splwow64.exe
Summary
Print Spooler WOW64 helper - enables 32-bit applications to print on 64-bit Windows through the spooler thunking layer.
splwow64.exe is the 394th most commonly executed Windows program in EchoTrail's dataset, observed 19,206 times across enterprise environments. It typically runs from C:\Windows and it is most often launched by EXCEL.EXE.
Behavior
Top Paths
- C:\Windows100%
Top Hashes (SHA256)
- d9fc77edf8f0930b63c9b3014b374658d4adb805befe99d8e693705fbb50120c30.84%
- 217dd7b54974ea35554e9aa26c5c3fe4d847fb975c88efca686d3b24d557740d9.45%
- 3bb7fe40eb892e5df9e44be5cc23f923c20ab518598d06f2f1a7c95388ae3c708.34%
- 70bf1c950110a5f30ccc8c8d85a6051b72d7e5a95d1cf8f347c86725b88f60c67.13%
- 47ca5c13cabf3a24ef5d115ea181fa5bf94c8946bec5619a5b910addf06169435.05%
- 615d6d66a1a6da346e3d68350c45b8235f7c184b851b36a516479c9a36306f064.69%
- 4191a65abc7a103829c83edf3634c763c5e824562cfb5d02bf42e1feff754e664.32%
- 13d2146749c41278b0885df1ad841892bd918bd369f9e2f82c4460676957f2d43.15%
- cafd1018b9424cd3e987cc4849e17a6ee0e5a0cd767587320f387a637a964eea2.64%
- 74b098da38c7c0961e7960372cda4d75be9fdbe513e3f376595ed3f1f55df6df2.18%
Process Ancestry
Top Grandparents
- explorer.exe57.58%
- OUTLOOK.EXE15.93%
- wfcrun32.exe8.1%
- services.exe6.79%
- chrome.exe2.12%
- E_YARNHSA.EXE1.65%
- svchost.exe1.13%
- RuntimeBroker.exe0.88%
- firefox.exe0.81%
Top Parents
- EXCEL.EXE27.61%
- WINWORD.EXE26.89%
- spoolsv.exe9.97%
- Acrobat.exe7.23%
- AcroRd32.exe7.19%
- wfica32.exe5.66%
- OUTLOOK.EXE4.71%
- POWERPNT.EXE1.13%
- FoxitReader.exe1.06%
- QBW32.EXE1.05%
Top Children
- sp2eup.exe54.56%
- CPC10Q.EXE31.28%
- CNMSEEU.EXE9.81%
- E_YARNHSA.EXE1.7%
- rundll32.exe0.41%
- E_YARNRAE.EXE0.26%
- acrotray.exe0.1%
- splwow64.exe0.06%
- WerFault.exe0.06%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about splwow64.exe
Rocky answers questions about splwow64.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.