pony | 42ed5b17e2740a09a015f02416134cff90851eae82f5cd664037a97f26731d27

Analysis

max time kernel
128s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
Size 2.2MB
Sample240617-mzl2la1frj
SHA256 42ed5b17e2740a09a015f02416134cff90851eae82f5cd664037a97f26731d27
MD5 b83de770d923aa1186edafc131987efb
SHA1 108fbe9dbc22a5f1cc73e9f3820c61d29bead7b5
SHA512 a227a7f7aed3bdc2d16ddf53861c09ef4166e5b282060301dd4f1e4561521763f5389e4e0e125bdd77c289b8834ca2ef7be4d4618723c2ae480727129042bca3
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZT:0UzeyQMS4DqodCnoe+iitjWww/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3432	explorer.exe
212	explorer.exe
2992	spoolsv.exe
4680	spoolsv.exe
3716	spoolsv.exe
1608	spoolsv.exe
1944	spoolsv.exe
3296	spoolsv.exe
4604	spoolsv.exe
2272	spoolsv.exe
1808	spoolsv.exe
1356	spoolsv.exe
4692	spoolsv.exe
4392	spoolsv.exe
4992	spoolsv.exe
2604	spoolsv.exe
3452	spoolsv.exe
4720	spoolsv.exe
4160	spoolsv.exe
4380	spoolsv.exe
3448	spoolsv.exe
4560	spoolsv.exe
3552	spoolsv.exe
2096	spoolsv.exe
3476	spoolsv.exe
3480	spoolsv.exe
2408	spoolsv.exe
4880	spoolsv.exe
4036	spoolsv.exe
3540	spoolsv.exe
1180	spoolsv.exe
1840	spoolsv.exe
4940	spoolsv.exe
1684	spoolsv.exe
5044	spoolsv.exe
2092	spoolsv.exe
4484	spoolsv.exe
1932	spoolsv.exe
1848	explorer.exe
5080	spoolsv.exe
4904	spoolsv.exe
2036	spoolsv.exe
3560	spoolsv.exe
1492	spoolsv.exe
4140	spoolsv.exe
3524	explorer.exe
1888	spoolsv.exe
2120	spoolsv.exe
2192	spoolsv.exe
1556	spoolsv.exe
4824	spoolsv.exe
2016	spoolsv.exe
4756	spoolsv.exe
2380	spoolsv.exe
4348	explorer.exe
4968	spoolsv.exe
876	spoolsv.exe
2732	spoolsv.exe
3564	spoolsv.exe
3392	spoolsv.exe
1960	spoolsv.exe
2828	spoolsv.exe
1036	explorer.exe
4408	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 43 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 852	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	86
PID 3432 set thread context of 212	3432	explorer.exe	91
PID 2992 set thread context of 1932	2992	spoolsv.exe	127
PID 4680 set thread context of 5080	4680	spoolsv.exe	129
PID 3716 set thread context of 4904	3716	spoolsv.exe	130
PID 1608 set thread context of 3560	1608	spoolsv.exe	132
PID 1944 set thread context of 1492	1944	spoolsv.exe	133
PID 3296 set thread context of 4140	3296	spoolsv.exe	134
PID 4604 set thread context of 1888	4604	spoolsv.exe	136
PID 2272 set thread context of 2120	2272	spoolsv.exe	169
PID 1808 set thread context of 2192	1808	spoolsv.exe	138
PID 1356 set thread context of 4824	1356	spoolsv.exe	140
PID 4692 set thread context of 2016	4692	spoolsv.exe	141
PID 4392 set thread context of 4756	4392	spoolsv.exe	142
PID 4992 set thread context of 2380	4992	spoolsv.exe	143
PID 2604 set thread context of 4968	2604	spoolsv.exe	145
PID 3452 set thread context of 876	3452	spoolsv.exe	146
PID 4720 set thread context of 2732	4720	spoolsv.exe	147
PID 4160 set thread context of 3392	4160	spoolsv.exe	171
PID 4380 set thread context of 1960	4380	spoolsv.exe	150
PID 3448 set thread context of 2828	3448	spoolsv.exe	151
PID 4560 set thread context of 4408	4560	spoolsv.exe	153
PID 3552 set thread context of 4004	3552	spoolsv.exe	154
PID 2096 set thread context of 1376	2096	spoolsv.exe	155
PID 3476 set thread context of 3696	3476	spoolsv.exe	157
PID 3480 set thread context of 1856	3480	spoolsv.exe	158
PID 2408 set thread context of 1596	2408	spoolsv.exe	159
PID 4880 set thread context of 1488	4880	spoolsv.exe	161
PID 4036 set thread context of 1776	4036	spoolsv.exe	163
PID 3540 set thread context of 860	3540	spoolsv.exe	164
PID 1180 set thread context of 3188	1180	spoolsv.exe	165
PID 1840 set thread context of 3948	1840	spoolsv.exe	166
PID 4940 set thread context of 3944	4940	spoolsv.exe	168
PID 1684 set thread context of 1352	1684	spoolsv.exe	170
PID 5044 set thread context of 3392	5044	spoolsv.exe	171
PID 2092 set thread context of 1484	2092	spoolsv.exe	172
PID 4484 set thread context of 4548	4484	spoolsv.exe	177
PID 1848 set thread context of 2640	1848	explorer.exe	180
PID 2036 set thread context of 1636	2036	spoolsv.exe	185
PID 3524 set thread context of 2216	3524	explorer.exe	190
PID 1556 set thread context of 1064	1556	spoolsv.exe	194
PID 4348 set thread context of 744	4348	explorer.exe	197
PID 3564 set thread context of 1548	3564	spoolsv.exe	202

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
852	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
852	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
212	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
852	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
852	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
212	explorer.exe
1932	spoolsv.exe
1932	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
4904	spoolsv.exe
4904	spoolsv.exe
3560	spoolsv.exe
3560	spoolsv.exe
1492	spoolsv.exe
1492	spoolsv.exe
4140	spoolsv.exe
4140	spoolsv.exe
1888	spoolsv.exe
1888	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2192	spoolsv.exe
2192	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe
2016	spoolsv.exe
2016	spoolsv.exe
4756	spoolsv.exe
4756	spoolsv.exe
2380	spoolsv.exe
2380	spoolsv.exe
4968	spoolsv.exe
4968	spoolsv.exe
876	spoolsv.exe
876	spoolsv.exe
2732	spoolsv.exe
2732	spoolsv.exe
3392	spoolsv.exe
3392	spoolsv.exe
1960	spoolsv.exe
1960	spoolsv.exe
2828	spoolsv.exe
2828	spoolsv.exe
4408	spoolsv.exe
4408	spoolsv.exe
4004	spoolsv.exe
4004	spoolsv.exe
1376	spoolsv.exe
1376	spoolsv.exe
3696	spoolsv.exe
3696	spoolsv.exe
1856	spoolsv.exe
1856	spoolsv.exe
1596	spoolsv.exe
1596	spoolsv.exe
1488	spoolsv.exe
1488	spoolsv.exe
1776	spoolsv.exe
1776	spoolsv.exe
860	spoolsv.exe
860	spoolsv.exe
3188	spoolsv.exe
3188	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1712	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	81
PID 1916 wrote to memory of 1712	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	81
PID 1916 wrote to memory of 852	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	86
PID 1916 wrote to memory of 852	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	86
PID 1916 wrote to memory of 852	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	86
PID 1916 wrote to memory of 852	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	86
PID 1916 wrote to memory of 852	1916	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	86
PID 852 wrote to memory of 3432	852	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	87
PID 852 wrote to memory of 3432	852	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	87
PID 852 wrote to memory of 3432	852	b83de770d923aa1186edafc131987efb_JaffaCakes118.exe	87
PID 3432 wrote to memory of 212	3432	explorer.exe	91
PID 3432 wrote to memory of 212	3432	explorer.exe	91
PID 3432 wrote to memory of 212	3432	explorer.exe	91
PID 3432 wrote to memory of 212	3432	explorer.exe	91
PID 3432 wrote to memory of 212	3432	explorer.exe	91
PID 212 wrote to memory of 2992	212	explorer.exe	92
PID 212 wrote to memory of 2992	212	explorer.exe	92
PID 212 wrote to memory of 2992	212	explorer.exe	92
PID 212 wrote to memory of 4680	212	explorer.exe	93
PID 212 wrote to memory of 4680	212	explorer.exe	93
PID 212 wrote to memory of 4680	212	explorer.exe	93
PID 212 wrote to memory of 3716	212	explorer.exe	94
PID 212 wrote to memory of 3716	212	explorer.exe	94
PID 212 wrote to memory of 3716	212	explorer.exe	94
PID 212 wrote to memory of 1608	212	explorer.exe	95
PID 212 wrote to memory of 1608	212	explorer.exe	95
PID 212 wrote to memory of 1608	212	explorer.exe	95
PID 212 wrote to memory of 1944	212	explorer.exe	96
PID 212 wrote to memory of 1944	212	explorer.exe	96
PID 212 wrote to memory of 1944	212	explorer.exe	96
PID 212 wrote to memory of 3296	212	explorer.exe	97
PID 212 wrote to memory of 3296	212	explorer.exe	97
PID 212 wrote to memory of 3296	212	explorer.exe	97
PID 212 wrote to memory of 4604	212	explorer.exe	98
PID 212 wrote to memory of 4604	212	explorer.exe	98
PID 212 wrote to memory of 4604	212	explorer.exe	98
PID 212 wrote to memory of 2272	212	explorer.exe	99
PID 212 wrote to memory of 2272	212	explorer.exe	99
PID 212 wrote to memory of 2272	212	explorer.exe	99
PID 212 wrote to memory of 1808	212	explorer.exe	100
PID 212 wrote to memory of 1808	212	explorer.exe	100
PID 212 wrote to memory of 1808	212	explorer.exe	100
PID 212 wrote to memory of 1356	212	explorer.exe	101
PID 212 wrote to memory of 1356	212	explorer.exe	101
PID 212 wrote to memory of 1356	212	explorer.exe	101
PID 212 wrote to memory of 4692	212	explorer.exe	102
PID 212 wrote to memory of 4692	212	explorer.exe	102
PID 212 wrote to memory of 4692	212	explorer.exe	102
PID 212 wrote to memory of 4392	212	explorer.exe	103
PID 212 wrote to memory of 4392	212	explorer.exe	103
PID 212 wrote to memory of 4392	212	explorer.exe	103
PID 212 wrote to memory of 4992	212	explorer.exe	104
PID 212 wrote to memory of 4992	212	explorer.exe	104
PID 212 wrote to memory of 4992	212	explorer.exe	104
PID 212 wrote to memory of 2604	212	explorer.exe	105
PID 212 wrote to memory of 2604	212	explorer.exe	105
PID 212 wrote to memory of 2604	212	explorer.exe	105
PID 212 wrote to memory of 3452	212	explorer.exe	106
PID 212 wrote to memory of 3452	212	explorer.exe	106
PID 212 wrote to memory of 3452	212	explorer.exe	106
PID 212 wrote to memory of 4720	212	explorer.exe	107
PID 212 wrote to memory of 4720	212	explorer.exe	107
PID 212 wrote to memory of 4720	212	explorer.exe	107
PID 212 wrote to memory of 4160	212	explorer.exe	108

C:\Users\Admin\AppData\Local\Temp\b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b83de770d923aa1186edafc131987efb_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\b83de770d923aa1186edafc131987efb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b83de770d923aa1186edafc131987efb_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:852
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1848
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3524
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4348
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1036
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3740
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4924
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:948
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4208
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1428
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1472
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3964
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 9ae466331a70b7a302ac4b503056ad2e0933859fb61208e6503de21bdacc72f0
MD5 f1b943cb52caf913ed9d3c5381afabbd
SHA1 bdab4c02674504534754091d7d22de8f9cfa2625
SHA512 dfc743bbf99c335800d3b455bc8701795e2ba774a20f59834d7b919e734775292c9f8e169d0f6a2872e108e5cde1f8955fd4a1a74d3d6e829fa5b4645f96c01a
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 9b481f3a5dc141691e65dee748b84833ee8f0b0243cf644ef5905ba253f9b17e
MD5 07c9a248a06173646b87ad4da227082d
SHA1 7809b4c06dd1fdef7edba5d7f87a0ffeab1d22c3
SHA512 63ba2926300a5824f52d5be12477a425e7e415b61753b66ad6c39e8fc461a70c249a760007f86b1be01a2b8f3c05b1edc841b948c5f53a99ad95003db33162f7
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-1030-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/212-100-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/744-4896-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/744-4892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/752-6105-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/852-82-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/852-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/852-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/852-39-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/860-3338-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-2848-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-2852-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-4857-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-4735-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1352-3499-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1356-1635-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1376-3047-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-5985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-5876-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1472-6085-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1484-3520-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1488-3241-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1492-2533-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1548-5282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1552-6458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1596-3397-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1596-3233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1608-1244-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1776-3326-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-5401-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1808-1634-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1856-3160-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1888-2609-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1916-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1916-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1916-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/1916-38-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/1932-2390-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1932-2562-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1944-1435-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1960-2967-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-2737-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-2732-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2096-2387-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2120-2622-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2192-6093-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2192-2632-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2216-4546-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2216-4549-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2272-1633-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2316-6247-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2380-2997-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2380-2830-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2408-2410-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2468-5603-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2468-5491-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2472-6365-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2604-1836-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2640-4070-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2640-4079-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2680-6125-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-2870-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2828-3185-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2828-3019-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2992-1031-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2992-2391-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3120-6488-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3188-3347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3296-1436-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3392-3509-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3392-2949-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3392-2946-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3432-101-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3432-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3448-2232-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3452-2045-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3476-2388-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3480-2399-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3492-6477-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3552-2386-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3560-2511-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3696-3135-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3716-1243-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3716-2404-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3944-3423-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3948-3415-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3964-6334-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4004-3040-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4140-2800-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4140-2601-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4160-2047-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4316-6237-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4380-2231-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4392-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4408-3028-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4548-3879-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4548-3992-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4560-2233-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4604-1437-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4680-1242-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4680-2397-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4692-1636-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4720-2046-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4756-2744-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4824-2723-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4828-5771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4904-2411-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4968-2837-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4968-2842-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4988-6229-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4992-1835-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5080-2400-0x0000000000400000-0x000000000043E000-memory.dmp

Download