3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c

Analysis

max time kernel
151s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
Size

206KB
MD5

9bc2f4b51e38a587e9fa465a46429efb
SHA1

6bf52b7b08c7d23624380598e8c557eb00c76291
SHA256

3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c
SHA512

24a081e2c90d861b16da59283b53b93f37fd59acdc1dcbbbc57293b61dc6826ec20bce268d338062c7c7fdbc93dca39863e3f1796c30e7c84b2f8576d2084a3b
SSDEEP

3072:bbluj2AgK1S4lQ/qml80FqCKmgTRHGvcqRI0NU/iYyA3:bbl5RKgOGqml80FrgTRHGvJI08iYx

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\drivers\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\SysWOW64\drivers\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\SysWOW64\drivers\udsys.exe	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
1020	explorer.exe
1756	spoolsv.exe
820	svchost.exe
1888	explorer.exe
1044	spoolsv.exe
968	svchost.exe
472	explorer.exe
1764	spoolsv.exe
556	svchost.exe
1628	explorer.exe
936	spoolsv.exe
1444	svchost.exe
1364	explorer.exe
1784	spoolsv.exe
844	svchost.exe
1616	explorer.exe
1584	spoolsv.exe
976	svchost.exe
1920	explorer.exe
1912	spoolsv.exe
1360	svchost.exe
1072	explorer.exe
644	spoolsv.exe
1536	svchost.exe
1112	explorer.exe
1428	spoolsv.exe
1724	svchost.exe
1692	explorer.exe
1612	spoolsv.exe
844	svchost.exe
1576	explorer.exe
1052	spoolsv.exe
472	svchost.exe
2040	explorer.exe
912	spoolsv.exe
1936	svchost.exe
1384	explorer.exe
1072	spoolsv.exe
1516	svchost.exe
556	explorer.exe
1388	spoolsv.exe
1740	svchost.exe
1264	explorer.exe
1248	spoolsv.exe
888	svchost.exe
1560	explorer.exe
1784	spoolsv.exe
1016	svchost.exe
2028	explorer.exe
812	spoolsv.exe
656	svchost.exe
852	explorer.exe
1204	spoolsv.exe
860	svchost.exe
1452	explorer.exe
956	spoolsv.exe
1520	svchost.exe
1628	explorer.exe
1536	spoolsv.exe
1196	svchost.exe
1388	explorer.exe
1428	spoolsv.exe
1068	svchost.exe
888	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Loads dropped DLL 64 IoCs

pid	Process
2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
1020	explorer.exe
1020	explorer.exe
1756	spoolsv.exe
1756	spoolsv.exe
820	svchost.exe
1020	explorer.exe
1020	explorer.exe
1044	spoolsv.exe
1044	spoolsv.exe
968	svchost.exe
1020	explorer.exe
1020	explorer.exe
1764	spoolsv.exe
1764	spoolsv.exe
556	svchost.exe
1020	explorer.exe
1020	explorer.exe
936	spoolsv.exe
936	spoolsv.exe
1444	svchost.exe
1020	explorer.exe
1020	explorer.exe
1784	spoolsv.exe
1784	spoolsv.exe
844	svchost.exe
1020	explorer.exe
1020	explorer.exe
1584	spoolsv.exe
1584	spoolsv.exe
976	svchost.exe
1020	explorer.exe
1020	explorer.exe
1912	spoolsv.exe
1912	spoolsv.exe
1360	svchost.exe
1020	explorer.exe
1020	explorer.exe
644	spoolsv.exe
644	spoolsv.exe
1536	svchost.exe
1020	explorer.exe
1020	explorer.exe
1428	spoolsv.exe
1428	spoolsv.exe
1724	svchost.exe
1020	explorer.exe
1020	explorer.exe
1612	spoolsv.exe
1612	spoolsv.exe
844	svchost.exe
1020	explorer.exe
1020	explorer.exe
1052	spoolsv.exe
1052	spoolsv.exe
472	svchost.exe
1020	explorer.exe
1020	explorer.exe
912	spoolsv.exe
912	spoolsv.exe
1936	svchost.exe
1020	explorer.exe
1020	explorer.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system32\\drivers\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe
1020	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1020	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
1020	explorer.exe
1020	explorer.exe
1756	spoolsv.exe
1756	spoolsv.exe
820	svchost.exe
820	svchost.exe
1888	explorer.exe
1888	explorer.exe
1020	explorer.exe
1020	explorer.exe
1044	spoolsv.exe
1044	spoolsv.exe
968	svchost.exe
968	svchost.exe
472	explorer.exe
472	explorer.exe
1764	spoolsv.exe
1764	spoolsv.exe
556	svchost.exe
556	svchost.exe
1628	explorer.exe
1628	explorer.exe
936	spoolsv.exe
936	spoolsv.exe
1444	svchost.exe
1444	svchost.exe
1364	explorer.exe
1364	explorer.exe
1784	spoolsv.exe
1784	spoolsv.exe
844	svchost.exe
844	svchost.exe
1616	explorer.exe
1616	explorer.exe
1584	spoolsv.exe
1584	spoolsv.exe
976	svchost.exe
976	svchost.exe
1920	explorer.exe
1920	explorer.exe
1912	spoolsv.exe
1912	spoolsv.exe
1360	svchost.exe
1360	svchost.exe
1072	explorer.exe
1072	explorer.exe
644	spoolsv.exe
644	spoolsv.exe
1536	svchost.exe
1536	svchost.exe
1112	explorer.exe
1112	explorer.exe
1428	spoolsv.exe
1428	spoolsv.exe
1724	svchost.exe
1724	svchost.exe
1692	explorer.exe
1692	explorer.exe
1612	spoolsv.exe
1612	spoolsv.exe
844	svchost.exe
844	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1020	2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe	27
PID 2008 wrote to memory of 1020	2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe	27
PID 2008 wrote to memory of 1020	2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe	27
PID 2008 wrote to memory of 1020	2008	3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe	27
PID 1020 wrote to memory of 1756	1020	explorer.exe	28
PID 1020 wrote to memory of 1756	1020	explorer.exe	28
PID 1020 wrote to memory of 1756	1020	explorer.exe	28
PID 1020 wrote to memory of 1756	1020	explorer.exe	28
PID 1756 wrote to memory of 820	1756	spoolsv.exe	29
PID 1756 wrote to memory of 820	1756	spoolsv.exe	29
PID 1756 wrote to memory of 820	1756	spoolsv.exe	29
PID 1756 wrote to memory of 820	1756	spoolsv.exe	29
PID 820 wrote to memory of 1888	820	svchost.exe	30
PID 820 wrote to memory of 1888	820	svchost.exe	30
PID 820 wrote to memory of 1888	820	svchost.exe	30
PID 820 wrote to memory of 1888	820	svchost.exe	30
PID 1020 wrote to memory of 592	1020	explorer.exe	31
PID 1020 wrote to memory of 592	1020	explorer.exe	31
PID 1020 wrote to memory of 592	1020	explorer.exe	31
PID 1020 wrote to memory of 592	1020	explorer.exe	31
PID 1020 wrote to memory of 1044	1020	explorer.exe	32
PID 1020 wrote to memory of 1044	1020	explorer.exe	32
PID 1020 wrote to memory of 1044	1020	explorer.exe	32
PID 1020 wrote to memory of 1044	1020	explorer.exe	32
PID 1044 wrote to memory of 968	1044	spoolsv.exe	33
PID 1044 wrote to memory of 968	1044	spoolsv.exe	33
PID 1044 wrote to memory of 968	1044	spoolsv.exe	33
PID 1044 wrote to memory of 968	1044	spoolsv.exe	33
PID 968 wrote to memory of 472	968	svchost.exe	34
PID 968 wrote to memory of 472	968	svchost.exe	34
PID 968 wrote to memory of 472	968	svchost.exe	34
PID 968 wrote to memory of 472	968	svchost.exe	34
PID 1020 wrote to memory of 1764	1020	explorer.exe	36
PID 1020 wrote to memory of 1764	1020	explorer.exe	36
PID 1020 wrote to memory of 1764	1020	explorer.exe	36
PID 1020 wrote to memory of 1764	1020	explorer.exe	36
PID 1764 wrote to memory of 556	1764	spoolsv.exe	37
PID 1764 wrote to memory of 556	1764	spoolsv.exe	37
PID 1764 wrote to memory of 556	1764	spoolsv.exe	37
PID 1764 wrote to memory of 556	1764	spoolsv.exe	37
PID 556 wrote to memory of 1628	556	svchost.exe	38
PID 556 wrote to memory of 1628	556	svchost.exe	38
PID 556 wrote to memory of 1628	556	svchost.exe	38
PID 556 wrote to memory of 1628	556	svchost.exe	38
PID 1020 wrote to memory of 936	1020	explorer.exe	39
PID 1020 wrote to memory of 936	1020	explorer.exe	39
PID 1020 wrote to memory of 936	1020	explorer.exe	39
PID 1020 wrote to memory of 936	1020	explorer.exe	39
PID 936 wrote to memory of 1444	936	spoolsv.exe	40
PID 936 wrote to memory of 1444	936	spoolsv.exe	40
PID 936 wrote to memory of 1444	936	spoolsv.exe	40
PID 936 wrote to memory of 1444	936	spoolsv.exe	40
PID 1444 wrote to memory of 1364	1444	svchost.exe	41
PID 1444 wrote to memory of 1364	1444	svchost.exe	41
PID 1444 wrote to memory of 1364	1444	svchost.exe	41
PID 1444 wrote to memory of 1364	1444	svchost.exe	41
PID 1020 wrote to memory of 1784	1020	explorer.exe	42
PID 1020 wrote to memory of 1784	1020	explorer.exe	42
PID 1020 wrote to memory of 1784	1020	explorer.exe	42
PID 1020 wrote to memory of 1784	1020	explorer.exe	42
PID 1784 wrote to memory of 844	1784	spoolsv.exe	43
PID 1784 wrote to memory of 844	1784	spoolsv.exe	43
PID 1784 wrote to memory of 844	1784	spoolsv.exe	43
PID 1784 wrote to memory of 844	1784	spoolsv.exe	43

C:\Users\Admin\AppData\Local\Temp\3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe
"C:\Users\Admin\AppData\Local\Temp\3ff29794c80c34fd3b90398d7b09734de60c94c1f453e78ce709f3e86e2c400c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1020
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:820
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:592
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:968
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:472
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:556
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:936
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1444
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:844
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:976
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:644
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1428
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:844
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:1576
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1052
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:472
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:2040
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:912
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1936
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:1384
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:1072
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:1516
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:556
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:1388
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:1740
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:1264
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:1248
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:888
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:1560
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:1784
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:1016
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:2028
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:812
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:656
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:852
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:1204
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:860
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:1452
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:956
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:1520
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:1628
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:1536
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:1196
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:1388
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    PID:1428
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      Executes dropped EXE
      PID:1068
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:888
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1576
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1948
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1680
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1596
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:552
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1320
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:908
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:912
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1936
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1548
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:2024
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1628
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:956
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:820
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:436
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1196
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1724
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1688
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1560
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1552
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1784
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1308
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:672
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1464
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:852
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:824
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1904
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:860
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:908
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1968
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1072
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:364
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:644
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:436
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:956
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1692
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1524
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1456
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1044
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:592
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:844
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:580
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:2040
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:984
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1132
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1384
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:852
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:560
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:524
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1968
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1732
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1508
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1628
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1272
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1888
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1768
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1016
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1744
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1688
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:812
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1052
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:580
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1984
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1372
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1100
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1500
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1092
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1748
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1716
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:860
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1548
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1580
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1136
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1264
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1068
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:2012
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1016
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1612
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1728
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1724
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1988
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1600
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1552
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1172
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:912
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1464
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1520
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:560
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1748
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1504
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1740
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1580
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:568
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1720
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1136
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1044
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1188
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:544
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:844
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:552
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:656
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1920
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:332
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1592
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:968
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1716
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:456
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1752
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1364
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1504
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:860
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:932
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1712
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:644
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1196
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1608
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1888
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1524
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:572
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:2020
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1988
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1904
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1124
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:472
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1796
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1600
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:852
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:524
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1372
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1748
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1236
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1692
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1700
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:436
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1712
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1948
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:812
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1608
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:2032
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:864
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:888
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:580
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:552
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1988
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1172
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1516
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1052
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1520
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1716
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:984
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:560
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:908
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1628
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1548
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1580
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:820
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1700
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1508
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1456
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:556
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1524
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1688
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:592
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1124
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1416
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:960
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:968
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:320
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1320
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:620
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:984
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1912
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1504
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1364
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:560
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1680
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1768
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1580
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:2028
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1888
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:812
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:544
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1188
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1948
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1936
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:2040
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:344
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1100
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1360
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:320
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1140
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:456
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:620
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1084
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1660
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1364
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1248
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1712
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1768
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1608
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1572
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1964
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1992
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:756
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1456
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1584
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1984
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1124
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1596
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1384
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1592
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:836
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:2024
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1140
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1656
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:908
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1748
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1628
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:956
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1740
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1720
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1760
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1608
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:888
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1612
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1704
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1728
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1784
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:552
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:332
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:592
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1384
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:892
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1092
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1944
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:936
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1520
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:908
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:824
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1112
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1248
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1508
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:2028
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1760
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:572
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:396
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:2020
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:672
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1728
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:812
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1600
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:968
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:552
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:852
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1492
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1592
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1692
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1968
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1140
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1732
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:824
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1364
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1740
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1604
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1264
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1452
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:544
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1572
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1920
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1936
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:848
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1764
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:332
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1100
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1388
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:524
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1596
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1536
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:944
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1592
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:436
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1664
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1732
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1136
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:272
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:860
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1512
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:572
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1452
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1616
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:964
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1416
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:2020
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1308
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:472
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:848
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1320
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1388
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1100
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:2044
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1536
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1692
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1912
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:644
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1712
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1740
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:2028
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:1364
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:2012
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:1512
  - - \??\c:\windows\SysWOW64\drivers\svchost.exe
      c:\windows\system32\drivers\svchost.exe
      4⤵
      PID:544
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        
        PID:1584
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe SE
    3⤵
    PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
C:\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
C:\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
C:\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
C:\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
C:\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
C:\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
C:\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\??\c:\windows\syswow64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\??\c:\windows\syswow64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
206KB

MD5
84a23ae4455dde37cb20023f3ec47b1f

SHA1
de0434463e40e2d4e78183eabd91170fff455b1c

SHA256
d068e6f73c12d07b0dfd93f16f335312bfd50017f4629891669c6e8754b0ca5d

SHA512
e1127c081a316081e7cca975210438183f22b1fec35e2434479711c564ab415ed3402eb913f23379205355a15d2e7e0d9ee9ff728f64daccd4b67dd165ebb554

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\SysWOW64\drivers\svchost.exe

Filesize
206KB

MD5
9e32f9058fab028565632638dab6884b

SHA1
a8e31d4aa8d2c4e5eb8b11732fb036f4fc81602f

SHA256
4153a11870a4c9e15e66b2d59f8e77df4c96df03e701ec789a69ab768898107c

SHA512
4f7fe084381df0c3a19eb36e699ff5a2cc3ae033f6c4479c7f1d1b4ca0b5cb7c2c4f64cccff9508e3747ac9f4199605dac761983016fe3a023c0559f8de32ed3

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
8682d9a6f1096993f106266449984efa

SHA1
e33fbba5df7ac8f6dc02ccf6d445e550e0097c60

SHA256
5ad251a09199142e7ab85cef153dcd1315c00706fd0c3158b9ea55672891a5ed

SHA512
312d6b0822abc341b284ba9dbde10e567f03c06cd496b27deeb0e4e71b39469e6d7638f7769a9510f0716d86e2208d7de2b7334381f48535f5a83f43d3c5ceb8

Download Submit
memory/592-92-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmp

Filesize
8KB

Download
memory/2008-57-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download