c6c4ec49222a77fa1de0877662b1b2321df876e4ec6db3066d015cf4756cdc77

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 299KB
Sample261027-ttetnaev4s
SHA256 c6c4ec49222a77fa1de0877662b1b2321df876e4ec6db3066d015cf4756cdc77
MD5 5e2f2af2c70a214cbb416f713ec8c381
SHA1 82d1d70fc794088aca0c8708794d430b2a5405d1
SHA512 ae3762bcc5f7441a1f61fc54d4e76d4dc03cc66c7745b8a48963fcc0e782f4dbe5c0564bfc31b9aa13689982bdebdbd96e9e1eb90246917451555c5101160e35
SSDEEP 6144:L+k5XLaJbcplKJmxOYO3rLPFE2NJOdK/wmr:t+JbMJqfFE27P9r
TLSH
T190549DA6B1A030B9E71A0B759A44FE9045590C3E8CD9814FEAFC3C7B16B11EF562721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
3532	explorer.exe
3308	explorer.exe
1700	explorer.exe
4508	spoolsv.exe
2916	spoolsv.exe
4592	spoolsv.exe
4604	explorer.exe
3156	explorer.exe
1636	explorer.exe
6092	explorer.exe
5856	explorer.exe
5716	spoolsv.exe
1136	spoolsv.exe
3436	spoolsv.exe
5188	spoolsv.exe
5852	spoolsv.exe
2360	spoolsv.exe
5272	explorer.exe
4404	spoolsv.exe
1244	explorer.exe
948	explorer.exe
5544	explorer.exe
5888	explorer.exe
5128	explorer.exe
1552	explorer.exe
5208	spoolsv.exe
4704	spoolsv.exe
1408	spoolsv.exe
5584	spoolsv.exe
5736	spoolsv.exe
5780	spoolsv.exe
1356	spoolsv.exe
1184	explorer.exe
6076	explorer.exe
3704	explorer.exe
2880	explorer.exe
5844	explorer.exe
1172	spoolsv.exe
3952	spoolsv.exe
3888	spoolsv.exe
5400	spoolsv.exe
4588	spoolsv.exe
5020	explorer.exe
4784	spoolsv.exe
4572	explorer.exe
4568	explorer.exe
4560	spoolsv.exe
5380	spoolsv.exe
4628	spoolsv.exe
3300	spoolsv.exe
2836	spoolsv.exe
4264	explorer.exe
3232	explorer.exe
544	explorer.exe
4912	spoolsv.exe
2060	spoolsv.exe
5908	spoolsv.exe
1100	spoolsv.exe
3172	spoolsv.exe
6128	spoolsv.exe
5336	spoolsv.exe
4700	spoolsv.exe
3880	explorer.exe
3944	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3472 set thread context of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3532 set thread context of 1700	3532	explorer.exe	94
PID 4508 set thread context of 4592	4508	spoolsv.exe	97
PID 4604 set thread context of 5856	4604	explorer.exe	102
PID 5716 set thread context of 3436	5716	spoolsv.exe	105
PID 5188 set thread context of 2360	5188	spoolsv.exe	110
PID 5272 set thread context of 1552	5272	explorer.exe	118
PID 4404 set thread context of 5584	4404	spoolsv.exe	122
PID 5736 set thread context of 1356	5736	spoolsv.exe	125
PID 1184 set thread context of 5844	1184	explorer.exe	130
PID 1172 set thread context of 4588	1172	spoolsv.exe	135
PID 5020 set thread context of 4568	5020	explorer.exe	139
PID 4784 set thread context of 5380	4784	spoolsv.exe	141
PID 4628 set thread context of 2836	4628	spoolsv.exe	144
PID 4264 set thread context of 544	4264	explorer.exe	147
PID 4912 set thread context of 5908	4912	spoolsv.exe	150
PID 1100 set thread context of 4700	1100	spoolsv.exe	155
PID 3880 set thread context of 5724	3880	explorer.exe	171
PID 3944 set thread context of 5692	3944	spoolsv.exe	175
PID 4820 set thread context of 3480	4820	spoolsv.exe	180
PID 3320 set thread context of 5340	3320	explorer.exe	184
PID 5260 set thread context of 4080	5260	spoolsv.exe	186
PID 4496 set thread context of 2580	4496	spoolsv.exe	189
PID 6080 set thread context of 2020	6080	explorer.exe	192
PID 5664 set thread context of 5528	5664	spoolsv.exe	195
PID 4904 set thread context of 2560	4904	explorer.exe	198
PID 4848 set thread context of 3156	4848	spoolsv.exe	201
PID 204 set thread context of 52	204	explorer.exe	204
PID 1036 set thread context of 3856	1036	spoolsv.exe	207
PID 5912 set thread context of 3388	5912	spoolsv.exe	210
PID 4860 set thread context of 3064	4860	explorer.exe	213
PID 1664 set thread context of 2616	1664	spoolsv.exe	216
PID 4300 set thread context of 5072	4300	spoolsv.exe	219
PID 1244 set thread context of 5888	1244	explorer.exe	222
PID 2800 set thread context of 5596	2800	spoolsv.exe	225
PID 1592 set thread context of 2188	1592	spoolsv.exe	228
PID 5044 set thread context of 2900	5044	explorer.exe	231
PID 1520 set thread context of 1860	1520	spoolsv.exe	234
PID 5944 set thread context of 6100	5944	spoolsv.exe	237
PID 2912 set thread context of 1292	2912	explorer.exe	240
PID 4876 set thread context of 2724	4876	spoolsv.exe	243
PID 1412 set thread context of 472	1412	spoolsv.exe	246
PID 4764 set thread context of 2456	4764	explorer.exe	249
PID 5516 set thread context of 4284	5516	spoolsv.exe	254
PID 3928 set thread context of 3748	3928	spoolsv.exe	257
PID 5772 set thread context of 5356	5772	explorer.exe	262
PID 1256 set thread context of 4732	1256	spoolsv.exe	267
PID 4692 set thread context of 5488	4692	spoolsv.exe	270
PID 3128 set thread context of 5564	3128	explorer.exe	275
PID 5692 set thread context of 1336	5692	spoolsv.exe	280
PID 2264 set thread context of 5264	2264	spoolsv.exe	285
PID 3416 set thread context of 1680	3416	explorer.exe	288
PID 3384 set thread context of 3044	3384	spoolsv.exe	291
PID 5952 set thread context of 5540	5952	spoolsv.exe	294
PID 4636 set thread context of 2992	4636	explorer.exe	297
PID 2560 set thread context of 1632	2560	spoolsv.exe	300
PID 3088 set thread context of 2044	3088	spoolsv.exe	303
PID 1596 set thread context of 5416	1596	explorer.exe	306
PID 4228 set thread context of 2504	4228	spoolsv.exe	309
PID 4712 set thread context of 1496	4712	spoolsv.exe	312
PID 3956 set thread context of 2548	3956	explorer.exe	317
PID 6112 set thread context of 5308	6112	spoolsv.exe	320
PID 4520 set thread context of 2204	4520	spoolsv.exe	323
PID 4812 set thread context of 1620	4812	explorer.exe	326

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.ex_	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	Process not Found
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.ex_	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.ex_	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	Process not Found
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	Process not Found
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	Process not Found
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	Process not Found
File opened for modification	\??\c:\windows\resources\themes\explorer.ex_	Process not Found
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	Process not Found
File opened for modification	\??\c:\windows\resources\themes\explorer.ex_	Process not Found
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	Process not Found
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	Process not Found
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.ex_	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\spoolsv.ex_	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	Process not Found

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3532	explorer.exe
3532	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1700	explorer.exe
1700	explorer.exe
4592	spoolsv.exe
4592	spoolsv.exe
5856	explorer.exe
5856	explorer.exe
3436	spoolsv.exe
3436	spoolsv.exe
2360	spoolsv.exe
2360	spoolsv.exe
1552	explorer.exe
1552	explorer.exe
5584	spoolsv.exe
5584	spoolsv.exe
1356	spoolsv.exe
1356	spoolsv.exe
5844	explorer.exe
5844	explorer.exe
4588	spoolsv.exe
4588	spoolsv.exe
4568	explorer.exe
4568	explorer.exe
5380	spoolsv.exe
5380	spoolsv.exe
2836	spoolsv.exe
2836	spoolsv.exe
544	explorer.exe
544	explorer.exe
5908	spoolsv.exe
5908	spoolsv.exe
4700	spoolsv.exe
4700	spoolsv.exe
5724	explorer.exe
5724	explorer.exe
5692	spoolsv.exe
5692	spoolsv.exe
3480	spoolsv.exe
3480	spoolsv.exe
5340	explorer.exe
5340	explorer.exe
4080	spoolsv.exe
4080	spoolsv.exe
2580	spoolsv.exe
2580	spoolsv.exe
2020	explorer.exe
2020	explorer.exe
5528	spoolsv.exe
5528	spoolsv.exe
2560	explorer.exe
2560	explorer.exe
3156	spoolsv.exe
3156	spoolsv.exe
52	explorer.exe
52	explorer.exe
3856	spoolsv.exe
3856	spoolsv.exe
3388	spoolsv.exe
3388	spoolsv.exe
3064	explorer.exe
3064	explorer.exe
2616	spoolsv.exe
2616	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4108	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3472 wrote to memory of 4868	3472	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 4868 wrote to memory of 3532	4868	2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	92
PID 3532 wrote to memory of 3308	3532	explorer.exe	93
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 3532 wrote to memory of 1700	3532	explorer.exe	94
PID 1700 wrote to memory of 4508	1700	explorer.exe	95
PID 4508 wrote to memory of 2916	4508	spoolsv.exe	96
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4508 wrote to memory of 4592	4508	spoolsv.exe	97
PID 4592 wrote to memory of 4604	4592	spoolsv.exe	98
PID 4604 wrote to memory of 3156	4604	explorer.exe	99
PID 4604 wrote to memory of 1636	4604	explorer.exe	100
PID 4604 wrote to memory of 6092	4604	explorer.exe	101
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 4604 wrote to memory of 5856	4604	explorer.exe	102
PID 1700 wrote to memory of 5716	1700	explorer.exe	103
PID 5716 wrote to memory of 1136	5716	spoolsv.exe	104
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 5716 wrote to memory of 3436	5716	spoolsv.exe	105
PID 1700 wrote to memory of 5188	1700	explorer.exe	106
PID 5188 wrote to memory of 5852	5188	spoolsv.exe	109
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110
PID 5188 wrote to memory of 2360	5188	spoolsv.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  2⤵
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-26_5e2f2af2c70a214cbb416f713ec8c381_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4868
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Executes dropped EXE
      PID:3308
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1700
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4508
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:2916
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:3156
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:1636
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:6092
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5856
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5716
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:1136
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3436
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5188
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:5852
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5272
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:1244
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:948
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:5544
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:5888
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:5128
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1552
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4404
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:5208
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:4704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:1408
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5584
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5736
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:5780
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1184
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:6076
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:3704
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:2880
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5844
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1172
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:3952
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:3888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:5400
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5020
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:4572
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4568
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4784
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:4560
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5380
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4628
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:3300
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4264
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        
        PID:3232
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4912
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:2060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5908
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1100
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:3172
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:6128
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        
        PID:5336
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3880
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5436
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2596
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4692
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2908
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1352
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5488
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4872
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1828
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5604
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4540
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3128
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:416
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1492
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5724
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3944
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5564
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5836
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5692
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4820
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1404
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2532
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1392
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3320
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5256
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5340
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5260
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4436
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4080
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4496
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5412
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:6080
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1516
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2020
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5664
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1936
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5528
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4904
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4816
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2560
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4848
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2672
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3156
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:204
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5804
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:52
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1036
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3856
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5912
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5084
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3388
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4860
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1496
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3064
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1664
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5312
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2616
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4300
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5072
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1244
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5544
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5888
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2800
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1740
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5596
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1592
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1988
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2188
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:5044
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2736
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1520
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4084
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1860
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5944
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:812
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6100
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:2912
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2372
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1292
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4876
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5116
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2724
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1412
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6036
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:472
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4764
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3612
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2456
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5516
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1388
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2120
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3928
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5908
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3452
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:420
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5356
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1256
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1932
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5900
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1684
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4732
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4692
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1352
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5488
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5724
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5608
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5204
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5564
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5692
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1824
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5056
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1336
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2264
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5652
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4884
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3764
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5264
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3416
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4196
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1680
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3384
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2424
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3044
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5952
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4276
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5540
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4636
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4624
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2992
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2560
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3012
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1632
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5372
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1596
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2440
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5416
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4228
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5084
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2504
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4712
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1676
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1496
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3956
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5448
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4972
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1536
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2548
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:6112
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2696
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5308
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4520
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1236
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2204
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4812
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4944
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1620
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1464
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5384
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1652
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4240
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2880
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2472
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1180
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:940
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4492
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4464
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4568
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1668
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5864
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2340
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4548
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5532
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6040
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6032
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3120
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2756
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4284
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4448
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6088
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2156
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:420
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4212
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5712
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5172
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4540
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5636
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2208
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5244
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:712
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5684
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4356
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3368
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1828
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2236
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4884
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3764
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2220
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4896
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5256
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3044
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4892
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4276
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5788
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3284
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1580
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1136
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6024
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:400
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1720
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4160
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1232
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4188
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3460
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5484
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3000
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1540
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4444
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2616
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2832
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3660
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2080
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2260
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4772
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2592
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5840
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:824
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2540
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4100
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2816
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3672
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1652
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1860
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4308
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5400
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3840
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5496
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3952
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4708
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6036
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3324
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4392
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5108
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2340
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5068
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6040
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5984
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5336
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3452
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4440
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2596
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1932
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5436
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5520
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4212
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2732
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3736
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1352
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4856
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5376
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5688
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4732
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4364
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1768
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1492
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4124
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4116
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2932
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1332
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1328
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3496
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5808
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4612
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2020
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1616
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5192
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6092
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1208
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1472
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2316
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4348
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3620
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3476
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4940
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1136
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6024
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:400
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1720
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1872
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1232
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4188
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1636
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6132
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5368
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1540
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5708
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2696
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1868
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1536
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3412
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1120
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1808
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2996
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2116
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1236
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1620
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4256
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4468
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5384
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3028
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2372
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4308
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1860
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3952
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3300
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2660
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1964
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5796
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2120
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4744
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3428
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4236
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4740
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5336
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4440
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4408
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4212
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3736
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6096
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4208
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1336
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5376
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:936
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3368
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4356
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5204
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4884
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4148
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1332
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1328
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1468
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5256
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4108
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4436
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5652
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2684
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2316
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5804
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3380
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5868
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2820
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1136
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3012
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1640
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3856
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1232
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4684
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5560
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2652
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2680
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3372
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4772
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1740
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3660
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1536
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2900
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1808
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4084
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6064
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4100
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3488
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5752
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1652
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4368
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5156
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4572
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5116
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3232
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3356
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4556
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2352
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5796
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4536
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2340
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4852
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3016
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5520
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3512
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5836
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1352
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5240
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2448
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5340
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1196
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1392
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4532
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1768
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5320
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5684
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2396
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1492
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5192
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1208
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4928
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1936
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3328
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4612
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:52
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2024
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1656
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2184
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:108
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:292
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4704
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4188
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5756
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3740
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5956
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6024
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1340
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3276
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4756
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5720
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5060
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3140
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:464
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2228
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4944
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4296
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2756
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5384
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1652
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6016
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1388
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4708
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4460
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5504
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5796
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2004
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4852
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3736
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1104
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:3816
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5980
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3604
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4344
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1196
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3008
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2908
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3368
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4816
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1836
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3176
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2936
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3592
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2772
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:3044
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3092
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5792
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1656
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5448
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3380
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3856
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2356
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2616
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4576
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1340
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3660
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5312
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4220
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:812
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1128
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1508
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4332
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:200
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4100
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1052
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5384
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4468
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2088
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4900
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3428
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3292
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3016
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3420
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4916
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5928
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3052
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2156
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2752
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4600
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2852
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4748
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2732
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5112
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2240
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2532
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5412
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4248
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6092
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2020
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3368
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3464
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1480
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4896
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2916
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3176
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2672
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2748
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2424
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5868
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:400
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3620
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:3160
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4612
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1136
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2604
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2768
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2848
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1604
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5840
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5560
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4576
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2500
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3660
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2232
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5060
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4084
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4332
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5500
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3040
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1904
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1052
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5384
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3428
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4460
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5504
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5124
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4920
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5076
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4864
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5984
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2208
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4744
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5980
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3376
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5936
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4500
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4232
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5344
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5112
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4360
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4356
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3368
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3464
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4164
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5608
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4896
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1492
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4976
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2992
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4416
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:400
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5948
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:252
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3740
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4972
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5276
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4612
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1136
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1328
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3184
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6132
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:940
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1632
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1408
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3400
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5380
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2232
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5060
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3436
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2140
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4084
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3864
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4900
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1840
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3140
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2372
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5356
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1376
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2764
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4504
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1404
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5928
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5000
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1352
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2752
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4408
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1296
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5632
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1616
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3592
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4288
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5412
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1440
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5512
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2024
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3328
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3552
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5084
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4892
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3092
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:108
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5360
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5708
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1676
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3380
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1328
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5780
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:6120
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5308
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1408
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5380
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5324
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4384
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4492
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5384
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5800
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5760
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4308
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2428
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5016
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4920
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2156
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5012
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3736
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4748
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2396
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1332
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1228
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5984
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1000
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1284
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5936
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4196
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2552
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3368
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3592
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5784
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5916
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5852
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4356
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4144
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2748
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3328
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2932
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4972
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4612
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1136
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3740
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3276
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4844
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:616
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2604
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5780
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4572
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:672
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5312
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3660
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5768
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5128
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5992
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1944
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2140
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5060
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:344
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:476
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1240
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:260
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2920
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5116
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2004
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4872
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3356
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6032
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5828
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2156
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:796
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2208
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5984
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5240
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2532
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1552
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4340
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4408
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1876
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4088
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1440
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2852
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2248
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5400
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6104
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:844
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2028
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2992
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3752
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1136
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5560
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4328
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2412
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3436
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2628
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4444
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5208
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5380
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3704
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4572
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3660
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3184
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4740
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5340
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:480
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2776
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5076
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:3140
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2920
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4504
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2372
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3052
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2308
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4748
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:796
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5712
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1336
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2552
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5424
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3464
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1768
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5788
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5708
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2932
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5276
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5372
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5512
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6012
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4368
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:980
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1860
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4492
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2816
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2824
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2088
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4852
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3016
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5128
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3660
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3184
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5312
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3076
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3436
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1984
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5828
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4248
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3376
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4872
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:260
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4108
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1000
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4196
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5652
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5476
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1876
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4964
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4652
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2852
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5788
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5708
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5276
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3276
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2028
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:6012
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4368
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3328
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3372
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1328
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4492
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3704
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3736
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2412
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5128
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3184
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4460
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:5960
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3612
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5000
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5328
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5696
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5800
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4248
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3624
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2652
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2732
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2748
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2084
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:608
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5608
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1040
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5744
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:2884
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:252
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4416
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5704
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2572
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:6012
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:4368
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3016
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3228
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:464
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:200
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5876
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5992
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4944
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2428
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3028
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:916
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3436
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3612
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4196
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2848
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:124
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2852
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2080
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1604
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2748
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1564
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:4964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5744
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2424
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1860
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4976
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1136
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5304
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:2984
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3864
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2880
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2832
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:1684
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1944
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:2888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5104
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3708
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3660
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3400
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:200
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:4920
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5316
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3176
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:3448
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5116
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2428
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2004
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:4948
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1052
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:5424
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:3604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:608
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        
        PID:1796
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:5344
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2992
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:1732
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:124
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2852
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        8⤵
        
        PID:2080
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5964
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1712
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        
        PID:3828
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:1992
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5400
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe
        6⤵
        
        PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 299KB
SHA256 d9f6e7d4a2cae1f74cad3d231b8ea20eebf7ab43d6eab5b8fde09de821d7ad26
MD5 a750886846fbe4cbd857f706608ec33e
SHA1 3cb020397b61715cc4f310214c7df04e3f37733f
SHA512 995b0154e6556af0f7079cbac901336289cbaaf5241a69092fba6a1f840d7db11c31ea1358b63313d8af0ba1b45e8be2efbbb030ef8bcc772b19a447fad633c8
SSDEEP 6144:L+k5XLaJbcplKJmxOYO3rLPFE2NJOdK/wmh:t+JbMJqfFE27P9h
TLSH
T160547C0923229172F7CC0F34B0D1D6E07895AD3A5685E04EE67ABA776D350C79AB318F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 299KB
SHA256 d4599b4dff4c186a4ecad543bd0ad29733ce864413cff636155d42173693cade
MD5 ac920a0779d2c92d6cb9c9f3b105d718
SHA1 53f0d3f0057d7ea4613a3c34f765a0161d1b7121
SHA512 bc7bca42d6ec036cc210e88788f55a0154c6820366a5028b98931fa4d60d548c978821ac30d71bdea262921d092e7f6e12b0914bbddb6612acac84193fc9a094
SSDEEP 6144:L+k5XLaJbcplKJmxOYO3rLPFE2NJOdK/wmP:t+JbMJqfFE27P9P
TLSH
T1D554BF022D004871E3561738C414E4A82AE96CBD09E4E54EF73A3DBABEB655F9B3315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-0-0x0000000000A20000-0x0000000000A25000-memory.dmp

Download

memory/4868-1-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4868-3-0x0000000000400000-0x000000000043E000-memory.dmp

Download