75e3d1a5056127ffa830519060b70e6e6c84c5faaf0c71d8b5aff58803641ef9

Analysis

max time kernel
121s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Size 449KB
Sample260720-lpdrssf16x
SHA256 75e3d1a5056127ffa830519060b70e6e6c84c5faaf0c71d8b5aff58803641ef9
MD5 6b7dfba8b3f36637c6990b9bd77d6d21
SHA1 bdbabaed3a3eb5d6cd4d3cbed2d903d8c9e2d00c
SHA512 68352e8e721fdec3fb1d70626eaf19467b883e917b3b796c5059c350c45e310538cadd82a464ba21efa083c2854a2cf280b038b2f95df7fec68925cbc59bfd4d
SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMX:nGyHm1dAAJybXdE7IlZ8s0qX
TLSH
T13AA407E02740C0A3DBC759B8D4775EAFA532A90C9D29144F36A1BF5F3C7A341426B89B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
2140	explorer.exe
224	explorer.exe
956	spoolsv.exe
3128	spoolsv.exe
1840	spoolsv.exe
1156	spoolsv.exe
1888	spoolsv.exe
1432	spoolsv.exe
3800	spoolsv.exe
600	spoolsv.exe
3248	spoolsv.exe
1916	spoolsv.exe
5048	spoolsv.exe
4476	spoolsv.exe
4648	spoolsv.exe
3028	spoolsv.exe
3528	spoolsv.exe
4196	spoolsv.exe
4864	spoolsv.exe
824	spoolsv.exe
784	spoolsv.exe
1344	spoolsv.exe
2332	spoolsv.exe
1060	spoolsv.exe
2512	spoolsv.exe
552	spoolsv.exe
4184	spoolsv.exe
4224	spoolsv.exe
1444	spoolsv.exe
2328	spoolsv.exe
3992	spoolsv.exe
1300	spoolsv.exe
1672	spoolsv.exe
4156	spoolsv.exe
2416	spoolsv.exe
5056	spoolsv.exe
3016	spoolsv.exe
2960	spoolsv.exe
392	spoolsv.exe
4328	spoolsv.exe
3600	spoolsv.exe
3904	spoolsv.exe
856	spoolsv.exe
1280	spoolsv.exe
1988	spoolsv.exe
4076	spoolsv.exe
4760	spoolsv.exe
1692	spoolsv.exe
3836	spoolsv.exe
1372	spoolsv.exe
4652	spoolsv.exe
4964	spoolsv.exe
3092	spoolsv.exe
2968	spoolsv.exe
4748	explorer.exe
1636	spoolsv.exe
3824	spoolsv.exe
3996	spoolsv.exe
4876	spoolsv.exe
1792	spoolsv.exe
3440	spoolsv.exe
3880	spoolsv.exe
368	spoolsv.exe
3284	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4916 set thread context of 708	4916	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	85
PID 2140 set thread context of 224	2140	explorer.exe	98
PID 4196 set thread context of 4328	4196	spoolsv.exe	140
PID 3016 set thread context of 3600	3016	spoolsv.exe	141
PID 1672 set thread context of 3904	1672	spoolsv.exe	142
PID 4156 set thread context of 856	4156	spoolsv.exe	143
PID 1060 set thread context of 1988	1060	spoolsv.exe	144
PID 3992 set thread context of 1280	3992	spoolsv.exe	145
PID 1344 set thread context of 4076	1344	spoolsv.exe	146
PID 552 set thread context of 4760	552	spoolsv.exe	147
PID 824 set thread context of 1692	824	spoolsv.exe	149
PID 5048 set thread context of 3836	5048	spoolsv.exe	151
PID 1432 set thread context of 4652	1432	spoolsv.exe	148
PID 3800 set thread context of 4964	3800	spoolsv.exe	150
PID 600 set thread context of 3092	600	spoolsv.exe	152
PID 1156 set thread context of 2968	1156	spoolsv.exe	154
PID 5056 set thread context of 3824	5056	spoolsv.exe	158
PID 2960 set thread context of 3996	2960	spoolsv.exe	157
PID 1300 set thread context of 4876	1300	spoolsv.exe	159
PID 3528 set thread context of 1792	3528	spoolsv.exe	160
PID 784 set thread context of 3880	784	spoolsv.exe	162
PID 1888 set thread context of 368	1888	spoolsv.exe	164
PID 3028 set thread context of 3284	3028	spoolsv.exe	163
PID 2332 set thread context of 4800	2332	spoolsv.exe	165
PID 4476 set thread context of 5080	4476	spoolsv.exe	166
PID 2416 set thread context of 4244	2416	spoolsv.exe	167
PID 4864 set thread context of 4260	4864	spoolsv.exe	170
PID 2512 set thread context of 5040	2512	spoolsv.exe	171
PID 3128 set thread context of 5172	3128	spoolsv.exe	178
PID 4184 set thread context of 2892	4184	spoolsv.exe	177
PID 1916 set thread context of 760	1916	spoolsv.exe	168
PID 4224 set thread context of 4032	4224	spoolsv.exe	169
PID 1444 set thread context of 2912	1444	spoolsv.exe	172
PID 3248 set thread context of 3388	3248	spoolsv.exe	175
PID 1840 set thread context of 4644	1840	spoolsv.exe	176
PID 4648 set thread context of 2964	4648	spoolsv.exe	173
PID 2328 set thread context of 1992	2328	spoolsv.exe	174
PID 2956 set thread context of 4228	2956	spoolsv.exe	202
PID 4444 set thread context of 4576	4444	spoolsv.exe	203
PID 2108 set thread context of 2100	2108	spoolsv.exe	205
PID 3368 set thread context of 4712	3368	spoolsv.exe	204
PID 6060 set thread context of 788	6060	spoolsv.exe	206
PID 5432 set thread context of 1796	5432	spoolsv.exe	207
PID 5984 set thread context of 1064	5984	spoolsv.exe	208
PID 4748 set thread context of 5276	4748	explorer.exe	209
PID 5932 set thread context of 5480	5932	spoolsv.exe	210
PID 1372 set thread context of 2696	1372	spoolsv.exe	212
PID 956 set thread context of 5256	956	spoolsv.exe	213
PID 2420 set thread context of 3640	2420	spoolsv.exe	216
PID 4600 set thread context of 1912	4600	spoolsv.exe	217
PID 2856 set thread context of 5720	2856	spoolsv.exe	218
PID 6000 set thread context of 5756	6000	spoolsv.exe	224
PID 5148 set thread context of 5272	5148	spoolsv.exe	219
PID 228 set thread context of 4216	228	spoolsv.exe	220
PID 5196 set thread context of 5808	5196	spoolsv.exe	221
PID 6092 set thread context of 5852	6092	spoolsv.exe	225
PID 6044 set thread context of 5816	6044	spoolsv.exe	227
PID 6076 set thread context of 4756	6076	spoolsv.exe	226
PID 6024 set thread context of 5552	6024	spoolsv.exe	228
PID 5968 set thread context of 5128	5968	spoolsv.exe	229
PID 1636 set thread context of 5228	1636	spoolsv.exe	231
PID 392 set thread context of 4312	392	spoolsv.exe	232
PID 3440 set thread context of 3336	3440	spoolsv.exe	230
PID 3676 set thread context of 5740	3676	spoolsv.exe	253

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
224	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
224	explorer.exe
224	explorer.exe
4328	spoolsv.exe
4328	spoolsv.exe
3600	spoolsv.exe
3600	spoolsv.exe
3904	spoolsv.exe
3904	spoolsv.exe
856	spoolsv.exe
856	spoolsv.exe
1280	spoolsv.exe
1280	spoolsv.exe
4076	spoolsv.exe
4760	spoolsv.exe
4076	spoolsv.exe
4760	spoolsv.exe
1988	spoolsv.exe
1988	spoolsv.exe
1692	spoolsv.exe
1692	spoolsv.exe
3836	spoolsv.exe
3836	spoolsv.exe
4652	spoolsv.exe
4652	spoolsv.exe
4964	spoolsv.exe
3092	spoolsv.exe
4964	spoolsv.exe
3092	spoolsv.exe
2968	spoolsv.exe
2968	spoolsv.exe
3824	spoolsv.exe
3824	spoolsv.exe
3996	spoolsv.exe
3996	spoolsv.exe
4876	spoolsv.exe
4876	spoolsv.exe
1792	spoolsv.exe
1792	spoolsv.exe
3880	spoolsv.exe
368	spoolsv.exe
3284	spoolsv.exe
3284	spoolsv.exe
3880	spoolsv.exe
368	spoolsv.exe
4800	spoolsv.exe
4800	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
4244	spoolsv.exe
4260	spoolsv.exe
5040	spoolsv.exe
5172	spoolsv.exe
5040	spoolsv.exe
5172	spoolsv.exe
2892	spoolsv.exe
2892	spoolsv.exe
760	spoolsv.exe
4032	spoolsv.exe
2912	spoolsv.exe
1992	spoolsv.exe
1992	spoolsv.exe
4032	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 708	4916	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	85
PID 4916 wrote to memory of 708	4916	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	85
PID 4916 wrote to memory of 708	4916	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	85
PID 4916 wrote to memory of 708	4916	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	85
PID 4916 wrote to memory of 708	4916	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	85
PID 708 wrote to memory of 2140	708	2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe	86
PID 2140 wrote to memory of 224	2140	explorer.exe	98
PID 2140 wrote to memory of 224	2140	explorer.exe	98
PID 2140 wrote to memory of 224	2140	explorer.exe	98
PID 2140 wrote to memory of 224	2140	explorer.exe	98
PID 2140 wrote to memory of 224	2140	explorer.exe	98
PID 224 wrote to memory of 956	224	explorer.exe	99
PID 224 wrote to memory of 3128	224	explorer.exe	100
PID 224 wrote to memory of 1840	224	explorer.exe	103
PID 224 wrote to memory of 1156	224	explorer.exe	104
PID 224 wrote to memory of 1888	224	explorer.exe	105
PID 224 wrote to memory of 1432	224	explorer.exe	106
PID 224 wrote to memory of 3800	224	explorer.exe	107
PID 224 wrote to memory of 600	224	explorer.exe	108
PID 224 wrote to memory of 3248	224	explorer.exe	109
PID 224 wrote to memory of 1916	224	explorer.exe	110
PID 224 wrote to memory of 5048	224	explorer.exe	111
PID 224 wrote to memory of 4476	224	explorer.exe	114
PID 224 wrote to memory of 4648	224	explorer.exe	115
PID 224 wrote to memory of 3028	224	explorer.exe	116
PID 224 wrote to memory of 3528	224	explorer.exe	117
PID 224 wrote to memory of 4196	224	explorer.exe	118
PID 224 wrote to memory of 4864	224	explorer.exe	119
PID 224 wrote to memory of 824	224	explorer.exe	120
PID 224 wrote to memory of 784	224	explorer.exe	121
PID 224 wrote to memory of 1344	224	explorer.exe	122
PID 224 wrote to memory of 2332	224	explorer.exe	123
PID 224 wrote to memory of 1060	224	explorer.exe	124
PID 224 wrote to memory of 2512	224	explorer.exe	125
PID 224 wrote to memory of 552	224	explorer.exe	126
PID 224 wrote to memory of 4184	224	explorer.exe	127
PID 224 wrote to memory of 4224	224	explorer.exe	128
PID 224 wrote to memory of 1444	224	explorer.exe	129
PID 224 wrote to memory of 2328	224	explorer.exe	130
PID 224 wrote to memory of 3992	224	explorer.exe	131
PID 224 wrote to memory of 1300	224	explorer.exe	132
PID 224 wrote to memory of 1672	224	explorer.exe	133
PID 224 wrote to memory of 4156	224	explorer.exe	134
PID 224 wrote to memory of 2416	224	explorer.exe	135
PID 224 wrote to memory of 5056	224	explorer.exe	136
PID 224 wrote to memory of 3016	224	explorer.exe	137
PID 224 wrote to memory of 2960	224	explorer.exe	138
PID 224 wrote to memory of 392	224	explorer.exe	139
PID 4196 wrote to memory of 4328	4196	spoolsv.exe	140
PID 3016 wrote to memory of 3600	3016	spoolsv.exe	141
PID 1672 wrote to memory of 3904	1672	spoolsv.exe	142
PID 4156 wrote to memory of 856	4156	spoolsv.exe	143
PID 1060 wrote to memory of 1988	1060	spoolsv.exe	144
PID 3992 wrote to memory of 1280	3992	spoolsv.exe	145
PID 1344 wrote to memory of 4076	1344	spoolsv.exe	146
PID 4196 wrote to memory of 4328	4196	spoolsv.exe	140
PID 4196 wrote to memory of 4328	4196	spoolsv.exe	140
PID 4196 wrote to memory of 4328	4196	spoolsv.exe	140
PID 4196 wrote to memory of 4328	4196	spoolsv.exe	140
PID 552 wrote to memory of 4760	552	spoolsv.exe	147
PID 3016 wrote to memory of 3600	3016	spoolsv.exe	141
PID 3016 wrote to memory of 3600	3016	spoolsv.exe	141
PID 3016 wrote to memory of 3600	3016	spoolsv.exe	141
PID 3016 wrote to memory of 3600	3016	spoolsv.exe	141

C:\Users\Admin\AppData\Local\Temp\2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-20_6b7dfba8b3f36637c6990b9bd77d6d21_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:708
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:224
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:956
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5256
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3128
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5172
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1840
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4644
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1156
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:368
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1432
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4652
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3800
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4964
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:600
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3092
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3248
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3388
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1916
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:760
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5048
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3836
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4476
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4648
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2964
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3028
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3284
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3528
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4196
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4328
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4748
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5276
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4864
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4260
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:824
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:784
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3880
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1344
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2332
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4800
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2512
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5040
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:552
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4760
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4184
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2892
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4224
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4032
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1444
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2912
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2328
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1992
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3992
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1300
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4156
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2416
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4244
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5056
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3824
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3016
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3600
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2960
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3996
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:392
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4312
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1372
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2696
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1636
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5228
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3440
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3336
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5432
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1796
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5932
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5480
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5968
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5128
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5984
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1064
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:6000
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5756
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:6024
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5552
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:6044
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5816
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:6060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:788
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:6076
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4756
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:6092
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5852
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5196
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5808
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:228
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4216
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2108
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2100
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3368
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4712
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4600
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1912
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2420
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3640
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1944
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5148
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5272
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2956
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5264
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5656
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4444
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4576
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2856
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5216
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3188
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5936
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2260
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1700
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3572
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5796
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5132
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5544
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5988
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4324
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5836
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4788
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5872
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5416
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5460
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5484
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3676
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5740
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5364
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5940
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5620
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5880
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5684
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2984
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5452
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5884
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4520
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:828
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5804
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1708
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2252
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6008
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2096
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1420
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5204
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5772
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4752
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2292
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4176
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5332
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4660
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1308
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3924
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5360
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4844
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2320
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5896
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4896
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5344
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5556
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:536
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5892
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3668
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3912
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3376
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5244
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5560
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5336
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3468
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4688
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4972
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5516
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5784
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3172
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5668
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5976
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2900
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1148
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3804
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:312
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5252
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5588
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5448
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3052
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5156
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6080
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:548
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6004
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4892
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3392
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4172
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5636
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6028
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5972
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4356
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6048
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5672
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5980
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5856
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:776
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3636
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5696
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3832
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5548
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5788
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6064
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5140
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5412
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5712
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3972
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1832
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3816
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4624
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5600
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5564
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:116
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5472
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4552
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1324
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5280
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5444
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4920
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5728
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5464
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:752
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5220
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3744
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5908
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4544
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4360
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4860
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3276
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3976
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2780
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2204
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5292
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1476
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2216
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5340
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3168
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1660
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:3220
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6584
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6032
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5824
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5324
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4924
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2740
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5732
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1128
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5568
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5320
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2844
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5876
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3480
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5152
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4292
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4908
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5680
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5996
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5580
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4164
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6384
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6068
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4732
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5724
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5868
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5716
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5212
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5064
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5532
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:988
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5200
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4944
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5536
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3000
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5488
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3332
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5780
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6648
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3884
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4436
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5508
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5396
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1540
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5440
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2408
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1232
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5380
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5284
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6012
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3692
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1240
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5136
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5308
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:652
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5144
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6380
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6740
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1836
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6764
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4220
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6796
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6288
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6816
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6848
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6184
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6880
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6164
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6908
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7156
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6924
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5576
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6940
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:452
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6956
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5660
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6972
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7140
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:6596
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6884
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6988
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4132
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7012
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7148
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7028
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5888
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7044
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3228
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5260
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7076
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7092
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7108
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2392
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7124
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5604
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4000
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6876
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7152
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5840
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6224
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6756
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:736
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5800
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7116
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:800
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6452
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3264
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6176
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:64
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6460
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4784
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6408
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4524
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7032
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6536
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6236
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2068
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6436
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:6964
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5752
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5664
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1192
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6968
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6776
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5096
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2644
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4596
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:996
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5288
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4168
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6696
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6072
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5408
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6612
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3660
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6412
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4264
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6724
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6772
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6036
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6428
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6820
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5580
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7072
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6264
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7144
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6588
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7020
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5328
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2316
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6652
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5744
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6568
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2804
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7136
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7096
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4456
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7000
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6744
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3828
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:6712
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3616
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6952
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3412
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6860
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2340
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6344
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7004
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6328
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4668
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6392
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6688
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6296
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3304
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5492
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6308
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6856
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6508
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6808
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6540
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6196
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7048
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1084
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5192
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5428
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2660
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6324
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7164
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5708
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5240
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1544
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6100
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1848
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5224
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5400
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5404
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6840
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7104
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5832
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6396
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4584
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6168
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6936
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6716
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5676
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7056
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1876
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7080
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6644
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5188
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6368
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6304
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6332
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4556
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6488
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6316
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5916
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6680
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6352
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6684
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6448
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7120
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5104
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4280
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6852
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6624
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4848
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6620
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6552
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6360
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2088
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2576
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4856
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6528
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6872
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4780
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6728
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5184
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6556
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4580
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6152
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5500
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6632
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6572
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6272
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4636
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6372
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6500
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6052
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6464
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6172
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6432
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6800
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6576
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3384
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6600
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4160
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6312
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6752
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6636
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3156
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2324
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1736
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:6484
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:7916
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5376
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3932
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7052
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6656
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4144
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5160
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6804
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3808
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7264
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7460
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8028
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7496
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8060
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7512
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8008
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7528
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7992
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7544
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8000
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7560
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8048
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7584
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7884
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7600
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7892
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7624
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7984
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7640
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7976
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7664
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7868
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7680
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7876
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7708
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7908
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7724
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7860
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:6628
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:7128
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7748
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7900
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7772
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7932
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7788
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7956
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7812
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7924
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4036
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5068
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7384
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4548
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:7396
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3032
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7784
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6616
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8148
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5612
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7856
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1472
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8044
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7488
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6440
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7556
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7304
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7524
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6564
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8100
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7172
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7196
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7904
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7228
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7492
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:648
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7268
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6104
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1160
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7252
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7292
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2796
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7308
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7700
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7336
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7620
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7448
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7744
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6960
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5052
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8132
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8080
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5384
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8136
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5388
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5760
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:7612
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6660
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5748
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7936
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6340
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7824
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3752
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8068
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6512
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6424
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8116
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7704
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7192
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7660
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4188
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7392
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7024
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1936
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7100
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6828
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7220
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7040
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7388
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7216
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7456
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7416
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2972
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8184
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5948
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7764
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7848
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6836
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6780
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2012
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3648
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4768
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:8176
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3008
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6520
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3024
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7348
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6892
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5044
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5436
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7332
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2052
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5920
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7840
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:632
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6992
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7968
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2884
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5944
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5900
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7852
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6476
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7296
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5820
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1872
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4420
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6496
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7280
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6900
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7340
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7536
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6524
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7676
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7188
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5372
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7476
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:7452
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:7608
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3020
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8024
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7272
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5232
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7636
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6944
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7364
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7756
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:216
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:176
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6260
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7880
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7484
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7712
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7248
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5524
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7796
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3900
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6336
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6400
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7672
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5500
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1296
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7576
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1516
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8124
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2004
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7760
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1140
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6252
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3044
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7668
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3048
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8064
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1940
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7616
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6532
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5420
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:344
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7212
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7692
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6912
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5248
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7912
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7804
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7780
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7592
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3152
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2712
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:8180
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6416
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6504
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6148
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6784
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2868
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7844
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6268
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4344
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6580
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8020
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6280
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5504
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7324
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7068
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1408
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7508
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7132
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1664
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6212
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7732
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7516
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7720
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3448
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6904
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6868
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6284
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7376
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8104
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2728
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7468
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4764
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7948
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3108
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4564
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7728
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4724
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5468
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7820
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5356
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8016
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7648
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7500
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6708
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7412
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7204
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3352
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6140
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:8224
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:8276
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1780
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7288
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3920
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1164
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7872
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8032
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7424
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7112
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5348
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6812
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4776
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8812
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6516
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5076
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7300
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8476
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7816
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8500
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7464
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8516
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8244
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8532
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8892
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8548
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8788
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8568
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8876
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8584
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8796
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:8964
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:8668
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8600
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8996
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8616
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8884
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8632
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8868
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8648
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8820
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8664
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8904
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8680
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8844
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8696
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8836
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8712
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8860
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8728
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8828
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8744
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8852
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8760
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8792
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8804
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7888
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5340
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8428
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3952
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:7568
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7176
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8840
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8052
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8848
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2272
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1244
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7696
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8552
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2480
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1396
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8036
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2424
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8356
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4212
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7836
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8564
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2796
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3772
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4804
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8404
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6544
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8460
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7572
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8348
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8012
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8400
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7360
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8436
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7864
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8332
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4280
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8288
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:8444
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8308
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8380
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8520
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7504
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5164
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8172
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8344
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7564
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7964
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8508
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7632
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7684
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8420
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7224
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6704
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5596
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6200
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6928
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7940
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:8800
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:7380
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 449KB
SHA256 3b125a9757214cb6a64aa2cd0daf3c13b6142df342942ed82b845594657e8573
MD5 5e1588ef57cef55b95d1efbb734bf6d0
SHA1 ec6aa8700dd17001f8b0f03f406375ddeac905c7
SHA512 3f2d738c8dbb5061db7712855d7629f950b93a09b98d8ef9091af988f4026760c58b0a6f920430427180487d03fb35429c7cadec782164f1fdf57d2fa90c7d9b
SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMb:nGyHm1dAAJybXdE7IlZ8s0qb
TLSH
T1D1A418E42742C071CB9785B5D03B8EBB9933945E9D66128B7A5AFF0E6C73343413688B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 449KB
SHA256 f5ff9e82ff2c1dd1c41d7914a0edabd6758e69c563a2f9bf28ca309e907d1afd
MD5 0e5f5059ca7a6ef3024ad7385acd7ef9
SHA1 b436cd7634a2b80eaf133ff06abb18e7e27ef9b7
SHA512 5e94d684565fe2d8c891b705d76663fe139b65d0bdae1d990bb6c66a843c00fe61f86800514bad3ef6980d1400f238fe9674a9b1239938acc19be95af92fe6bd
SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMi:nGyHm1dAAJybXdE7IlZ8s0qi
TLSH
T1E8A4F7F06601C0A4EB9B4439D43B9EAFB433710D9D79565E3A59BF2F2D31382016B89B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-254-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/224-16-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/224-1896-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/368-269-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/452-1669-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/452-1692-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/708-2-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/708-11-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/708-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/760-342-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/760-377-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/776-1097-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/788-453-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/828-733-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/828-677-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/856-111-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/996-1886-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1064-456-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1064-485-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1280-116-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1280-143-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1324-1090-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1660-1248-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1692-149-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1700-802-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1708-674-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1744-673-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1792-263-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1796-479-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1796-454-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1944-808-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1988-169-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1992-368-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2100-419-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2340-2039-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2892-316-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2900-1167-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2912-344-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2964-375-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2968-198-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3008-3367-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3092-179-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3092-193-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3228-1653-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3284-265-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3332-1399-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3336-610-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3392-1170-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3600-108-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3616-2222-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3640-514-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3740-1404-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3828-1972-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3832-1095-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3836-151-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3880-267-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3904-110-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3972-1162-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3976-1249-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3996-266-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4032-390-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4032-343-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4076-117-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4076-155-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4228-494-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4228-417-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4244-315-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4244-385-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4260-374-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4260-317-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4312-612-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4328-107-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4652-152-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4652-192-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4660-941-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4712-420-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4712-424-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4720-1696-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4760-158-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4760-118-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4856-2542-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4896-935-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5040-318-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5080-314-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5136-1400-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5144-1695-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5172-365-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5172-313-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5204-766-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5212-1474-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5256-486-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5256-474-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5260-1575-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5276-491-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5284-1402-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5412-1093-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5444-1342-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5472-1092-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5480-482-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5568-1250-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5580-2038-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5656-809-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5668-882-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5668-972-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5728-1099-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5732-1260-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5740-671-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5752-2057-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5756-541-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5764-1259-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5808-584-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5852-542-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5876-1258-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5884-678-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5892-883-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5904-884-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5936-765-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5940-969-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5972-1096-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6008-675-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6196-2204-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6288-1651-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6436-1755-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6584-1516-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6648-1707-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6660-3207-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6884-1864-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/7096-1973-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/7128-2876-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/7140-1569-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/7608-3520-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/7888-4038-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/7916-2704-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/8180-3686-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/8276-3864-0x0000000000400000-0x000000000041F000-memory.dmp

Download