be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50

Analysis

max time kernel
145s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe
Size

184KB
MD5

27face62e87ecea542422d4a24fa2b60
SHA1

303b3f677ee902ebe4487499e1476afd086f3daa
SHA256

be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50
SHA512

93466cacf8f2ecacffbdd2d3d79c0de461d8309c5188e4c7d983ad4af7287152f0b942e88fe6c0c9df463e6dcd282e86a30c468ee0924aaf0d0649581818e7ee
SSDEEP

3072:GWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW1C:GWkWXV9wUezUroW+tCmCCfNGP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\drivers\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\SysWOW64\drivers\mr.exe	explorer.exe
File opened for modification	\??\c:\windows\SysWOW64\drivers\udsys.exe	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
2560	explorer.exe
2880	spoolsv.exe
3740	explorer.exe
4948	spoolsv.exe
212	explorer.exe
208	spoolsv.exe
4940	explorer.exe
3960	spoolsv.exe
4236	explorer.exe
4316	spoolsv.exe
4312	explorer.exe
3196	spoolsv.exe
2736	explorer.exe
1748	spoolsv.exe
1992	explorer.exe
3392	spoolsv.exe
2856	explorer.exe
1004	spoolsv.exe
2392	explorer.exe
3860	spoolsv.exe
2784	explorer.exe
3744	spoolsv.exe
4052	explorer.exe
4804	spoolsv.exe
5100	explorer.exe
4336	spoolsv.exe
4656	explorer.exe
4364	spoolsv.exe
5004	explorer.exe
712	spoolsv.exe
4080	explorer.exe
4876	spoolsv.exe
3988	explorer.exe
1368	spoolsv.exe
4400	explorer.exe
408	spoolsv.exe
4076	explorer.exe
4512	spoolsv.exe
4324	explorer.exe
2132	spoolsv.exe
4632	explorer.exe
4796	spoolsv.exe
4828	explorer.exe
3964	spoolsv.exe
4616	explorer.exe
1140	spoolsv.exe
2280	explorer.exe
4120	spoolsv.exe
1880	explorer.exe
3888	spoolsv.exe
2888	explorer.exe
5040	spoolsv.exe
4124	explorer.exe
5032	spoolsv.exe
4520	explorer.exe
4404	spoolsv.exe
3100	explorer.exe
1432	spoolsv.exe
1192	explorer.exe
2492	spoolsv.exe
1212	explorer.exe
1712	spoolsv.exe
1956	explorer.exe
1112	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "c:\\windows\\system32\\drivers\\mr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "c:\\windows\\system32\\drivers\\mr.exe"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system32\\drivers\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1904	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe
1904	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe
2560	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1904	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe
1904	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe
2560	explorer.exe
2560	explorer.exe
2880	spoolsv.exe
2880	spoolsv.exe
3740	explorer.exe
3740	explorer.exe
2560	explorer.exe
2560	explorer.exe
4948	spoolsv.exe
4948	spoolsv.exe
212	explorer.exe
212	explorer.exe
208	spoolsv.exe
208	spoolsv.exe
4940	explorer.exe
4940	explorer.exe
3960	spoolsv.exe
3960	spoolsv.exe
4236	explorer.exe
4236	explorer.exe
4316	spoolsv.exe
4316	spoolsv.exe
4312	explorer.exe
4312	explorer.exe
3196	spoolsv.exe
3196	spoolsv.exe
2736	explorer.exe
2736	explorer.exe
1748	spoolsv.exe
1748	spoolsv.exe
1992	explorer.exe
1992	explorer.exe
3392	spoolsv.exe
3392	spoolsv.exe
2856	explorer.exe
2856	explorer.exe
1004	spoolsv.exe
1004	spoolsv.exe
2392	explorer.exe
2392	explorer.exe
3860	spoolsv.exe
3860	spoolsv.exe
2784	explorer.exe
2784	explorer.exe
3744	spoolsv.exe
3744	spoolsv.exe
4052	explorer.exe
4052	explorer.exe
4804	spoolsv.exe
4804	spoolsv.exe
5100	explorer.exe
5100	explorer.exe
4336	spoolsv.exe
4336	spoolsv.exe
4656	explorer.exe
4656	explorer.exe
4364	spoolsv.exe
4364	spoolsv.exe
5004	explorer.exe
5004	explorer.exe
712	spoolsv.exe
712	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2560	1904	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe	78
PID 1904 wrote to memory of 2560	1904	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe	78
PID 1904 wrote to memory of 2560	1904	be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe	78
PID 2560 wrote to memory of 2880	2560	explorer.exe	79
PID 2560 wrote to memory of 2880	2560	explorer.exe	79
PID 2560 wrote to memory of 2880	2560	explorer.exe	79
PID 2880 wrote to memory of 3740	2880	spoolsv.exe	80
PID 2880 wrote to memory of 3740	2880	spoolsv.exe	80
PID 2880 wrote to memory of 3740	2880	spoolsv.exe	80
PID 2560 wrote to memory of 4948	2560	explorer.exe	81
PID 2560 wrote to memory of 4948	2560	explorer.exe	81
PID 2560 wrote to memory of 4948	2560	explorer.exe	81
PID 4948 wrote to memory of 212	4948	spoolsv.exe	82
PID 4948 wrote to memory of 212	4948	spoolsv.exe	82
PID 4948 wrote to memory of 212	4948	spoolsv.exe	82
PID 2560 wrote to memory of 208	2560	explorer.exe	83
PID 2560 wrote to memory of 208	2560	explorer.exe	83
PID 2560 wrote to memory of 208	2560	explorer.exe	83
PID 208 wrote to memory of 4940	208	spoolsv.exe	84
PID 208 wrote to memory of 4940	208	spoolsv.exe	84
PID 208 wrote to memory of 4940	208	spoolsv.exe	84
PID 2560 wrote to memory of 3960	2560	explorer.exe	85
PID 2560 wrote to memory of 3960	2560	explorer.exe	85
PID 2560 wrote to memory of 3960	2560	explorer.exe	85
PID 3960 wrote to memory of 4236	3960	spoolsv.exe	86
PID 3960 wrote to memory of 4236	3960	spoolsv.exe	86
PID 3960 wrote to memory of 4236	3960	spoolsv.exe	86
PID 2560 wrote to memory of 4316	2560	explorer.exe	87
PID 2560 wrote to memory of 4316	2560	explorer.exe	87
PID 2560 wrote to memory of 4316	2560	explorer.exe	87
PID 4316 wrote to memory of 4312	4316	spoolsv.exe	88
PID 4316 wrote to memory of 4312	4316	spoolsv.exe	88
PID 4316 wrote to memory of 4312	4316	spoolsv.exe	88
PID 2560 wrote to memory of 3196	2560	explorer.exe	89
PID 2560 wrote to memory of 3196	2560	explorer.exe	89
PID 2560 wrote to memory of 3196	2560	explorer.exe	89
PID 3196 wrote to memory of 2736	3196	spoolsv.exe	90
PID 3196 wrote to memory of 2736	3196	spoolsv.exe	90
PID 3196 wrote to memory of 2736	3196	spoolsv.exe	90
PID 2560 wrote to memory of 1748	2560	explorer.exe	91
PID 2560 wrote to memory of 1748	2560	explorer.exe	91
PID 2560 wrote to memory of 1748	2560	explorer.exe	91
PID 1748 wrote to memory of 1992	1748	spoolsv.exe	92
PID 1748 wrote to memory of 1992	1748	spoolsv.exe	92
PID 1748 wrote to memory of 1992	1748	spoolsv.exe	92
PID 2560 wrote to memory of 3392	2560	explorer.exe	93
PID 2560 wrote to memory of 3392	2560	explorer.exe	93
PID 2560 wrote to memory of 3392	2560	explorer.exe	93
PID 3392 wrote to memory of 2856	3392	spoolsv.exe	94
PID 3392 wrote to memory of 2856	3392	spoolsv.exe	94
PID 3392 wrote to memory of 2856	3392	spoolsv.exe	94
PID 2560 wrote to memory of 1004	2560	explorer.exe	95
PID 2560 wrote to memory of 1004	2560	explorer.exe	95
PID 2560 wrote to memory of 1004	2560	explorer.exe	95
PID 1004 wrote to memory of 2392	1004	spoolsv.exe	96
PID 1004 wrote to memory of 2392	1004	spoolsv.exe	96
PID 1004 wrote to memory of 2392	1004	spoolsv.exe	96
PID 2560 wrote to memory of 3860	2560	explorer.exe	97
PID 2560 wrote to memory of 3860	2560	explorer.exe	97
PID 2560 wrote to memory of 3860	2560	explorer.exe	97
PID 3860 wrote to memory of 2784	3860	spoolsv.exe	98
PID 3860 wrote to memory of 2784	3860	spoolsv.exe	98
PID 3860 wrote to memory of 2784	3860	spoolsv.exe	98
PID 2560 wrote to memory of 3744	2560	explorer.exe	99

C:\Users\Admin\AppData\Local\Temp\be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe
"C:\Users\Admin\AppData\Local\Temp\be8d92d1284b391e985d34c2d10084e419b44e0ae601d5da090bb62b34e46c50.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3740
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:208
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4940
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4236
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4312
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2736
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4052
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4804
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4336
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4656
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4364
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:712
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4080
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4876
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3988
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1368
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4400
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:408
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4076
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4512
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4324
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:2132
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4632
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4828
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:3964
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4616
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1140
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:2280
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4120
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1880
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:3888
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:2888
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:5040
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4124
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:5032
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:4520
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:4404
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3100
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1432
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1192
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:2492
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1212
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1712
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      PID:1956
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    - Executes dropped EXE
    PID:1112
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1640
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2784
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1760
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3348
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:460
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:792
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3968
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1336
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2988
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:672
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4564
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4308
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4728
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:5048
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4900
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:5064
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4140
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4872
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4840
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2612
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2364
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:804
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3892
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3944
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1140
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5072
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:308
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3440
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4948
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:208
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4368
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3052
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4684
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4680
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3476
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4492
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4132
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2248
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1772
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3032
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3272
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2488
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4208
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4560
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1212
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3392
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1316
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1464
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3248
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3604
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2316
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:432
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2168
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5084
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3152
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3024
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2664
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1336
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4300
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2988
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4008
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4396
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1944
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4688
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4728
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2040
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:5064
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5008
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4140
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2084
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3772
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3596
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4852
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3328
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1032
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:260
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2920
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2748
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2324
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3440
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3568
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:208
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3684
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4800
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4520
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3472
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2596
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4492
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2996
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2248
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1952
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4212
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4016
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3984
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2140
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:532
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4328
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3432
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1712
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2784
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1372
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1760
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4656
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:672
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4300
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4740
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1452
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2588
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4280
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4900
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3760
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4512
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4836
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1480
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2364
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2448
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1032
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1476
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:112
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2536
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4320
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4368
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3568
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4904
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4316
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4312
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:448
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:744
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:956
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4132
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3664
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1748
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3272
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1212
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3984
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1956
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2896
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3248
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4044
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:396
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3544
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:5104
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:792
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4656
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4724
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2900
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3284
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:828
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4648
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3540
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4008
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4300
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:764
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4400
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2516
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3056
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1248
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:3368
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:2264
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1724
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4032
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4140
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:1896
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4792
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:3768
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2728
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:1440
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4000
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4916
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:2748
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      PID:4160
- - \??\c:\windows\SysWOW64\drivers\spoolsv.exe
    c:\windows\system32\drivers\spoolsv.exe
    3⤵
    PID:4124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
C:\Windows\System\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
\??\c:\windows\SysWOW64\drivers\spoolsv.exe

Filesize
184KB

MD5
4b9b2bb1fc4312a1899c0f46bd872173

SHA1
a6482a463555ef5361f1a6ac8d0554b9a1d8b998

SHA256
ed0d346575c83da0c52a275d17efe4b8ab9074f835fe6474901d3a530946824c

SHA512
a6954e87bab47f45e84ca26745405960bd5dad7d60fe06d8ca375cd2759f4a5a77481bb13d835be92553c246bc546c8e055d2283d6776ea00a581351ee859d0f

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
184KB

MD5
cbb34642025f71fc53a4836375fc497a

SHA1
4d593e30531a7aab052e113571fe58e82162b148

SHA256
b2bfa48ed7a0c1b1a72f20e07d977fcfcbf0339982331bb70bee419c1ec289b4

SHA512
bb9af5f2d22d31b56d876e8dc3c9f75b49125dd81c6388801a340982b5bacb388c7e1c5ebf60090475bea27033a9c7e9fc154138f408217a7c615ab45cd87a4f

Download Submit
memory/208-162-0x0000000000000000-mapping.dmp

Download
memory/212-157-0x0000000000000000-mapping.dmp

Download
memory/408-312-0x0000000000000000-mapping.dmp

Download
memory/712-282-0x0000000000000000-mapping.dmp

Download
memory/1004-222-0x0000000000000000-mapping.dmp

Download
memory/1112-451-0x0000000000000000-mapping.dmp

Download
memory/1140-362-0x0000000000000000-mapping.dmp

Download
memory/1192-427-0x0000000000000000-mapping.dmp

Download
memory/1212-437-0x0000000000000000-mapping.dmp

Download
memory/1368-302-0x0000000000000000-mapping.dmp

Download
memory/1432-422-0x0000000000000000-mapping.dmp

Download
memory/1712-442-0x0000000000000000-mapping.dmp

Download
memory/1748-202-0x0000000000000000-mapping.dmp

Download
memory/1880-377-0x0000000000000000-mapping.dmp

Download
memory/1956-447-0x0000000000000000-mapping.dmp

Download
memory/1992-207-0x0000000000000000-mapping.dmp

Download
memory/2132-332-0x0000000000000000-mapping.dmp

Download
memory/2280-367-0x0000000000000000-mapping.dmp

Download
memory/2392-227-0x0000000000000000-mapping.dmp

Download
memory/2492-432-0x0000000000000000-mapping.dmp

Download
memory/2560-135-0x0000000000000000-mapping.dmp

Download
memory/2736-197-0x0000000000000000-mapping.dmp

Download
memory/2784-237-0x0000000000000000-mapping.dmp

Download
memory/2856-217-0x0000000000000000-mapping.dmp

Download
memory/2880-141-0x0000000000000000-mapping.dmp

Download
memory/2888-387-0x0000000000000000-mapping.dmp

Download
memory/3100-417-0x0000000000000000-mapping.dmp

Download
memory/3196-192-0x0000000000000000-mapping.dmp

Download
memory/3392-212-0x0000000000000000-mapping.dmp

Download
memory/3740-147-0x0000000000000000-mapping.dmp

Download
memory/3744-242-0x0000000000000000-mapping.dmp

Download
memory/3860-232-0x0000000000000000-mapping.dmp

Download
memory/3888-382-0x0000000000000000-mapping.dmp

Download
memory/3960-172-0x0000000000000000-mapping.dmp

Download
memory/3964-352-0x0000000000000000-mapping.dmp

Download
memory/3988-297-0x0000000000000000-mapping.dmp

Download
memory/4052-247-0x0000000000000000-mapping.dmp

Download
memory/4076-317-0x0000000000000000-mapping.dmp

Download
memory/4080-287-0x0000000000000000-mapping.dmp

Download
memory/4120-372-0x0000000000000000-mapping.dmp

Download
memory/4124-397-0x0000000000000000-mapping.dmp

Download
memory/4236-177-0x0000000000000000-mapping.dmp

Download
memory/4312-187-0x0000000000000000-mapping.dmp

Download
memory/4316-182-0x0000000000000000-mapping.dmp

Download
memory/4324-327-0x0000000000000000-mapping.dmp

Download
memory/4336-262-0x0000000000000000-mapping.dmp

Download
memory/4364-272-0x0000000000000000-mapping.dmp

Download
memory/4400-307-0x0000000000000000-mapping.dmp

Download
memory/4404-412-0x0000000000000000-mapping.dmp

Download
memory/4512-322-0x0000000000000000-mapping.dmp

Download
memory/4520-407-0x0000000000000000-mapping.dmp

Download
memory/4616-357-0x0000000000000000-mapping.dmp

Download
memory/4632-337-0x0000000000000000-mapping.dmp

Download
memory/4656-267-0x0000000000000000-mapping.dmp

Download
memory/4796-342-0x0000000000000000-mapping.dmp

Download
memory/4804-252-0x0000000000000000-mapping.dmp

Download
memory/4828-347-0x0000000000000000-mapping.dmp

Download
memory/4876-292-0x0000000000000000-mapping.dmp

Download
memory/4940-167-0x0000000000000000-mapping.dmp

Download
memory/4948-152-0x0000000000000000-mapping.dmp

Download
memory/5004-277-0x0000000000000000-mapping.dmp

Download
memory/5032-402-0x0000000000000000-mapping.dmp

Download
memory/5040-392-0x0000000000000000-mapping.dmp

Download
memory/5100-257-0x0000000000000000-mapping.dmp

Download