b2a3f339386252da9ca3a61367700f9c361097fc511dca72cd93286b53c51f24

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47f67332f9c6633e07d4f19e374f8784.exe
Size

67KB
MD5

47f67332f9c6633e07d4f19e374f8784
SHA1

d8b9f77191decef0010d6e11229f77beb8e54cd1
SHA256

b2a3f339386252da9ca3a61367700f9c361097fc511dca72cd93286b53c51f24
SHA512

3ad8f0e7987ab1765b0f60b62ef7979ff49cc20f157e37ce1fd71bd4f2cba7af86b895162bbdfa762c16bac0344a26c58622a4876e2e498266b7c7cb25e7c90c
SSDEEP

768:n/xvEJPgR7UgXOs6KZNxqaPVF7PyCMsIABzDDFXXXXXXXXXXXXXXXXXXXXXXXXX3:9EJPkvB6Knx/jLxVIQJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1908	exp1orer.exe
1160	exp1orer.exe
2736	exp1orer.exe
2776	exp1orer.exe
2844	exp1orer.exe
2780	Process not Found
2088	Process not Found
2888	Process not Found
2956	Process not Found
2808	Process not Found
2868	Process not Found
2620	exp1orer.exe
2672	Process not Found
2796	Process not Found
3064	Process not Found
2520	Process not Found
1672	Process not Found
2892	Process not Found
2952	Process not Found
2472	Process not Found
1988	Process not Found
552	exp1orer.exe
2300	Process not Found
1792	Process not Found
1920	Process not Found
1428	exp1orer.exe
292	Process not Found
2296	Process not Found
1516	Process not Found
1612	exp1orer.exe
2276	Process not Found
864	Process not Found
2280	Process not Found
2140	Process not Found
2080	Process not Found
2064	Process not Found
2996	Process not Found
3000	Process not Found
2576	Process not Found
2156	exp1orer.exe
2480	Process not Found
1328	Process not Found
2204	Process not Found
592	Process not Found
692	Process not Found
488	exp1orer.exe
880	Process not Found
596	Process not Found
1632	exp1orer.exe
580	Process not Found
704	Process not Found
996	Process not Found
544	Process not Found
1288	Process not Found
2592	Process not Found
112	Process not Found
1092	exp1orer.exe
1884	Process not Found
2428	Process not Found
1076	exp1orer.exe
1352	Process not Found
1668	Process not Found
1528	Process not Found
2008	exp1orer.exe

Loads dropped DLL 64 IoCs

pid	Process
1048	47f67332f9c6633e07d4f19e374f8784.exe
1048	47f67332f9c6633e07d4f19e374f8784.exe
1908	exp1orer.exe
1908	exp1orer.exe
1160	exp1orer.exe
1160	exp1orer.exe
2736	exp1orer.exe
2736	exp1orer.exe
2776	exp1orer.exe
2776	exp1orer.exe
2844	exp1orer.exe
2844	exp1orer.exe
2780	Process not Found
2780	Process not Found
2088	Process not Found
2088	Process not Found
2888	Process not Found
2888	Process not Found
2956	Process not Found
2956	Process not Found
2808	Process not Found
2808	Process not Found
2868	Process not Found
2868	Process not Found
2620	exp1orer.exe
2620	exp1orer.exe
2672	Process not Found
2672	Process not Found
2796	Process not Found
2796	Process not Found
3064	Process not Found
3064	Process not Found
2520	Process not Found
2520	Process not Found
1672	Process not Found
1672	Process not Found
2892	Process not Found
2892	Process not Found
2952	Process not Found
2952	Process not Found
2472	Process not Found
2472	Process not Found
1988	Process not Found
1988	Process not Found
552	exp1orer.exe
552	exp1orer.exe
2300	Process not Found
2300	Process not Found
1792	Process not Found
1792	Process not Found
1920	Process not Found
1920	Process not Found
1428	exp1orer.exe
1428	exp1orer.exe
292	Process not Found
292	Process not Found
2296	Process not Found
2296	Process not Found
1516	Process not Found
1516	Process not Found
1612	exp1orer.exe
1612	exp1orer.exe
2276	Process not Found
2276	Process not Found

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	47f67332f9c6633e07d4f19e374f8784.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	Process not Found
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1908	1048	47f67332f9c6633e07d4f19e374f8784.exe	28
PID 1048 wrote to memory of 1908	1048	47f67332f9c6633e07d4f19e374f8784.exe	28
PID 1048 wrote to memory of 1908	1048	47f67332f9c6633e07d4f19e374f8784.exe	28
PID 1048 wrote to memory of 1908	1048	47f67332f9c6633e07d4f19e374f8784.exe	28
PID 1908 wrote to memory of 1160	1908	exp1orer.exe	30
PID 1908 wrote to memory of 1160	1908	exp1orer.exe	30
PID 1908 wrote to memory of 1160	1908	exp1orer.exe	30
PID 1908 wrote to memory of 1160	1908	exp1orer.exe	30
PID 1160 wrote to memory of 2736	1160	exp1orer.exe	29
PID 1160 wrote to memory of 2736	1160	exp1orer.exe	29
PID 1160 wrote to memory of 2736	1160	exp1orer.exe	29
PID 1160 wrote to memory of 2736	1160	exp1orer.exe	29
PID 2736 wrote to memory of 2776	2736	exp1orer.exe	31
PID 2736 wrote to memory of 2776	2736	exp1orer.exe	31
PID 2736 wrote to memory of 2776	2736	exp1orer.exe	31
PID 2736 wrote to memory of 2776	2736	exp1orer.exe	31
PID 2776 wrote to memory of 2844	2776	exp1orer.exe	32
PID 2776 wrote to memory of 2844	2776	exp1orer.exe	32
PID 2776 wrote to memory of 2844	2776	exp1orer.exe	32
PID 2776 wrote to memory of 2844	2776	exp1orer.exe	32
PID 2844 wrote to memory of 2780	2844	exp1orer.exe	2066
PID 2844 wrote to memory of 2780	2844	exp1orer.exe	2066
PID 2844 wrote to memory of 2780	2844	exp1orer.exe	2066
PID 2844 wrote to memory of 2780	2844	exp1orer.exe	2066
PID 2780 wrote to memory of 2088	2780	Process not Found	2065
PID 2780 wrote to memory of 2088	2780	Process not Found	2065
PID 2780 wrote to memory of 2088	2780	Process not Found	2065
PID 2780 wrote to memory of 2088	2780	Process not Found	2065
PID 2088 wrote to memory of 2888	2088	Process not Found	2067
PID 2088 wrote to memory of 2888	2088	Process not Found	2067
PID 2088 wrote to memory of 2888	2088	Process not Found	2067
PID 2088 wrote to memory of 2888	2088	Process not Found	2067
PID 2888 wrote to memory of 2956	2888	Process not Found	2063
PID 2888 wrote to memory of 2956	2888	Process not Found	2063
PID 2888 wrote to memory of 2956	2888	Process not Found	2063
PID 2888 wrote to memory of 2956	2888	Process not Found	2063
PID 2956 wrote to memory of 2808	2956	Process not Found	2062
PID 2956 wrote to memory of 2808	2956	Process not Found	2062
PID 2956 wrote to memory of 2808	2956	Process not Found	2062
PID 2956 wrote to memory of 2808	2956	Process not Found	2062
PID 2808 wrote to memory of 2868	2808	Process not Found	2061
PID 2808 wrote to memory of 2868	2808	Process not Found	2061
PID 2808 wrote to memory of 2868	2808	Process not Found	2061
PID 2808 wrote to memory of 2868	2808	Process not Found	2061
PID 2868 wrote to memory of 2620	2868	Process not Found	33
PID 2868 wrote to memory of 2620	2868	Process not Found	33
PID 2868 wrote to memory of 2620	2868	Process not Found	33
PID 2868 wrote to memory of 2620	2868	Process not Found	33
PID 2620 wrote to memory of 2672	2620	exp1orer.exe	2060
PID 2620 wrote to memory of 2672	2620	exp1orer.exe	2060
PID 2620 wrote to memory of 2672	2620	exp1orer.exe	2060
PID 2620 wrote to memory of 2672	2620	exp1orer.exe	2060
PID 2672 wrote to memory of 2796	2672	Process not Found	2059
PID 2672 wrote to memory of 2796	2672	Process not Found	2059
PID 2672 wrote to memory of 2796	2672	Process not Found	2059
PID 2672 wrote to memory of 2796	2672	Process not Found	2059
PID 2796 wrote to memory of 3064	2796	Process not Found	2058
PID 2796 wrote to memory of 3064	2796	Process not Found	2058
PID 2796 wrote to memory of 3064	2796	Process not Found	2058
PID 2796 wrote to memory of 3064	2796	Process not Found	2058
PID 3064 wrote to memory of 2520	3064	Process not Found	2057
PID 3064 wrote to memory of 2520	3064	Process not Found	2057
PID 3064 wrote to memory of 2520	3064	Process not Found	2057
PID 3064 wrote to memory of 2520	3064	Process not Found	2057

C:\Users\Admin\AppData\Local\Temp\47f67332f9c6633e07d4f19e374f8784.exe
"C:\Users\Admin\AppData\Local\Temp\47f67332f9c6633e07d4f19e374f8784.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
      4⤵
      PID:17256
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
    3⤵
    PID:17272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\47F673~1.EXE >> NUL
  2⤵
  PID:17264

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
      4⤵
      PID:17372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
    3⤵
    PID:17320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
  2⤵
  PID:17284

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
  2⤵
  PID:17568

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
  2⤵
  PID:17444

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
  2⤵
  PID:17696

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1612

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2156

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:488

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1632

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
PID:1092

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1076

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2008

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Drops file in System32 directory
PID:1652

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1248

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2196

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1760

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3040

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2336

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2128

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1596

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1568

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2536

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2396

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2984

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2744

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2792

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2624

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2692

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1660

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3056

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2416

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2244

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1052

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2304

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2368

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1096

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:540

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:808

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3036

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1168

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3028

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3084

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3116

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3148
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:3164

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3140

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3196

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3268

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3300

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3332

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3364

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3388

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3428

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3460

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3492

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3524

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3556

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3620

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3652

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3684
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:3692

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3700

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3764

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3860

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3892

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3916

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3956

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4012

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4076

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4104

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4092

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4136

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4200

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4232

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4256

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4296

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4360

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4392
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:4408

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4440

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4472

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4496

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4528

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4552

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4584

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4612

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4636
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:4644

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4652

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4684

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4772

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4804

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4836

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4860
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:4868

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4876

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4908

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4940

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4972

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5036

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5060

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5092

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:4592

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5124

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1720

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5256

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5280

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5376
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5384

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5392

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5424

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5448

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5472

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5512

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5568

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5600
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5608
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:5616

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5648

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5672

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5704

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5736

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5760

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5792
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5800

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5808

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5832

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5856

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5880

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5908

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5940

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5972
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5980

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6020

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6068

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6100

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6132

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6156

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6180

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6212

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6244

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6276

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6300

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6324

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6316

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6356

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6380

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6412

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6444

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6468
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6476

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6508

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6532

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6564

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6596

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6620

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6636
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6644

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6672

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6704

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6728

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6760

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6784
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6792

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6776

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6816

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6848

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6880

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6912

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6944

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6968

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6992
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7000

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7008
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7048

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7104

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7136

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7256
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7264

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7248

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7296

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7384

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7420

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7452

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7484

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7516

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7540

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7572

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7596

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7628

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7660

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7684

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7716

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7732
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7772

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7804

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7836

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7868

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7900

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7932

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7996
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8028

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8060

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8092

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8116

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8156

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8188

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8220

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8260

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8300

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8332

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8364

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8396

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8428

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8452

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8484

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8516

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8548

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8604

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8636

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8668

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8700

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8764

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8852

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8884

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8908

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8932

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8992

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9024

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9048

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9104

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9128

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9120

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9152

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9184

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9208

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9248

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9272

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9304

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9336

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9360
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9368

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9400

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9432

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9456

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9488

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9520

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9552

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9584

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9608

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9632

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9664

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9688

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9724

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9748

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9836

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9868

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9892

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9924

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9948

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9980

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10012

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10028

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10052

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10076

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10108

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10140

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10172

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10204

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10196

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10268

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10284

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10300

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10324

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10356

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10380

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10412

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10444

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10480

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10504

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10528

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10560
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10568

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10576
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10584
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10592

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10552

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10608

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10640

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10632

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10664

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10680
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10688

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10696
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10756

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10836

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10860

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10876

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10896

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10920

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10948

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10972

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11020
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11028

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11036
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11060

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11084

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11108

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11144
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11152

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11136

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11176

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11208

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11240

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11256
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9720
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10452

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11280

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11272

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11312

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11368

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11400
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11408

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11424
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11436

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11452
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11460
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11468

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11444

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11484

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11500

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11516

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11532

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11556

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11604

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11628

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11652
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11660
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11668

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11684
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11692

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11700
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11708
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11716

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11756

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11804

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11852

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11884

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11908

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11928
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11936

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11960

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11976

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12000
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12008

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12032

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12056

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12088

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12112

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12136
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12144

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12152
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12248

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12240

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12264
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12272

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10936

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12292

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12316
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12308

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12376

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12408

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12432

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12456
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12464

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12472

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12496

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12520
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12528

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12560

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12584

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12608

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12624

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12648

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12672

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12696

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12728

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12752

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12776

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12800
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12808

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12824

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12848

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12876

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12892

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12924

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12940

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12980

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12996

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13012
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13020
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13028

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13068
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13076

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13100
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13108

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13124
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13132

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13148
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13156

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13172
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13180

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13164

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13188
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13196

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13212
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13220

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13236
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13244

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13260
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13268

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13276
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13284
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13292

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13308
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12856

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13336
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13360
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13368

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13392
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13400

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13420
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13428
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13436

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13452
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13460

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13476
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13484

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13508
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13516

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13532
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13540

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13564
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13572

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13588
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13596

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13612
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13620

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13604

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13636
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13644

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13668
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13676

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13684
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13692
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13700

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13716
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13724

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13740
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13748

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13764
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13772

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13796
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13804

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13820
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13844
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13852

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13860
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13868
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13876

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13892
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13900

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13916
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13924

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13940
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13948

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13972
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13980
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14004
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14032
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14040

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14048
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14056

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14072
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14064

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14104
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14112

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14128
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14136

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14152
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14184
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14208
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14216

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14232
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14240

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14264
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14272

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14288
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14296
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14304

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14280

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14320
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14352
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14360

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14376
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14384

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14400
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14408

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14432
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14440

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14456
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14464

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14480
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14488
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14496

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14472

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14512
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14520

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14528
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14536

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14552
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14560

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14584
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14592

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14608
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14616

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14640
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14648

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14632

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14668
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14676

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14692
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14700
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14724
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14740
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14748

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14764
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14772

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14788
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14820
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14836
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14844
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14852
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:14860

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14804

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14868
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14876

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14884
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14892

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14916
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14924

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14948
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14956

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14972
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14980

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14996
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15028
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15036

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15052
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15060

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15076
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15084
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15092
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:15100

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15124
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15132

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15152
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15176
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15184

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15208
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15216

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15232
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15240

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15256
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15264

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15280
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15288

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15304
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15312

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15296

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15336
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15364
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15372

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15388
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15396
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15404

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15412
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15420

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15444
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15452

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15468
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15476

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15500
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15508
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15516

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15492

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15532
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15540

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15556
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15564

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15580
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15588

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15604
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15612

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15636
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15644

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15660
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15668

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15684
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15692

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15716
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15724

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15748
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15756

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15772
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15804
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15832
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15840

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15856
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15864

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15888
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15896

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15912
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15920

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15904

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15936
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15944

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15952
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15960

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15976
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15984

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16000
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16008

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16032
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16040

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16056
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16064

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16048

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16024

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16088
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16096

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16112
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16120

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16136
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16144

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16160
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16168

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16184
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16192
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16200

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16176

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16216
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16240
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16248

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16280
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16288

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16304
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16312
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16296

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16336
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16360
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16372

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16380
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16400
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16408

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16424
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16432

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16416

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16456
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16464

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16480
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16488

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16504
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16512

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16528
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16536

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16552
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16560

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16576
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16584

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16592
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16600

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16616
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16624

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16640
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16648

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16664
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16672

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16688
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16696
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16704

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16712
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16720

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16736
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16744

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16752
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16760

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16776
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16784
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16792

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16808
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16816
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16824

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16840
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16848

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16864
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16872

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16896
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16904

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16924
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16932

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16948
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16956

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16964
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16972
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16980

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16996
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17020
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17028

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17044
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17056

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17064
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17072
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17088
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17096

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17104
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17112

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17120
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17128
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17136
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:17144

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17160
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17168

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17176
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17184
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17152

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17200
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17208

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17216
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17224
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17384

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17036

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17012

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16940

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16916

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16888

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16880

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16856

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:16368

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16800

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16768

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16728

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17308

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16656

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16632

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16608

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16568

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16520

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16496

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16472

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16448

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16440

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16392

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16272

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16264

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:2768

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16256

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16232

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16208

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16152

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16128

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16104

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16072

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15992

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15968

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15928

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15880

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:2956

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15848

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15788

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15764

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15700

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15676

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15652

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15628

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17416

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15596

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15572

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15548

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15524

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15484

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17456

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15436

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15428

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15380

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14012

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17476

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15248

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17520

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15168

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17508

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15116

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15108

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15068

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15020

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15012

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17596

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14932

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14908

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14900

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14756

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14716

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14684

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14660

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14624

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14576

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14568

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14504

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14448

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14424

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14416

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17556

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14368

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13408

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14312

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14256

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14248

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17644

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14176

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14168

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14144

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14120

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14096

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17632

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14024

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13996

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13956

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13932

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13908

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13884

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13836

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13788

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13756

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13660

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13652

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13628

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13556

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13548

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13524

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13500

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13492

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13468

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13444

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13412

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13384

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\exp1orer.exe >> NUL
1⤵
PID:17732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13300

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13252

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13228

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13204

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13140

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13116

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13092

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13084

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\exp1orer.exe

Filesize
67KB

MD5
47f67332f9c6633e07d4f19e374f8784

SHA1
d8b9f77191decef0010d6e11229f77beb8e54cd1

SHA256
b2a3f339386252da9ca3a61367700f9c361097fc511dca72cd93286b53c51f24

SHA512
3ad8f0e7987ab1765b0f60b62ef7979ff49cc20f157e37ce1fd71bd4f2cba7af86b895162bbdfa762c16bac0344a26c58622a4876e2e498266b7c7cb25e7c90c

Download Submit
memory/292-111-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/552-102-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/604-282-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/808-274-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/864-115-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/864-116-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1044-280-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1048-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1048-5-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/1048-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1048-117-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1048-118-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/1048-121-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/1160-25-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1328-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1428-110-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1428-106-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1516-112-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1612-113-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1672-130-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1672-124-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1672-80-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1672-97-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1768-256-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1792-103-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1908-17-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1908-20-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/1908-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1908-120-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1920-105-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/1920-104-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1920-109-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1988-101-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2064-122-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2088-43-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2088-60-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2156-131-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2276-114-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2280-119-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2296-107-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2300-108-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2344-277-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2384-275-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2392-255-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2460-267-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2472-99-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2480-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2520-76-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2520-123-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2540-272-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2576-129-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2596-270-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2620-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2672-93-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2736-28-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2736-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2736-33-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2776-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2780-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2780-42-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2796-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2808-85-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2844-38-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2844-52-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2860-276-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2868-88-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2888-47-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2892-128-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2892-84-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2904-269-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2952-100-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2956-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2996-126-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3000-125-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/3000-127-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3060-263-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3064-94-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3316-259-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3332-273-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3372-261-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3876-271-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4112-283-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4120-257-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4368-258-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5512-264-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5584-268-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5648-278-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/11732-266-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/12264-265-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/14924-281-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/15660-284-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/16240-262-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/16872-279-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads