pony | 6f9f5ca03f6e8703fe62609485051bfd298505331b2d8783bb39e5bd130cc0d3

Analysis

max time kernel
83s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
Size

2.6MB
MD5

dc65f47cdf39eba39785cef7609de2ac
SHA1

b69f839e1bc077ace500cbb3aa2677a562fcbb0c
SHA256

6f9f5ca03f6e8703fe62609485051bfd298505331b2d8783bb39e5bd130cc0d3
SHA512

83ba2d9631abab9895dd5966c6ace3b071ede1d08e71e7ea5b26f0cc59d1c2d90a72fe8cb815fd11f53c0bd8f2a8c957bff1eca6bad64cb0e443cc231e23e18e
SSDEEP

49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlM:86SIROiFJiwp0xlrlM

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2760	explorer.exe
1688	explorer.exe
1996	explorer.exe
364	spoolsv.exe
812	spoolsv.exe
852	spoolsv.exe
2472	spoolsv.exe
1404	spoolsv.exe
1928	spoolsv.exe
1724	spoolsv.exe
1108	spoolsv.exe
3052	spoolsv.exe
1064	spoolsv.exe
1576	spoolsv.exe
2800	spoolsv.exe
2660	spoolsv.exe
1752	spoolsv.exe
1516	spoolsv.exe
936	spoolsv.exe
2272	spoolsv.exe
2176	spoolsv.exe
2180	spoolsv.exe
2312	spoolsv.exe
2464	spoolsv.exe
2276	spoolsv.exe
1724	spoolsv.exe
388	spoolsv.exe
2380	spoolsv.exe
1716	spoolsv.exe
2156	spoolsv.exe
2840	spoolsv.exe
2752	spoolsv.exe
2620	spoolsv.exe
2292	spoolsv.exe
1956	spoolsv.exe
2736	spoolsv.exe
1704	spoolsv.exe
2072	spoolsv.exe
2300	spoolsv.exe
2448	spoolsv.exe
1544	spoolsv.exe
924	spoolsv.exe
1760	spoolsv.exe
2420	spoolsv.exe
2844	spoolsv.exe
2280	spoolsv.exe
2424	spoolsv.exe
2200	spoolsv.exe
2032	spoolsv.exe
108	spoolsv.exe
2820	spoolsv.exe
2064	spoolsv.exe
2152	spoolsv.exe
1536	spoolsv.exe
2852	spoolsv.exe
2976	spoolsv.exe
1976	spoolsv.exe
2332	spoolsv.exe
2596	spoolsv.exe
2924	spoolsv.exe
2716	spoolsv.exe
1696	spoolsv.exe
1472	spoolsv.exe
1756	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
2760	explorer.exe
1996	explorer.exe
1996	explorer.exe
364	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
852	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
1404	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
1724	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
3052	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
1576	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2660	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
1516	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2272	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2180	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2464	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
1724	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2380	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2156	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2752	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2292	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2736	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2072	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
2448	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
924	spoolsv.exe
1996	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2172 set thread context of 2864	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	31
PID 2760 set thread context of 1688	2760	explorer.exe	33
PID 1688 set thread context of 1996	1688	explorer.exe	34
PID 364 set thread context of 812	364	spoolsv.exe	36
PID 852 set thread context of 2472	852	spoolsv.exe	38
PID 1404 set thread context of 1928	1404	spoolsv.exe	40
PID 1724 set thread context of 1108	1724	spoolsv.exe	42
PID 3052 set thread context of 1064	3052	spoolsv.exe	44
PID 1576 set thread context of 2800	1576	spoolsv.exe	46
PID 2660 set thread context of 1752	2660	spoolsv.exe	48
PID 1516 set thread context of 936	1516	spoolsv.exe	50
PID 2272 set thread context of 2176	2272	spoolsv.exe	52
PID 2180 set thread context of 2312	2180	spoolsv.exe	54
PID 2464 set thread context of 2276	2464	spoolsv.exe	56
PID 1724 set thread context of 388	1724	spoolsv.exe	58
PID 2380 set thread context of 1716	2380	spoolsv.exe	60
PID 2156 set thread context of 2840	2156	spoolsv.exe	62
PID 2752 set thread context of 2620	2752	spoolsv.exe	64
PID 2292 set thread context of 1956	2292	spoolsv.exe	66
PID 2736 set thread context of 1704	2736	spoolsv.exe	68
PID 2072 set thread context of 2300	2072	spoolsv.exe	70
PID 2448 set thread context of 1544	2448	spoolsv.exe	72
PID 924 set thread context of 1760	924	spoolsv.exe	74
PID 2420 set thread context of 2844	2420	spoolsv.exe	76
PID 2280 set thread context of 2424	2280	spoolsv.exe	78
PID 2200 set thread context of 2032	2200	spoolsv.exe	80
PID 108 set thread context of 2820	108	spoolsv.exe	82
PID 2064 set thread context of 2152	2064	spoolsv.exe	84
PID 1536 set thread context of 2852	1536	spoolsv.exe	86
PID 2976 set thread context of 1976	2976	spoolsv.exe	88
PID 2332 set thread context of 2596	2332	spoolsv.exe	90
PID 2924 set thread context of 2716	2924	spoolsv.exe	92
PID 1696 set thread context of 1472	1696	spoolsv.exe	94
PID 1756 set thread context of 2264	1756	spoolsv.exe	96
PID 1124 set thread context of 2072	1124	spoolsv.exe	98
PID 1404 set thread context of 1592	1404	spoolsv.exe	100
PID 2340 set thread context of 2796	2340	spoolsv.exe	102
PID 1576 set thread context of 2752	1576	spoolsv.exe	104
PID 1276 set thread context of 1168	1276	spoolsv.exe	106
PID 2220 set thread context of 2992	2220	spoolsv.exe	108
PID 2144 set thread context of 1536	2144	spoolsv.exe	110
PID 2944 set thread context of 2876	2944	spoolsv.exe	112
PID 1208 set thread context of 1944	1208	spoolsv.exe	114
PID 2408 set thread context of 1128	2408	spoolsv.exe	116
PID 1560 set thread context of 1700	1560	spoolsv.exe	118
PID 2144 set thread context of 1532	2144	spoolsv.exe	120
PID 3064 set thread context of 1756	3064	spoolsv.exe	122
PID 2288 set thread context of 2220	2288	spoolsv.exe	124
PID 1724 set thread context of 2500	1724	spoolsv.exe	126
PID 2924 set thread context of 628	2924	spoolsv.exe	128
PID 2684 set thread context of 1124	2684	spoolsv.exe	130
PID 1732 set thread context of 2420	1732	spoolsv.exe	132
PID 1628 set thread context of 2648	1628	spoolsv.exe	134
PID 1572 set thread context of 2832	1572	spoolsv.exe	136
PID 2268 set thread context of 2288	2268	spoolsv.exe	138
PID 584 set thread context of 1572	584	spoolsv.exe	140
PID 2496 set thread context of 2564	2496	spoolsv.exe	142
PID 2900 set thread context of 2956	2900	spoolsv.exe	144
PID 2040 set thread context of 1696	2040	spoolsv.exe	146
PID 276 set thread context of 2772	276	spoolsv.exe	148
PID 2268 set thread context of 2980	2268	spoolsv.exe	150
PID 2924 set thread context of 2684	2924	spoolsv.exe	152
PID 2940 set thread context of 2900	2940	spoolsv.exe	154

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe
1996	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1996	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
2760	explorer.exe
1996	explorer.exe
1996	explorer.exe
364	spoolsv.exe
1996	explorer.exe
1996	explorer.exe
852	spoolsv.exe
1404	spoolsv.exe
1724	spoolsv.exe
3052	spoolsv.exe
1576	spoolsv.exe
2660	spoolsv.exe
1516	spoolsv.exe
2272	spoolsv.exe
2180	spoolsv.exe
2464	spoolsv.exe
1724	spoolsv.exe
2380	spoolsv.exe
2156	spoolsv.exe
2752	spoolsv.exe
2292	spoolsv.exe
2736	spoolsv.exe
2072	spoolsv.exe
2448	spoolsv.exe
924	spoolsv.exe
2420	spoolsv.exe
2280	spoolsv.exe
2200	spoolsv.exe
108	spoolsv.exe
2064	spoolsv.exe
1536	spoolsv.exe
2976	spoolsv.exe
2332	spoolsv.exe
2924	spoolsv.exe
1696	spoolsv.exe
1756	spoolsv.exe
1124	spoolsv.exe
1404	spoolsv.exe
2340	spoolsv.exe
1576	spoolsv.exe
1276	spoolsv.exe
2220	spoolsv.exe
2144	spoolsv.exe
2944	spoolsv.exe
1208	spoolsv.exe
2408	spoolsv.exe
1560	spoolsv.exe
2144	spoolsv.exe
3064	spoolsv.exe
2288	spoolsv.exe
1724	spoolsv.exe
2924	spoolsv.exe
2684	spoolsv.exe
1732	spoolsv.exe
1628	spoolsv.exe
1572	spoolsv.exe
2268	spoolsv.exe
584	spoolsv.exe
2496	spoolsv.exe
2900	spoolsv.exe
2040	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2172	2420	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	29
PID 2172 wrote to memory of 1804	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	30
PID 2172 wrote to memory of 1804	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	30
PID 2172 wrote to memory of 1804	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	30
PID 2172 wrote to memory of 1804	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2864	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2864	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2864	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2864	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2864	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2864	2172	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2760	2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2760	2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2760	2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2760	2864	dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe	32
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 2760 wrote to memory of 1688	2760	explorer.exe	33
PID 1688 wrote to memory of 1996	1688	explorer.exe	34
PID 1688 wrote to memory of 1996	1688	explorer.exe	34
PID 1688 wrote to memory of 1996	1688	explorer.exe	34
PID 1688 wrote to memory of 1996	1688	explorer.exe	34
PID 1688 wrote to memory of 1996	1688	explorer.exe	34
PID 1688 wrote to memory of 1996	1688	explorer.exe	34
PID 1996 wrote to memory of 364	1996	explorer.exe	35
PID 1996 wrote to memory of 364	1996	explorer.exe	35
PID 1996 wrote to memory of 364	1996	explorer.exe	35
PID 1996 wrote to memory of 364	1996	explorer.exe	35
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36
PID 364 wrote to memory of 812	364	spoolsv.exe	36

C:\Users\Admin\AppData\Local\Temp\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dc65f47cdf39eba39785cef7609de2ac_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2760
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1688
      - \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:364
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:812
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4060
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:852
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2472
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3460
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:3560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:3684
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1404
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1928
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3900
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:3992
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:2140
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1108
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3088
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3408
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1752
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4376
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:936
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2176
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4496
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3488
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2276
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3532
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:388
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:2792
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1716
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2840
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4056
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1956
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:276
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:5024
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4980
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1544
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4992
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4268
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        
        PID:4516
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:4892
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2844
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4660
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2032
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:108
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2820
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1976
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3124
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4768
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:2716
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3856
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        
        PID:1472
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1756
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1124
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1404
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1592
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2796
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2752
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1168
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2220
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2992
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3920
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1536
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4036
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1208
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1944
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:2584
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:2124
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:1532
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1756
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2288
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2220
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4120
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:628
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2648
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4000
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:584
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:1572
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2564
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:2076
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2900
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:276
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2772
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        
        PID:2268
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2980
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        
        PID:2924
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2684
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2900
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:2224
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2416
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1096
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2780
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4640
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1120
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:836
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:2484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:708
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:2480
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3520
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:1408
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2764
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1452
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        Drops file in Windows directory
        
        PID:2872
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2224
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:2140
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3172
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3248
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4480
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3376
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3420
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4964
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3632
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:4856
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3652
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3712
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3840
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3840
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3948
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4032
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3112
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3228
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3176
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3368
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3540
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3488
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3692
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3752
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3832
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3840
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4068
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3140
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4032
        
        \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        9⤵
        
        PID:3092
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3232
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3276
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3316
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3328
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3352
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3492
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3536
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3616
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3680
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3704
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3732
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3760
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3784
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3768
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3824
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3876
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3816
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3752
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3940
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4020
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3120
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3236
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3376
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3428
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3532
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3372
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3780
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3820
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4016
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3088
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3228
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3996
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3404
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3620
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3708
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:2252
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4548
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4572
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3084
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:3200
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4292
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4920
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:4728
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:4356
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:3080
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        8⤵
        
        PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
\Windows\system\explorer.exe

Filesize
2.6MB

MD5
41dec1678596f2991cc66e72fad89329

SHA1
4e43b2e36840102bb3ad056455281ccea51cdd8c

SHA256
fd167a78834039b48e1aede6b8a3c9ada74bd212a2a3931ee1785addadddb486

SHA512
347a04fc52d2d56abed604f71fb97e7e9c39072996a05e37a708f14c2e87255e62fdfe51e95dee135c1eeb55515b2f260d4bb3f579ba6957e1ba7b08f36778f7

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.6MB

MD5
bf46dd8dc09214988b64e2b7a71be4ee

SHA1
b3c85d69cd1247b3e564a44cf7215fd24b546422

SHA256
d92905b1b7c7059b9159abcfe29d82d4801c7409ee985b23ca6c2606a9a8b00d

SHA512
9ad16a4d4c38406493545131e1117f49430616f4d4b051cd94bbb0e5ad542d92b86c7048df99dce26bafca08a39e3d3a6ff02ab5109aa3324a03ea77f5b03bce

Download Submit
memory/812-109-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1688-88-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1688-81-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1688-63-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1688-60-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1996-3522-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1996-540-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2076-3682-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2172-23-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2172-6-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2172-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2172-3-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2172-5-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2172-7-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2172-4-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2420-2-0x0000000000407000-0x0000000000408000-memory.dmp

Filesize
4KB

Download
memory/2584-3513-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2760-53-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2760-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-3603-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-37-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-62-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3092-3641-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3124-3381-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3408-3147-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3460-3054-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3460-3065-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-3168-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3520-3586-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3840-3626-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3856-3708-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3900-3154-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3900-3085-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3920-3262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4036-3261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4056-3199-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4060-2988-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4120-3398-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4268-3295-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4376-3327-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4660-3443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4768-3425-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-3357-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-3782-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download