of 1280	1588	spoolsv.exe	158
PID 4992 set thread context of 1848	4992	spoolsv.exe	160
PID 5076 set thread context of 4960	5076	spoolsv.exe	161
PID 4880 set thread context of 3248	4880	spoolsv.exe	162
PID 3124 set thread context of 4384	3124	spoolsv.exe	165
PID 3272 set thread context of 2804	3272	spoolsv.exe	166
PID 4004 set thread context of 2008	4004	spoolsv.exe	168
PID 4712 set thread context of 3660	4712	spoolsv.exe	170
PID 4464 set thread context of 2924	4464	spoolsv.exe	171
PID 4656 set thread context of 3256	4656	spoolsv.exe	173
PID 1560 set thread context of 2000	1560	explorer.exe	176
PID 4496 set thread context of 5044	4496	spoolsv.exe	177
PID 4148 set thread context of 2940	4148	spoolsv.exe	182
PID 712 set thread context of 1072	712	explorer.exe	184

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1388	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
1388	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1388	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
1388	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2536	spoolsv.exe
2536	spoolsv.exe
3396	spoolsv.exe
3396	spoolsv.exe
3692	spoolsv.exe
3692	spoolsv.exe
1440	spoolsv.exe
1440	spoolsv.exe
4320	spoolsv.exe
4320	spoolsv.exe
2240	spoolsv.exe
2240	spoolsv.exe
3712	spoolsv.exe
3712	spoolsv.exe
3496	spoolsv.exe
3496	spoolsv.exe
3972	spoolsv.exe
3972	spoolsv.exe
1656	spoolsv.exe
1656	spoolsv.exe
2912	spoolsv.exe
2912	spoolsv.exe
4708	spoolsv.exe
4708	spoolsv.exe
4792	spoolsv.exe
4792	spoolsv.exe
1436	spoolsv.exe
1436	spoolsv.exe
5008	spoolsv.exe
5008	spoolsv.exe
2020	spoolsv.exe
2020	spoolsv.exe
3648	spoolsv.exe
3648	spoolsv.exe
3120	spoolsv.exe
3120	spoolsv.exe
2072	spoolsv.exe
2072	spoolsv.exe
2752	spoolsv.exe
2752	spoolsv.exe
1280	spoolsv.exe
1280	spoolsv.exe
1848	spoolsv.exe
1848	spoolsv.exe
4960	spoolsv.exe
4960	spoolsv.exe
3248	spoolsv.exe
3248	spoolsv.exe
4384	spoolsv.exe
4384	spoolsv.exe
2804	spoolsv.exe
2804	spoolsv.exe
2008	spoolsv.exe
2008	spoolsv.exe
3660	spoolsv.exe
3660	spoolsv.exe
2924	spoolsv.exe
2924	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 5088	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	81
PID 2176 wrote to memory of 5088	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	81
PID 2176 wrote to memory of 1388	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	86
PID 2176 wrote to memory of 1388	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	86
PID 2176 wrote to memory of 1388	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	86
PID 2176 wrote to memory of 1388	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	86
PID 2176 wrote to memory of 1388	2176	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	86
PID 1388 wrote to memory of 5072	1388	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	87
PID 1388 wrote to memory of 5072	1388	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	87
PID 1388 wrote to memory of 5072	1388	a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe	87
PID 5072 wrote to memory of 2584	5072	explorer.exe	95
PID 5072 wrote to memory of 2584	5072	explorer.exe	95
PID 5072 wrote to memory of 2584	5072	explorer.exe	95
PID 5072 wrote to memory of 2584	5072	explorer.exe	95
PID 5072 wrote to memory of 2584	5072	explorer.exe	95
PID 2584 wrote to memory of 4340	2584	explorer.exe	96
PID 2584 wrote to memory of 4340	2584	explorer.exe	96
PID 2584 wrote to memory of 4340	2584	explorer.exe	96
PID 2584 wrote to memory of 2720	2584	explorer.exe	97
PID 2584 wrote to memory of 2720	2584	explorer.exe	97
PID 2584 wrote to memory of 2720	2584	explorer.exe	97
PID 2584 wrote to memory of 2936	2584	explorer.exe	98
PID 2584 wrote to memory of 2936	2584	explorer.exe	98
PID 2584 wrote to memory of 2936	2584	explorer.exe	98
PID 2584 wrote to memory of 4252	2584	explorer.exe	99
PID 2584 wrote to memory of 4252	2584	explorer.exe	99
PID 2584 wrote to memory of 4252	2584	explorer.exe	99
PID 2584 wrote to memory of 512	2584	explorer.exe	100
PID 2584 wrote to memory of 512	2584	explorer.exe	100
PID 2584 wrote to memory of 512	2584	explorer.exe	100
PID 2584 wrote to memory of 2108	2584	explorer.exe	101
PID 2584 wrote to memory of 2108	2584	explorer.exe	101
PID 2584 wrote to memory of 2108	2584	explorer.exe	101
PID 2584 wrote to memory of 4376	2584	explorer.exe	102
PID 2584 wrote to memory of 4376	2584	explorer.exe	102
PID 2584 wrote to memory of 4376	2584	explorer.exe	102
PID 2584 wrote to memory of 2288	2584	explorer.exe	103
PID 2584 wrote to memory of 2288	2584	explorer.exe	103
PID 2584 wrote to memory of 2288	2584	explorer.exe	103
PID 2584 wrote to memory of 3956	2584	explorer.exe	104
PID 2584 wrote to memory of 3956	2584	explorer.exe	104
PID 2584 wrote to memory of 3956	2584	explorer.exe	104
PID 2584 wrote to memory of 2332	2584	explorer.exe	105
PID 2584 wrote to memory of 2332	2584	explorer.exe	105
PID 2584 wrote to memory of 2332	2584	explorer.exe	105
PID 2584 wrote to memory of 5080	2584	explorer.exe	106
PID 2584 wrote to memory of 5080	2584	explorer.exe	106
PID 2584 wrote to memory of 5080	2584	explorer.exe	106
PID 2584 wrote to memory of 4896	2584	explorer.exe	107
PID 2584 wrote to memory of 4896	2584	explorer.exe	107
PID 2584 wrote to memory of 4896	2584	explorer.exe	107
PID 2584 wrote to memory of 636	2584	explorer.exe	108
PID 2584 wrote to memory of 636	2584	explorer.exe	108
PID 2584 wrote to memory of 636	2584	explorer.exe	108
PID 2584 wrote to memory of 4484	2584	explorer.exe	109
PID 2584 wrote to memory of 4484	2584	explorer.exe	109
PID 2584 wrote to memory of 4484	2584	explorer.exe	109
PID 2584 wrote to memory of 5020	2584	explorer.exe	110
PID 2584 wrote to memory of 5020	2584	explorer.exe	110
PID 2584 wrote to memory of 5020	2584	explorer.exe	110
PID 2584 wrote to memory of 3492	2584	explorer.exe	111
PID 2584 wrote to memory of 3492	2584	explorer.exe	111
PID 2584 wrote to memory of 3492	2584	explorer.exe	111
PID 2584 wrote to memory of 4696	2584	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a6e0059d46ab66c2e4e8283d860fc5bc_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1388
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1560
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:712
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3496
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:624
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1824
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2796
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:848
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3256
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4576
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:828
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2940
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2136
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4164
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4660
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3424
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4604
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4680
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1164
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4480
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 dc4d68789d70e411f643f4e63695f7703402fe551464dda247baf7ea2b7a89fc
MD5 67021ed102c4fc49752a6863de907365
SHA1 417f7a6751c0bff870ab9d5188d8748aec693300
SHA512 10bf980aa099a6ade0d58b27e3564f073ec1ac18c9b7b52ca5fb8dcf2d81e9c272505b26c1153b77ba52174b81d743c5fac0b5539c22433c0d9c9902edb18ae0
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwR
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 bb8b12a0b70d9c008b0263a374af25074dcbe4b6745302c2f434c58bfe2baed2
MD5 fd7ccfda96fb9c169168d9feae08ea7a
SHA1 f0726c5d03ff82e8360b515cdb36e9612a72217f
SHA512 bd7886984055b5320838b3f217ffbff17068925a5c3c2f716f11ff4a278229693a0fabd3a4620eb43ac5efa06a8cf3306ba83672746946f4e08a03ef4a3d4954
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZD:0UzeyQMS4DqodCnoe+iitjWwwv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-1078-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/636-1625-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/716-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/920-5747-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1072-3699-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1164-5400-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1164-5512-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1196-4933-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1268-5409-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1280-2804-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1280-2800-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1316-4928-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1316-4930-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1388-42-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1388-73-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1388-39-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1436-2470-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1440-2237-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1440-2117-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1488-4068-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1496-5759-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1588-1992-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1608-5206-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1608-5382-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1656-2290-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1848-2881-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-3536-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-3158-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-3218-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2020-2619-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2044-4576-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2072-2947-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2072-2771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2108-1079-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2176-0-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/2176-44-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2176-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2176-38-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/2240-2137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2288-1251-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2332-1445-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2448-4078-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2536-2054-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2536-1984-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2552-5217-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2584-808-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2584-88-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2720-1994-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2720-950-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2752-2784-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2752-2780-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2912-2437-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2912-2584-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2924-3172-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2936-951-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2936-2006-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2940-3689-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2940-3790-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-2640-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3248-2969-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3248-3098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3256-3465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3392-5006-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3396-1993-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3492-1751-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3496-2380-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3496-2271-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3620-5082-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3648-2627-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3648-2630-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3660-3163-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3660-3167-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3692-2003-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3692-2005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3712-2148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3816-1982-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3956-1252-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3972-2278-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4112-5545-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4164-3977-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4164-3879-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4252-952-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4320-2128-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4324-5455-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4324-5436-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-1985-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4340-809-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4376-1250-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4384-3024-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-5671-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-5539-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4604-4415-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4604-4283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4680-4985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4680-4856-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4696-1752-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4708-2450-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4792-2459-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4828-5226-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4832-4772-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4860-5022-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-1447-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4920-1983-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4968-3889-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4992-2017-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5008-2607-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5008-2748-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-1750-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5072-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5072-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5076-2116-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5080-1446-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5112-5236-0x0000000000400000-0x000000000043E000-memory.dmp

Download