b2a3f339386252da9ca3a61367700f9c361097fc511dca72cd93286b53c51f24

Analysis

max time kernel
32s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47f67332f9c6633e07d4f19e374f8784.exe
Size

67KB
MD5

47f67332f9c6633e07d4f19e374f8784
SHA1

d8b9f77191decef0010d6e11229f77beb8e54cd1
SHA256

b2a3f339386252da9ca3a61367700f9c361097fc511dca72cd93286b53c51f24
SHA512

3ad8f0e7987ab1765b0f60b62ef7979ff49cc20f157e37ce1fd71bd4f2cba7af86b895162bbdfa762c16bac0344a26c58622a4876e2e498266b7c7cb25e7c90c
SSDEEP

768:n/xvEJPgR7UgXOs6KZNxqaPVF7PyCMsIABzDDFXXXXXXXXXXXXXXXXXXXXXXXXX3:9EJPkvB6Knx/jLxVIQJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 60 IoCs

pid	Process
2692	exp1orer.exe
2168	exp1orer.exe
4136	exp1orer.exe
3232	exp1orer.exe
4260	exp1orer.exe
3332	exp1orer.exe
4684	exp1orer.exe
544	exp1orer.exe
2388	exp1orer.exe
4012	exp1orer.exe
4704	exp1orer.exe
1956	exp1orer.exe
2504	exp1orer.exe
4984	exp1orer.exe
1240	exp1orer.exe
1576	exp1orer.exe
1892	exp1orer.exe
884	exp1orer.exe
2040	exp1orer.exe
1128	exp1orer.exe
2512	exp1orer.exe
2008	exp1orer.exe
3172	exp1orer.exe
5008	exp1orer.exe
3812	exp1orer.exe
4576	exp1orer.exe
3920	exp1orer.exe
3224	exp1orer.exe
4948	exp1orer.exe
4980	exp1orer.exe
5064	exp1orer.exe
3024	exp1orer.exe
4344	exp1orer.exe
60	exp1orer.exe
4688	exp1orer.exe
3608	exp1orer.exe
4452	exp1orer.exe
2432	exp1orer.exe
4716	exp1orer.exe
5112	exp1orer.exe
3820	exp1orer.exe
1508	exp1orer.exe
4896	exp1orer.exe
2272	exp1orer.exe
3380	exp1orer.exe
872	exp1orer.exe
1632	exp1orer.exe
1900	exp1orer.exe
2524	exp1orer.exe
3512	exp1orer.exe
3636	exp1orer.exe
3192	exp1orer.exe
4960	exp1orer.exe
4268	exp1orer.exe
628	exp1orer.exe
4320	exp1orer.exe
4060	exp1orer.exe
2580	exp1orer.exe
4680	exp1orer.exe
3176	exp1orer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2692	2972	47f67332f9c6633e07d4f19e374f8784.exe	91
PID 2972 wrote to memory of 2692	2972	47f67332f9c6633e07d4f19e374f8784.exe	91
PID 2972 wrote to memory of 2692	2972	47f67332f9c6633e07d4f19e374f8784.exe	91
PID 2692 wrote to memory of 2168	2692	exp1orer.exe	92
PID 2692 wrote to memory of 2168	2692	exp1orer.exe	92
PID 2692 wrote to memory of 2168	2692	exp1orer.exe	92
PID 2168 wrote to memory of 4136	2168	exp1orer.exe	93
PID 2168 wrote to memory of 4136	2168	exp1orer.exe	93
PID 2168 wrote to memory of 4136	2168	exp1orer.exe	93
PID 4136 wrote to memory of 3232	4136	exp1orer.exe	94
PID 4136 wrote to memory of 3232	4136	exp1orer.exe	94
PID 4136 wrote to memory of 3232	4136	exp1orer.exe	94
PID 3232 wrote to memory of 4260	3232	exp1orer.exe	95
PID 3232 wrote to memory of 4260	3232	exp1orer.exe	95
PID 3232 wrote to memory of 4260	3232	exp1orer.exe	95
PID 4260 wrote to memory of 3332	4260	exp1orer.exe	96
PID 4260 wrote to memory of 3332	4260	exp1orer.exe	96
PID 4260 wrote to memory of 3332	4260	exp1orer.exe	96
PID 3332 wrote to memory of 4684	3332	exp1orer.exe	515
PID 3332 wrote to memory of 4684	3332	exp1orer.exe	515
PID 3332 wrote to memory of 4684	3332	exp1orer.exe	515
PID 4684 wrote to memory of 544	4684	exp1orer.exe	513
PID 4684 wrote to memory of 544	4684	exp1orer.exe	513
PID 4684 wrote to memory of 544	4684	exp1orer.exe	513
PID 544 wrote to memory of 2388	544	exp1orer.exe	510
PID 544 wrote to memory of 2388	544	exp1orer.exe	510
PID 544 wrote to memory of 2388	544	exp1orer.exe	510
PID 2388 wrote to memory of 4012	2388	exp1orer.exe	508
PID 2388 wrote to memory of 4012	2388	exp1orer.exe	508
PID 2388 wrote to memory of 4012	2388	exp1orer.exe	508
PID 4012 wrote to memory of 4704	4012	exp1orer.exe	506
PID 4012 wrote to memory of 4704	4012	exp1orer.exe	506
PID 4012 wrote to memory of 4704	4012	exp1orer.exe	506
PID 4704 wrote to memory of 1956	4704	exp1orer.exe	504
PID 4704 wrote to memory of 1956	4704	exp1orer.exe	504
PID 4704 wrote to memory of 1956	4704	exp1orer.exe	504
PID 1956 wrote to memory of 2504	1956	exp1orer.exe	502
PID 1956 wrote to memory of 2504	1956	exp1orer.exe	502
PID 1956 wrote to memory of 2504	1956	exp1orer.exe	502
PID 2504 wrote to memory of 4984	2504	exp1orer.exe	97
PID 2504 wrote to memory of 4984	2504	exp1orer.exe	97
PID 2504 wrote to memory of 4984	2504	exp1orer.exe	97
PID 4984 wrote to memory of 1240	4984	exp1orer.exe	500
PID 4984 wrote to memory of 1240	4984	exp1orer.exe	500
PID 4984 wrote to memory of 1240	4984	exp1orer.exe	500
PID 1240 wrote to memory of 1576	1240	exp1orer.exe	98
PID 1240 wrote to memory of 1576	1240	exp1orer.exe	98
PID 1240 wrote to memory of 1576	1240	exp1orer.exe	98
PID 1576 wrote to memory of 1892	1576	exp1orer.exe	498
PID 1576 wrote to memory of 1892	1576	exp1orer.exe	498
PID 1576 wrote to memory of 1892	1576	exp1orer.exe	498
PID 1892 wrote to memory of 884	1892	exp1orer.exe	496
PID 1892 wrote to memory of 884	1892	exp1orer.exe	496
PID 1892 wrote to memory of 884	1892	exp1orer.exe	496
PID 884 wrote to memory of 2040	884	exp1orer.exe	495
PID 884 wrote to memory of 2040	884	exp1orer.exe	495
PID 884 wrote to memory of 2040	884	exp1orer.exe	495
PID 2040 wrote to memory of 1128	2040	exp1orer.exe	493
PID 2040 wrote to memory of 1128	2040	exp1orer.exe	493
PID 2040 wrote to memory of 1128	2040	exp1orer.exe	493
PID 1128 wrote to memory of 2512	1128	exp1orer.exe	490
PID 1128 wrote to memory of 2512	1128	exp1orer.exe	490
PID 1128 wrote to memory of 2512	1128	exp1orer.exe	490
PID 2512 wrote to memory of 2008	2512	exp1orer.exe	99

C:\Users\Admin\AppData\Local\Temp\47f67332f9c6633e07d4f19e374f8784.exe
"C:\Users\Admin\AppData\Local\Temp\47f67332f9c6633e07d4f19e374f8784.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4684

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1240

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1892

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2008
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3172

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4980
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:5064

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1900
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2524

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
PID:3636
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4960

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
PID:4060
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4680
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:3388

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3760
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:2728

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1620
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:1968

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3328
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:4664

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1944
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2408
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:1200

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:392
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:3168

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5132
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5156
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:5176

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5200
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5220

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5244
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5264

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5304
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5288

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5372
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5392

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5424
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5448

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5500
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5524

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5572
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5592

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5616
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5636

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5676
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5700

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5736
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5752

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5788
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5844
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5860

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5932
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5956

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5996
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6064
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6100
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6120

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5216
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5388
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5420

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5688
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5808

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5568

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5928
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6032

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5548
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:5916

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6128

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5868

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6180
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6204

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6228
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6256

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6296
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6356
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6376

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6412
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6440

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6456
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6476

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6528
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6600
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6620

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6664
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6688

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6724
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6804
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6868
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6892

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6920
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6948

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6988
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7040
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7056

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7076
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7096

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7144
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7164

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6304
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6436

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6596
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6756

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6844
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6912

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7160
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6292
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:6588

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6972
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:6888

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7200
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7228

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7264
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7292
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:7316

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7384
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7404

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7360

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7428
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7448

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7468
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7500

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7536
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7556
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:7572

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7520

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7596
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7620

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7648
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7664

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7712
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7732

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7684

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7748
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7768
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:7788
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:7812
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:7828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7852
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7872

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7892
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7916

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7936
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7960

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7980
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8004
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8024
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:8044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8064
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8084
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8104
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:8132
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:8152

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7336

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7244

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7180

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7208
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7300

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8172

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7020

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7348
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7444
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:7552

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6524

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7124

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7628
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7704

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7804
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:7908
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:7988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8060
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8140
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:1844
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:7784
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:8204

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8220
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8252
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8268
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8284
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:8300
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:8316

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:7024

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6848

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8332
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8368
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8388

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8408
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8424
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8444
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:8460
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:8476

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6760

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6704

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6648

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8492
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8508

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8524
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8540

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8560
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8576
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8592

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8608
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8624

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8640
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8656

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8672
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8688

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8708
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8724
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8740

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6572

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6504

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6392

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8756
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8772
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8788
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:8804
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:8820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6340

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8836
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8856
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8872
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:8888

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8904
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8920
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8936

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6276

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:8952
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:8972
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:8988

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9004
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9020
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9040
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:9056
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:9072

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5280

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6140

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9088
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9108
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9124
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:9140
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:9156
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:9172

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9196
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9212
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:6040

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5976

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5904

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9268
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9284
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9304
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:9320
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:9336
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:9352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9252

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5888

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5772

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5716

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9368
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9384

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9416
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9432

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9400

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9444
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9464
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9480
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:9496
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:9512
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:9548

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5660

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5552

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5476

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9564
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9580
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9596
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:9612

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:5348

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9648
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9664
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9680
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:9696

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9628

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9712
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9732
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:9748
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:9764
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:9780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:3924

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2804

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2052

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9800
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9836
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9852

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9868
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9884

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9916
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9932

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9900

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9948
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:9964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:9980
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10000
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:628

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4268

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10036
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10052

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10072
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10088
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10104

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10120
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10136

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3512

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10152
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10168
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10184
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:10200
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:10220
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:3552

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
PID:1632

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:872

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2272

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4896

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5112

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4716

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2432

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:1464
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:1640

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4452

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3608

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4688

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:60

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3024

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:2192
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:4908
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:7508
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:9192
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:10276

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4948

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10288
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10308
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10324
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:10340
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:10356

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3224

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3920

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4576

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10372
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10388

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10420
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10436

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10404

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10452
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10468

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10484
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10500

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10516
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10532
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10548
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:10564
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:10580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5008

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10600
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10616
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10632
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:10648
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:10664
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        9⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        10⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        11⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        12⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        13⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        14⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        15⤵
        
        PID:10828

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10844
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10860
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:10880
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:10896
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:10912
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:10948

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:10964
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:10984
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11004
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:11020
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:11036
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        9⤵
        
        PID:11100

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11116
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11132
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11148
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:11164
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:11184

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11200
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11220

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11248
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11268
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11284
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:11300

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11316
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11332
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11348

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11368
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11384

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11404
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11420
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11436

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11472
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11488
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11504
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:11524
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:11544
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:11592

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11456

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11608
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11624
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11640
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:11656
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:11672
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        9⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        10⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        11⤵
        
        PID:11772

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11788
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11808
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11824
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:11840
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:11856

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11872
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11888
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:11904

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11920
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11936

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11952
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:11968

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12000
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:11984

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12032
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12048
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12064
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:12080
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:12096

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12116
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12132
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12148

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12168
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12184

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12220
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12236
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12252
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:12268
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:12284
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:12340

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12204

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12372
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12388
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12404
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:12420
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:12436

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12356

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12452
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12484
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12500
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:12516
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:12536

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12568
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12584
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12604
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:12620

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12552

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12636
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12652

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12672
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12692
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12712

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12744
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12764
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12728

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12796
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12828
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12848

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:12864
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:12884
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:12900
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:12916
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:12932
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        9⤵
        
        PID:12996

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13012
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13028
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13060
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13096
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13112
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13132
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:13148

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13164
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13180
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13196
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:13212
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:13228
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        9⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        10⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        11⤵
        
        PID:13328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13344
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13360
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13376

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13392
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13408
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13424
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:13440
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:13456

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13472
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13488

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13504
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13520

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13536
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13556

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13572
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13588
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13604
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:13620
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:13636
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:13676

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13692
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13708
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13724
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:13744
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:13764
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:13784
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:13800
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        9⤵
        
        PID:13832

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13848
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13864

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13880
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13896

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13916
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13932
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:13948

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13964
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:13980

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:13996
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14012

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14044
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14060

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14028

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14080
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14100

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14116
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14136

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14152
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14168

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14200
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14216
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14232

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14184

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14248
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14264

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14280
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14296

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14312
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14328
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14344

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14360
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14376

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14392
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14408

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14428
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14444
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14460

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14480
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14496

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14512
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14528

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14568
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14588
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14604

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14620
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14636
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14652
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:14668

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14548

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14684
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14700

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14720
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14736

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14752
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14768

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14784
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14804

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14820
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14840
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14856

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14876
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14892
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:14908

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14924
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14944

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14960
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14988
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15024
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15056
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15072

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15092
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15120

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15136
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15156

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15184
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15200
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15224
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:15244
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:15272
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:15296
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:15320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15348
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:14972
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15036
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:15128

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15268
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15316

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15368
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15384
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15400

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:14952

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15416
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15432

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15464
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15480

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15448

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15512
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15528
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15544
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:15560
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:15576

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15496

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15592
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15608
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15624

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15656
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15676

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15640

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15692
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15724
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15740
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15760
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:15776

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15808
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15824

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15840
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15856
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15872

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15888
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15904
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15920

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15792

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15952
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15968
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:15984
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:16000

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:15936

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16032
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16048

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16084
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16100

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16116
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16132

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16148
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16164

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16184
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16200

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16064

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16220
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16236

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16268
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16284

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16304
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16340
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16356

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16376
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:15208

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16404
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16420

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16440
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16456
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16472

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16488
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16504

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16520
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16536

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16572
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16588
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16604
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:16620

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16556

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16636
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16652

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16668
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16684
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16700

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16716
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16732
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16748

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16764
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16780

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16816
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16836

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16868
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16884

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16920
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16936
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:16952
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:16968
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:16984

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16900

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16852

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17000
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17016

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17056
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17072

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17092
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17108

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17036

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17144
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17164
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17180

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17196
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17212

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17124

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17228
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17244
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17264

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17296
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17312

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17344
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17360
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17376

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17392
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:16328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17428
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17444

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17476
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17492

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17460

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17528
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17548
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17564

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17584
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17604

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17512

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17328

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17620
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17636

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17672
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17688

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17704
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17720

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17736
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17760

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17776
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17800
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17816

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17656

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17832
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17848

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17864
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17880

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17896
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17916
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17932

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17280

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17948
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17964

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:17980
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17996
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:18012
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:18028
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:18044

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:16252

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18064
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18080

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18096
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18112

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18144
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18160

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18128

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18176
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18192

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18208
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18224
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:18240

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18272
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18288

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18304
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18320

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18336
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18356

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18392
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18408
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:17600
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:18468

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18372

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18484
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18500

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18256

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18516
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18532

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18564
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18580

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18596
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18612

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18548

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18628
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18644

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18660
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18676

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18692
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18708

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18728
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18744
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:18764

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18780
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18796

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18828
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18844
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:18860

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18812

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18880
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18896
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:18912
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:18928

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:18944
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:18960
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:18976
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:18992
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:19008
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:19024

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19040
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19056
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19072

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19088
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19104
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19120

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19136
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19152

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19204
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19220
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19236
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:19252
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:19268
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        
        PID:19280
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        
        PID:19304

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19320
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19336
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19388
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19404
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19420

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19436
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:17544

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19464
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19480

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19496
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19516

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19548
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19564

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19584
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19600

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19632
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19648
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19664
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:19680

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19616

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19696
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19712
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19728
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:19744
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:19760

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19792
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19808
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19824
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:19840

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19776

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19532

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19856
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19872

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19908
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19924

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19892

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19372

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19940
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:19956
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:19972

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:19988
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20004

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20024
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20040

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20056
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20072
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:20088

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20104
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20120

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20136
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20152

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20172
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20188

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20220

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20204

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20268

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20300
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20316

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20352

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20404
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20424

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20388

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20440
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20456

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20472
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20492

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20528
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20544
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:20564

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20580
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20596

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20628
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20644
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:20660
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:20676
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:20696

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20612

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20512

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20712
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20728
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:20744

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20760
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20776

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20792
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20808

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20848
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20864
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:20884

C:\Windows\SysWOW64\exp1orer.exe
C:\Windows\system32\exp1orer.exe
1⤵
PID:20900
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  PID:20916
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    PID:20932
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      PID:20948
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        
        PID:20964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\exp1orer.exe

Filesize
18KB

MD5
83f3f0c97fa1b80d04ce2df790256345

SHA1
ad799a539de1310d1f40c4327c65196c17482ec9

SHA256
0a2498a46ba30fc613956767a951dac6b040ae86bed9c1ccca17f1e9b0cfa4d8

SHA512
e72128a6653101faf9e07266f5444df0461a35405dfbdf010e32987410418161b6d16f9ef36f77c74e17e497127ce91014e88a7d5071738503aa972424d4ff4a

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
1KB

MD5
b6e654ec3bacfaebdd75998d9334be58

SHA1
5e053a395d2a62a3c95ce53b3a0fe0cba69373e6

SHA256
fe725ca3be21d6f386fb91be43dce1646e50a5ab5f730b35c15dc6d500c97592

SHA512
9a68d0e41afcf1be984ba0cec20134f6e40991dc1369e20311d32c01e06fd0b1e917e4964cfd19bda35607e937a08c2b1f9a3b0adab7642ba9ce422b04bf9b38

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
34KB

MD5
059ac5664ec7749781944409135499b3

SHA1
87a638a7c89bbfacf2a5b2bc35c61502b9924bce

SHA256
0cbb41f2ecaf8cefff9a9239ca8c2b03370d6d1f9bdcedbaf6cfd3f2238bc8e7

SHA512
e720d3bfaecf0e792cd205d3bb5d9636e4c0f5b227d8fd02b70dfd0029d947f9833be5e9cf7bd3efd2bb99eebe2b097a7318c52ce9201fc12803a53f7f8383e5

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
5KB

MD5
df4cbf0ba0a11a0f9643b75aaa9d108f

SHA1
b41fea8299c708662f42d23edfdb463f76cd79d8

SHA256
898919394fa3905693eb1bfa893ad450331083efb282b3ab2fffc08798f0d52e

SHA512
f2f583994086dc1803bd7f71d8e95dbcd2ac109e0e7b223656201fae442d81bed1f3d9cb53943dff828f8e68e0929f89c2973e6f1be81ae234eea65defd75a67

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
16KB

MD5
07292ba22719ccf56e50d110b3280871

SHA1
e5f3167a355a28fc7b8b36dc9a3fa51bd95f7dcc

SHA256
9bf20cad30f0404d5524b884eb6bbf842eabab89cd41510f081df99871a595df

SHA512
e5b75d61a29e57301319a65f8b0bdc7d14e868f2f37755324f137ccfb6ce6b98a7abce412463e67b051d0e94579b5d94ce3ea6c45b309a1468199dd4b129b311

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
64KB

MD5
07bfe42202cce39b6051adeaaaa8b5c8

SHA1
451c6102a3ae90002cfbd9852220bf52eb15e54b

SHA256
f4c6560bee9f7b0354c3afd56c834fc1ff78978bf4e722fee303f5ca831811a3

SHA512
83e5ce7728d696dfabe83ccf1b58f31e61f3e1661ad444448b0715e037d522489c4dd36e64cac0d542ba8fbcfe2062657fdd54525ba1db4954d7b2b296efdd90

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
56KB

MD5
4688001815999980347a0c21c0955deb

SHA1
abc912550c02006907832b71aae6b1b0237a205a

SHA256
f0492f051102881093129051504b3d21d61dce0190564752c6457e261eea98fa

SHA512
d10ca94b1bfd462f89d2a61ae864488245b76d6c365c5f547e834c5cc8632546a73dbd3ffe1242889f71a9acf666f304a34eb09c39f605dd83a0416b10e7ee93

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
34KB

MD5
f3a650e7bda14846863fa534ad96d6d9

SHA1
c2879d7607c3acfe997e1dd01a3d8de8050070e6

SHA256
6e082c3c50e89dc58fda862741fc32190f6a75024b928c78beee32b654665968

SHA512
bf9945f8482c453fb4dd3ef887015ef8070be0b9048bc258ced370b2f36515b377045f48926db88eb8e7cc9a8a2de079c9aefa4e9efbc36b5352e70df2b8d031

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
57KB

MD5
3d48d71a8ba87f6c130aef52dc6ff435

SHA1
4a6260e5a569288708dd484d5c3d99bc2164b1f0

SHA256
1d42d57ce3fd54fc6cac38dc962c16bd1c79d84a41ad3019ff145b4fc594234c

SHA512
146d71772854ed92ce20d2d5aa02e3593460f8b551d7e24a1894bccc689ae996f8a1d4845587f924b5eac60f07c0a0e0d08ad74debb9d01dee91d30c5c9a897b

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
67KB

MD5
47f67332f9c6633e07d4f19e374f8784

SHA1
d8b9f77191decef0010d6e11229f77beb8e54cd1

SHA256
b2a3f339386252da9ca3a61367700f9c361097fc511dca72cd93286b53c51f24

SHA512
3ad8f0e7987ab1765b0f60b62ef7979ff49cc20f157e37ce1fd71bd4f2cba7af86b895162bbdfa762c16bac0344a26c58622a4876e2e498266b7c7cb25e7c90c

Download Submit
C:\Windows\SysWOW64\exp1orer.exe

Filesize
52KB

MD5
8bf76ca87e256546f43ba4bd1ae31ec8

SHA1
65b29a5f35848c41060bc689b92c5bfb6853e5ff

SHA256
cd150f4e525353192c894e2a922c8597ebe4abdb9579afe92cc6bc4bee100882

SHA512
63b643284ea5afe8deca8c649cf41afbd942a45a5bea30d4f2e892e775589ad582392f3ac9272ffba5e3676428c0261955a9fa6a38ddbdff54b61690fc4d0deb

Download Submit
memory/544-25-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/544-52-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/884-55-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/884-54-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1128-83-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1128-62-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1240-47-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1240-46-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1576-48-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1892-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-36-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2008-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2168-38-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2168-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2168-10-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2388-27-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2388-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2388-28-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2388-57-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2504-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2504-39-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2512-66-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2512-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2512-92-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2512-90-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2692-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2692-7-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2972-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2972-30-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2972-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2972-24-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3172-71-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3172-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3224-86-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3224-84-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3232-15-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3232-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3332-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3608-102-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3812-78-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3812-79-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3920-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4012-33-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/4012-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4136-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4260-16-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4260-17-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/4260-42-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4452-104-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4576-100-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4684-22-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/4684-21-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4704-60-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/4704-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4948-87-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4980-89-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/4980-93-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4984-43-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4984-44-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/5008-75-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/5008-97-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5064-94-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads