sleepy-printer: The Case of the Midnight Exfiltrator

A user reported their workstation behaving oddly after opening a PDF from an unknown sender. The machine was running slow and the printer kept trying to connect to strange IP addresses. Security captured a memory dump before the system was powered down.

Your forensics team extracted key artifacts from the memory dump. The process tree shows: System (PID 4) → services.exe (PID 620) → spoolsv.exe (PID 1844) → svchost.exe (PID 2912). Analysis of PID 2912 reveals injected code in memory region 0x02A40000-0x02A60000. Hex dump of that region:

4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C010300A7B23F6500000000000000E00022010B010E00001000000010000000000000002000000010000000100000000400000010000000020000060000000000000006000000000000000600000000000000000100000000000001000000000000000100000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002E74657874000000F40F000000100000001000000010000000000000000000000000000020000060

A strings dump from the injected memory shows: "C2_SERVER=192.168.45.222:8443" and "TARGET_FILE=financial_report_q4_2023.xlsx". Network connection analysis reveals PID 2912 established a connection to 192.168.45.222:8443 at 02:47:33 UTC. A carved file fragment from process memory at offset 0x02A5C000 contains: "X09GaW5hbmNpYWwgUmVwb3J0IFE0IDIwMjMKClRvdGFsIFJldmVudWU6ICQxMi4zbQpQcm9qZWN0IENvZGVuYW1lOiBPUEVSQVRJT05fU0hBRE9XQk9MVC0yMDI0" followed by network transmission logs showing 8,192 bytes sent to the C2 address.

The attacker used the Print Spooler service as a persistence mechanism and injected a custom exfiltration tool. Your task: determine what sensitive project codename was stolen from the financial report. The flag is the project codename in lowercase with underscores.