caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7

Analysis

max time kernel
163s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe
Size

184KB
MD5

671da604dfb5ce0c40f4681bcaf66250
SHA1

c7baea6b0556b67a5d075ba2b711494b285c2c84
SHA256

caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7
SHA512

428dc6778c8900fd4960cda09ff2908dda1d20c13b08277c0d1927fd9282bb88865b1b2b264b1d451e6018ffa28311adc2e1e544534c8d483f626583166e84a4
SSDEEP

3072:GWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW1Zw:GWkWXV9wUezUroW+tCmCCfNGv

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\drivers\mr.exe	explorer.exe
File opened for modification	\??\c:\windows\SysWOW64\drivers\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\SysWOW64\drivers\spoolsv.exe	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
8	explorer.exe
4504	spoolsv.exe
4688	explorer.exe
4660	spoolsv.exe
2208	explorer.exe
1652	spoolsv.exe
3720	explorer.exe
2212	spoolsv.exe
1264	explorer.exe
3964	spoolsv.exe
2096	explorer.exe
2264	spoolsv.exe
348	explorer.exe
1536	spoolsv.exe
3016	explorer.exe
4168	spoolsv.exe
3652	explorer.exe
3380	spoolsv.exe
2664	explorer.exe
4780	spoolsv.exe
452	explorer.exe
2304	spoolsv.exe
4356	explorer.exe
2964	spoolsv.exe
3880	explorer.exe
2784	spoolsv.exe
4672	explorer.exe
4072	spoolsv.exe
4448	explorer.exe
3708	spoolsv.exe
4372	explorer.exe
3524	spoolsv.exe
2544	explorer.exe
2204	spoolsv.exe
2560	explorer.exe
1868	spoolsv.exe
4976	explorer.exe
4384	spoolsv.exe
1476	explorer.exe
640	spoolsv.exe
4092	explorer.exe
1356	spoolsv.exe
2276	explorer.exe
2068	spoolsv.exe
884	explorer.exe
1528	spoolsv.exe
3968	explorer.exe
3320	spoolsv.exe
3944	explorer.exe
4732	spoolsv.exe
5092	explorer.exe
4928	spoolsv.exe
4664	explorer.exe
4100	spoolsv.exe
1184	explorer.exe
3760	spoolsv.exe
3640	explorer.exe
4556	spoolsv.exe
3768	explorer.exe
2096	spoolsv.exe
1648	explorer.exe
1672	spoolsv.exe
3004	explorer.exe
3980	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "c:\\windows\\system32\\drivers\\mr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "c:\\windows\\system32\\drivers\\mr.exe"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system32\\drivers\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4084	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe
4084	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe
8	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4084	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe
4084	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe
8	explorer.exe
8	explorer.exe
4504	spoolsv.exe
4504	spoolsv.exe
4688	explorer.exe
4688	explorer.exe
8	explorer.exe
8	explorer.exe
4660	spoolsv.exe
4660	spoolsv.exe
2208	explorer.exe
2208	explorer.exe
1652	spoolsv.exe
1652	spoolsv.exe
3720	explorer.exe
3720	explorer.exe
2212	spoolsv.exe
2212	spoolsv.exe
1264	explorer.exe
1264	explorer.exe
3964	spoolsv.exe
3964	spoolsv.exe
2096	explorer.exe
2096	explorer.exe
2264	spoolsv.exe
2264	spoolsv.exe
348	explorer.exe
348	explorer.exe
1536	spoolsv.exe
1536	spoolsv.exe
3016	explorer.exe
3016	explorer.exe
4168	spoolsv.exe
4168	spoolsv.exe
3652	explorer.exe
3652	explorer.exe
3380	spoolsv.exe
3380	spoolsv.exe
2664	explorer.exe
2664	explorer.exe
4780	spoolsv.exe
4780	spoolsv.exe
452	explorer.exe
452	explorer.exe
2304	spoolsv.exe
2304	spoolsv.exe
4356	explorer.exe
4356	explorer.exe
2964	spoolsv.exe
2964	spoolsv.exe
3880	explorer.exe
3880	explorer.exe
2784	spoolsv.exe
2784	spoolsv.exe
4672	explorer.exe
4672	explorer.exe
4072	spoolsv.exe
4072	spoolsv.exe
4448	explorer.exe
4448	explorer.exe
3708	spoolsv.exe
3708	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 8	4084	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe	79
PID 4084 wrote to memory of 8	4084	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe	79
PID 4084 wrote to memory of 8	4084	caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe	79
PID 8 wrote to memory of 4504	8	explorer.exe	80
PID 8 wrote to memory of 4504	8	explorer.exe	80
PID 8 wrote to memory of 4504	8	explorer.exe	80
PID 4504 wrote to memory of 4688	4504	spoolsv.exe	81
PID 4504 wrote to memory of 4688	4504	spoolsv.exe	81
PID 4504 wrote to memory of 4688	4504	spoolsv.exe	81
PID 8 wrote to memory of 4660	8	explorer.exe	82
PID 8 wrote to memory of 4660	8	explorer.exe	82
PID 8 wrote to memory of 4660	8	explorer.exe	82
PID 4660 wrote to memory of 2208	4660	spoolsv.exe	83
PID 4660 wrote to memory of 2208	4660	spoolsv.exe	83
PID 4660 wrote to memory of 2208	4660	spoolsv.exe	83
PID 8 wrote to memory of 1652	8	explorer.exe	84
PID 8 wrote to memory of 1652	8	explorer.exe	84
PID 8 wrote to memory of 1652	8	explorer.exe	84
PID 1652 wrote to memory of 3720	1652	spoolsv.exe	85
PID 1652 wrote to memory of 3720	1652	spoolsv.exe	85
PID 1652 wrote to memory of 3720	1652	spoolsv.exe	85
PID 8 wrote to memory of 2212	8	explorer.exe	86
PID 8 wrote to memory of 2212	8	explorer.exe	86
PID 8 wrote to memory of 2212	8	explorer.exe	86
PID 2212 wrote to memory of 1264	2212	spoolsv.exe	87
PID 2212 wrote to memory of 1264	2212	spoolsv.exe	87
PID 2212 wrote to memory of 1264	2212	spoolsv.exe	87
PID 8 wrote to memory of 3964	8	explorer.exe	88
PID 8 wrote to memory of 3964	8	explorer.exe	88
PID 8 wrote to memory of 3964	8	explorer.exe	88
PID 3964 wrote to memory of 2096	3964	spoolsv.exe	89
PID 3964 wrote to memory of 2096	3964	spoolsv.exe	89
PID 3964 wrote to memory of 2096	3964	spoolsv.exe	89
PID 8 wrote to memory of 2264	8	explorer.exe	90
PID 8 wrote to memory of 2264	8	explorer.exe	90
PID 8 wrote to memory of 2264	8	explorer.exe	90
PID 2264 wrote to memory of 348	2264	spoolsv.exe	91
PID 2264 wrote to memory of 348	2264	spoolsv.exe	91
PID 2264 wrote to memory of 348	2264	spoolsv.exe	91
PID 8 wrote to memory of 1536	8	explorer.exe	92
PID 8 wrote to memory of 1536	8	explorer.exe	92
PID 8 wrote to memory of 1536	8	explorer.exe	92
PID 1536 wrote to memory of 3016	1536	spoolsv.exe	93
PID 1536 wrote to memory of 3016	1536	spoolsv.exe	93
PID 1536 wrote to memory of 3016	1536	spoolsv.exe	93
PID 8 wrote to memory of 4168	8	explorer.exe	94
PID 8 wrote to memory of 4168	8	explorer.exe	94
PID 8 wrote to memory of 4168	8	explorer.exe	94
PID 4168 wrote to memory of 3652	4168	spoolsv.exe	95
PID 4168 wrote to memory of 3652	4168	spoolsv.exe	95
PID 4168 wrote to memory of 3652	4168	spoolsv.exe	95
PID 8 wrote to memory of 3380	8	explorer.exe	96
PID 8 wrote to memory of 3380	8	explorer.exe	96
PID 8 wrote to memory of 3380	8	explorer.exe	96
PID 3380 wrote to memory of 2664	3380	spoolsv.exe	97
PID 3380 wrote to memory of 2664	3380	spoolsv.exe	97
PID 3380 wrote to memory of 2664	3380	spoolsv.exe	97
PID 8 wrote to memory of 4780	8	explorer.exe	98
PID 8 wrote to memory of 4780	8	explorer.exe	98
PID 8 wrote to memory of 4780	8	explorer.exe	98
PID 4780 wrote to memory of 452	4780	spoolsv.exe	99
PID 4780 wrote to memory of 452	4780	spoolsv.exe	99
PID 4780 wrote to memory of 452	4780	spoolsv.exe	99
PID 8 wrote to memory of 2304	8	explorer.exe	100

C:\Users\Admin\AppData\Local\Temp\caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe
"C:\Users\Admin\AppData\Local\Temp\caa5f99be4b971b6a215b47e2f0178991440ac7f421f19ffa4d1fa0cf67513b7.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:8
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4688
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1264
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2096
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:348
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3016
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3652
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2664
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:452
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2304
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3880
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4672
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4072
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4448
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3708
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4372
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:3524
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:2544
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:2204
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:2560
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1868
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4976
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4384
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1476
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:640
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4092
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1356
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:2276
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:2068
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:884
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1528
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3968
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:3320
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3944
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4732
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:5092
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4928
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4664
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4100
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1184
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:3760
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3640
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4556
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3768
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:2096
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1648
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1672
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3004
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:3980
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3656
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3868
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1836
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1220
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4588
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5100
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3460
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:800
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2808
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1308
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3108
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4832
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3812
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2784
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:5044
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4920
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3932
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4416
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4036
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4212
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3428
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2560
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4348
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4808
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3040
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3400
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2276
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2592
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:884
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4032
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4712
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3052
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4764
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4228
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:548
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2540
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1424
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4028
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2200
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:740
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4972
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2460
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2264
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3636
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3488
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4564
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3856
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3984
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3292
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4464
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3096
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4820
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2808
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3424
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3100
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2492
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4840
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1540
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4408
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4372
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4836
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2364
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4240
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3832
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2204
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4152
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1124
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1684
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4104
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3472
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3040
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2688
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4544
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1156
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3952
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4772
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5084
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4732
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4532
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1324
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5072
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1332
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3236
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2148
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4960
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2212
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1424
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1144
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:212
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2836
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1656
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4972
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2696
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:628
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2260
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2796
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1876
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3884
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4392
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3016
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3580
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4892
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4612
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4140
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1800
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4356
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2656
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2532
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4292
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4024
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3708
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2684
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4408
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1976
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4836
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1980
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4240
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1480
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2204
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2164
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1124
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4328
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1044
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1880
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1584
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3036
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3972
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3456
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3976
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4536
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4344
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:620
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4628
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4740
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4624
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4156
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:548
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3384
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1304
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1904
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3120
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4956
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3780
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:112
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:228
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1516
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4896
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4972
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:948
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3836
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:628
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4604
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3504
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3876
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3860
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3464
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3696
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3244
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3896
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2060
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3816
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4456
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4892
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3468
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:804
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1260
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4308
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1132
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1308
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3880
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2964
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:528
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3228
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1352
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3076
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4236
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4824
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4828
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3524
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1252
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2280
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1180
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4320
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3400
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1356
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1768
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:984
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1152
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2556
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4220
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3044
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4716
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3952
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:736
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4648
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2436
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4620
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3760
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4624
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3764
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:548
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3692
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3280
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4944
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3276
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3772
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2128
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4312
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4136
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4304
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2976
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:428
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3116
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3496
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3872
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4276
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1628
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3980
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2680
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3488
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2672
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3788
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3580
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4780
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2832
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5096
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1724
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5040
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4192
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2100
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1800
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2004
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2656
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4832
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3100
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1020
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4404
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4024
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1112
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4236
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2384
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4212
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1216
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1684
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1844
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1184
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3472
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1896
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3400
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4044
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1768
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3320
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1152
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4912
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4220
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4760
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4716
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1324
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:736
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1332
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2436
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2312
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2244
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:636
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2576
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4812
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4452
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1424
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4560
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4944
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4632
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1648
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3004
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4312
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4072
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4448
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3636
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3720
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3284
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4100
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1672
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1212
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3852
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1660
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3644
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3332
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3380
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4588
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1580
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2352
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:808
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5100
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3460
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5068
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2828
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1132
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4308
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3880
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1308
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2656
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4488
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4888
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3228
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4552
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4316
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2512
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3832
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4236
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1980
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4212
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2220
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1684
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1748
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1184
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1880
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1272
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3036
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1044
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4712
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2556
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:884
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3948
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4912
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3300
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4704
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4112
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4532
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4572
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4624
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit
\??\c:\windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
9d30c20fd1e6547faded71f303b44d47

SHA1
bee6c2186517bb037ab784e7c363d2e1026c18d3

SHA256
08b46c681c7f3ff00a2e546f92da5c5a0e68b15151f5c620791e2ef6a8115938

SHA512
c484c676fbade743d9bfd36ae8885eb905b8273938d3ec6def86b1fd6647903ebe8e95e0c8fec7192715b273a1915baf61460e5e72430dfeb176a13ef7b6bc3b

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
184KB

MD5
f9f66b478dd06ae57454dbffb9a8e1ff

SHA1
f90899c14f4aa0f296e869a3d90fea3ce7940d65

SHA256
f4759ec8dfa281e6f3d18987f6bdebe15af816a8fb49492e559997f160db7329

SHA512
fb8fb7f6d76e9e3178f5bd34a88f236cd1ee5e9610bc47ad6460c81262dfbacad0510888414a7abe005881850de16373943c6efb74625987abcfb7fbf8f8d56b

Download Submit