41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c

Analysis

max time kernel
150s
max time network
89s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
Size

184KB
MD5

a1d07d0719ffaf95e3168389dc642e90
SHA1

72468bff61ba1161569697ff8c4e5ac83316928e
SHA256

41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c
SHA512

cabfdbe5398bab7ee77805534b612da9f6cf7cc78d85fa005897703e5cf951d9c586cd619d8a7792fcfc04a196718bb6dd1d9a58cfedafd272a03ae7938b5e43
SSDEEP

3072:GWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW1Ib:GWkWXV9wUezUroW+tCmCCfNGhb

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\drivers\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\SysWOW64\drivers\mr.exe	explorer.exe
File opened for modification	\??\c:\windows\SysWOW64\drivers\udsys.exe	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
624	explorer.exe
1972	spoolsv.exe
1176	explorer.exe
1632	spoolsv.exe
1148	explorer.exe
1000	spoolsv.exe
992	explorer.exe
976	spoolsv.exe
1376	explorer.exe
1208	spoolsv.exe
1516	explorer.exe
960	spoolsv.exe
1620	explorer.exe
1968	spoolsv.exe
1808	explorer.exe
1576	spoolsv.exe
756	explorer.exe
1668	spoolsv.exe
564	explorer.exe
1952	spoolsv.exe
604	explorer.exe
540	spoolsv.exe
1680	explorer.exe
1512	spoolsv.exe
688	explorer.exe
960	spoolsv.exe
280	explorer.exe
1712	spoolsv.exe
876	explorer.exe
1808	spoolsv.exe
1652	explorer.exe
1148	spoolsv.exe
392	explorer.exe
1088	spoolsv.exe
1384	explorer.exe
1260	spoolsv.exe
976	explorer.exe
1952	spoolsv.exe
276	explorer.exe
1516	spoolsv.exe
1604	explorer.exe
1836	spoolsv.exe
556	explorer.exe
1684	spoolsv.exe
1620	explorer.exe
1560	spoolsv.exe
876	explorer.exe
532	spoolsv.exe
888	explorer.exe
1576	spoolsv.exe
1568	explorer.exe
804	spoolsv.exe
1324	explorer.exe
1984	spoolsv.exe
1660	explorer.exe
1648	spoolsv.exe
540	explorer.exe
912	spoolsv.exe
1524	explorer.exe
688	spoolsv.exe
1068	explorer.exe
1796	spoolsv.exe
340	explorer.exe
1020	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "c:\\windows\\system32\\drivers\\mr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "c:\\windows\\system32\\drivers\\mr.exe"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Loads dropped DLL 64 IoCs

pid	Process
1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
624	explorer.exe
624	explorer.exe
1972	spoolsv.exe
624	explorer.exe
624	explorer.exe
1632	spoolsv.exe
624	explorer.exe
624	explorer.exe
1000	spoolsv.exe
624	explorer.exe
624	explorer.exe
976	spoolsv.exe
624	explorer.exe
624	explorer.exe
1208	spoolsv.exe
624	explorer.exe
624	explorer.exe
960	spoolsv.exe
624	explorer.exe
624	explorer.exe
1968	spoolsv.exe
624	explorer.exe
624	explorer.exe
1576	spoolsv.exe
624	explorer.exe
624	explorer.exe
1668	spoolsv.exe
624	explorer.exe
624	explorer.exe
1952	spoolsv.exe
624	explorer.exe
624	explorer.exe
540	spoolsv.exe
624	explorer.exe
624	explorer.exe
1512	spoolsv.exe
624	explorer.exe
624	explorer.exe
960	spoolsv.exe
624	explorer.exe
624	explorer.exe
1712	spoolsv.exe
624	explorer.exe
624	explorer.exe
1808	spoolsv.exe
624	explorer.exe
624	explorer.exe
1148	spoolsv.exe
624	explorer.exe
624	explorer.exe
1088	spoolsv.exe
624	explorer.exe
624	explorer.exe
1260	spoolsv.exe
624	explorer.exe
624	explorer.exe
1952	spoolsv.exe
624	explorer.exe
624	explorer.exe
1516	spoolsv.exe
624	explorer.exe
624	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system32\\drivers\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe"	explorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
624	explorer.exe
624	explorer.exe
1972	spoolsv.exe
1972	spoolsv.exe
1176	explorer.exe
1176	explorer.exe
624	explorer.exe
624	explorer.exe
1632	spoolsv.exe
1632	spoolsv.exe
1148	explorer.exe
1148	explorer.exe
1000	spoolsv.exe
1000	spoolsv.exe
992	explorer.exe
992	explorer.exe
976	spoolsv.exe
976	spoolsv.exe
1376	explorer.exe
1376	explorer.exe
1208	spoolsv.exe
1208	spoolsv.exe
1516	explorer.exe
1516	explorer.exe
960	spoolsv.exe
960	spoolsv.exe
1620	explorer.exe
1620	explorer.exe
1968	spoolsv.exe
1968	spoolsv.exe
1808	explorer.exe
1808	explorer.exe
1576	spoolsv.exe
1576	spoolsv.exe
756	explorer.exe
756	explorer.exe
1668	spoolsv.exe
1668	spoolsv.exe
564	explorer.exe
564	explorer.exe
1952	spoolsv.exe
1952	spoolsv.exe
604	explorer.exe
604	explorer.exe
540	spoolsv.exe
540	spoolsv.exe
1680	explorer.exe
1680	explorer.exe
1512	spoolsv.exe
1512	spoolsv.exe
688	explorer.exe
688	explorer.exe
960	spoolsv.exe
960	spoolsv.exe
280	explorer.exe
280	explorer.exe
1712	spoolsv.exe
1712	spoolsv.exe
876	explorer.exe
876	explorer.exe
1808	spoolsv.exe
1808	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 624	1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe	28
PID 1716 wrote to memory of 624	1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe	28
PID 1716 wrote to memory of 624	1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe	28
PID 1716 wrote to memory of 624	1716	41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe	28
PID 624 wrote to memory of 1972	624	explorer.exe	29
PID 624 wrote to memory of 1972	624	explorer.exe	29
PID 624 wrote to memory of 1972	624	explorer.exe	29
PID 624 wrote to memory of 1972	624	explorer.exe	29
PID 1972 wrote to memory of 1176	1972	spoolsv.exe	30
PID 1972 wrote to memory of 1176	1972	spoolsv.exe	30
PID 1972 wrote to memory of 1176	1972	spoolsv.exe	30
PID 1972 wrote to memory of 1176	1972	spoolsv.exe	30
PID 624 wrote to memory of 940	624	explorer.exe	31
PID 624 wrote to memory of 940	624	explorer.exe	31
PID 624 wrote to memory of 940	624	explorer.exe	31
PID 624 wrote to memory of 940	624	explorer.exe	31
PID 624 wrote to memory of 1632	624	explorer.exe	32
PID 624 wrote to memory of 1632	624	explorer.exe	32
PID 624 wrote to memory of 1632	624	explorer.exe	32
PID 624 wrote to memory of 1632	624	explorer.exe	32
PID 1632 wrote to memory of 1148	1632	spoolsv.exe	33
PID 1632 wrote to memory of 1148	1632	spoolsv.exe	33
PID 1632 wrote to memory of 1148	1632	spoolsv.exe	33
PID 1632 wrote to memory of 1148	1632	spoolsv.exe	33
PID 624 wrote to memory of 1000	624	explorer.exe	34
PID 624 wrote to memory of 1000	624	explorer.exe	34
PID 624 wrote to memory of 1000	624	explorer.exe	34
PID 624 wrote to memory of 1000	624	explorer.exe	34
PID 1000 wrote to memory of 992	1000	spoolsv.exe	36
PID 1000 wrote to memory of 992	1000	spoolsv.exe	36
PID 1000 wrote to memory of 992	1000	spoolsv.exe	36
PID 1000 wrote to memory of 992	1000	spoolsv.exe	36
PID 624 wrote to memory of 976	624	explorer.exe	37
PID 624 wrote to memory of 976	624	explorer.exe	37
PID 624 wrote to memory of 976	624	explorer.exe	37
PID 624 wrote to memory of 976	624	explorer.exe	37
PID 976 wrote to memory of 1376	976	spoolsv.exe	38
PID 976 wrote to memory of 1376	976	spoolsv.exe	38
PID 976 wrote to memory of 1376	976	spoolsv.exe	38
PID 976 wrote to memory of 1376	976	spoolsv.exe	38
PID 624 wrote to memory of 1208	624	explorer.exe	39
PID 624 wrote to memory of 1208	624	explorer.exe	39
PID 624 wrote to memory of 1208	624	explorer.exe	39
PID 624 wrote to memory of 1208	624	explorer.exe	39
PID 1208 wrote to memory of 1516	1208	spoolsv.exe	40
PID 1208 wrote to memory of 1516	1208	spoolsv.exe	40
PID 1208 wrote to memory of 1516	1208	spoolsv.exe	40
PID 1208 wrote to memory of 1516	1208	spoolsv.exe	40
PID 624 wrote to memory of 960	624	explorer.exe	41
PID 624 wrote to memory of 960	624	explorer.exe	41
PID 624 wrote to memory of 960	624	explorer.exe	41
PID 624 wrote to memory of 960	624	explorer.exe	41
PID 960 wrote to memory of 1620	960	spoolsv.exe	42
PID 960 wrote to memory of 1620	960	spoolsv.exe	42
PID 960 wrote to memory of 1620	960	spoolsv.exe	42
PID 960 wrote to memory of 1620	960	spoolsv.exe	42
PID 624 wrote to memory of 1968	624	explorer.exe	43
PID 624 wrote to memory of 1968	624	explorer.exe	43
PID 624 wrote to memory of 1968	624	explorer.exe	43
PID 624 wrote to memory of 1968	624	explorer.exe	43
PID 1968 wrote to memory of 1808	1968	spoolsv.exe	44
PID 1968 wrote to memory of 1808	1968	spoolsv.exe	44
PID 1968 wrote to memory of 1808	1968	spoolsv.exe	44
PID 1968 wrote to memory of 1808	1968	spoolsv.exe	44

C:\Users\Admin\AppData\Local\Temp\41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe
"C:\Users\Admin\AppData\Local\Temp\41055977397849d0c149f6cac957fe6f607178fa69d2ad72d0eb5c11095e060c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:624
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:940
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1148
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:992
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:976
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1376
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:960
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:756
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:564
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1952
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:604
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:540
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1512
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:688
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:960
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:280
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1808
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1652
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1148
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:392
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1088
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1384
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1260
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:976
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1952
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:276
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1516
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1604
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1836
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:556
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1684
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1620
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1560
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:876
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:532
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:888
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1576
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1568
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:804
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1324
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1984
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1660
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1648
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:540
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:912
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1524
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:688
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1068
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:340
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1020
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1828
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1772
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1028
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:992
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1576
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:808
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2012
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1468
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1936
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:520
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1732
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:972
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1512
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:912
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:556
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1096
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1620
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:632
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1280
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1020
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:828
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1028
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1088
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:992
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1080
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:808
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1584
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1260
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1876
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1732
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:552
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1624
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1836
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:556
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:688
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1116
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:940
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1796
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1636
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1380
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:532
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:432
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:392
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1088
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1208
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1284
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1660
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1584
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:760
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:868
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1624
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1736
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:748
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1068
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1620
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1828
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1784
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1020
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1636
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1344
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1148
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1964
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1600
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1756
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1544
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2012
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1656
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1468
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:276
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1120
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1960
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1736
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:932
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1684
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1752
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1560
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1104
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1620
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1316
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1724
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1052
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1772
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:836
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1148
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1956
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1384
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1080
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2012
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:316
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1468
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1516
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1304
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1720
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:280
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1096
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:952
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1336
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1704
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:240
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1104
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1020
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1724
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1072
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1568
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1088
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1008
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1456
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1668
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:808
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:268
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1628
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1612
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:580
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1680
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1304
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:912
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1736
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1532
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1068
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:940
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1748
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:632
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1104
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1416
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1644
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1028
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1636
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1964
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:804
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
C:\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\??\c:\windows\syswow64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
38dc0417d15e4d7acf535b92c7dd6b45

SHA1
104b292f28e9c75adebeecd7dae24f237631f186

SHA256
2de3b6c1863814807c15461cb509386b4847140ededf9d18d2603c40bf1bc77b

SHA512
280cc11bc29335d5926e04993fa81e7be1660817f2d2356a2014f185130d66be8522b534c60f60d70188e1c6865b9d983abbe92a0e3efbafb267793e075dc300

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
\Windows\system\explorer.exe

Filesize
184KB

MD5
c75b4ccd37eb68724d9dc0ca39676419

SHA1
1feff28a124cf7c691ed9b3edab2ee641281714c

SHA256
3f1cb4df1288fec319dfc934e3fa018105ecb8158977798eff83c18374816477

SHA512
3aeeb977f146529fba54f7d4b6571d23569781b82f10993d475038d8b8ef946f02a1df78819d50221ded915b5e78c210dbe5ab429561d3712d2e618d4298dcea

Download Submit
memory/276-296-0x0000000000000000-mapping.dmp

Download
memory/280-242-0x0000000000000000-mapping.dmp

Download
memory/340-404-0x0000000000000000-mapping.dmp

Download
memory/392-269-0x0000000000000000-mapping.dmp

Download
memory/532-336-0x0000000000000000-mapping.dmp

Download
memory/540-377-0x0000000000000000-mapping.dmp

Download
memory/540-212-0x0000000000000000-mapping.dmp

Download
memory/556-314-0x0000000000000000-mapping.dmp

Download
memory/564-191-0x0000000000000000-mapping.dmp

Download
memory/604-205-0x0000000000000000-mapping.dmp

Download
memory/624-60-0x0000000000000000-mapping.dmp

Download
memory/688-390-0x0000000000000000-mapping.dmp

Download
memory/688-233-0x0000000000000000-mapping.dmp

Download
memory/756-177-0x0000000000000000-mapping.dmp

Download
memory/804-354-0x0000000000000000-mapping.dmp

Download
memory/876-332-0x0000000000000000-mapping.dmp

Download
memory/876-251-0x0000000000000000-mapping.dmp

Download
memory/888-341-0x0000000000000000-mapping.dmp

Download
memory/912-381-0x0000000000000000-mapping.dmp

Download
memory/940-82-0x0000000000000000-mapping.dmp

Download
memory/940-83-0x000007FEFC0D1000-0x000007FEFC0D3000-memory.dmp

Filesize
8KB

Download
memory/960-142-0x0000000000000000-mapping.dmp

Download
memory/960-237-0x0000000000000000-mapping.dmp

Download
memory/976-287-0x0000000000000000-mapping.dmp

Download
memory/976-114-0x0000000000000000-mapping.dmp

Download
memory/992-107-0x0000000000000000-mapping.dmp

Download
memory/1000-100-0x0000000000000000-mapping.dmp

Download
memory/1068-395-0x0000000000000000-mapping.dmp

Download
memory/1088-273-0x0000000000000000-mapping.dmp

Download
memory/1148-93-0x0000000000000000-mapping.dmp

Download
memory/1148-264-0x0000000000000000-mapping.dmp

Download
memory/1176-77-0x0000000000000000-mapping.dmp

Download
memory/1208-128-0x0000000000000000-mapping.dmp

Download
memory/1260-282-0x0000000000000000-mapping.dmp

Download
memory/1324-359-0x0000000000000000-mapping.dmp

Download
memory/1376-121-0x0000000000000000-mapping.dmp

Download
memory/1384-278-0x0000000000000000-mapping.dmp

Download
memory/1512-226-0x0000000000000000-mapping.dmp

Download
memory/1516-300-0x0000000000000000-mapping.dmp

Download
memory/1516-135-0x0000000000000000-mapping.dmp

Download
memory/1524-386-0x0000000000000000-mapping.dmp

Download
memory/1560-327-0x0000000000000000-mapping.dmp

Download
memory/1568-350-0x0000000000000000-mapping.dmp

Download
memory/1576-170-0x0000000000000000-mapping.dmp

Download
memory/1576-345-0x0000000000000000-mapping.dmp

Download
memory/1604-305-0x0000000000000000-mapping.dmp

Download
memory/1620-149-0x0000000000000000-mapping.dmp

Download
memory/1620-323-0x0000000000000000-mapping.dmp

Download
memory/1632-86-0x0000000000000000-mapping.dmp

Download
memory/1648-372-0x0000000000000000-mapping.dmp

Download
memory/1652-260-0x0000000000000000-mapping.dmp

Download
memory/1660-368-0x0000000000000000-mapping.dmp

Download
memory/1668-184-0x0000000000000000-mapping.dmp

Download
memory/1680-219-0x0000000000000000-mapping.dmp

Download
memory/1684-318-0x0000000000000000-mapping.dmp

Download
memory/1712-246-0x0000000000000000-mapping.dmp

Download
memory/1716-57-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1796-399-0x0000000000000000-mapping.dmp

Download
memory/1808-255-0x0000000000000000-mapping.dmp

Download
memory/1808-163-0x0000000000000000-mapping.dmp

Download
memory/1836-309-0x0000000000000000-mapping.dmp

Download
memory/1952-291-0x0000000000000000-mapping.dmp

Download
memory/1952-198-0x0000000000000000-mapping.dmp

Download
memory/1968-156-0x0000000000000000-mapping.dmp

Download
memory/1972-69-0x0000000000000000-mapping.dmp

Download
memory/1984-363-0x0000000000000000-mapping.dmp

Download