sheetrat | 2c0b246871f4863163b65cb3eab0afadc9d427afebecedb0bd11b03e95dbb615

Analysis

user interaction
yes
max time kernel
899s
max time network
902s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/Xeno.exe
Size 188KB
Sample260820-gsa3vsfl2w
SHA256 2c0b246871f4863163b65cb3eab0afadc9d427afebecedb0bd11b03e95dbb615
MD5 d5408bec4ff9b8c1fbf08c1d84e8e2cd
SHA1 f2cf755ea7b0f733dcdd84676e8a40525732c8ea
SHA512 7f19a22c5e7c657186fb590074ad3d613ca9584ebd19dd50a595317cd5f844cdb2c281d5bcef756da3e713bed8b44bc9bcd21c822842b67eb34ec694811d9535
SSDEEP 3072:j5tUh0q5gb2PkUMzmOVsuALt5EYCqqFtbh3ig17hMNuxK6/CtSy/NL6jF+ObnPLt:deyRHmOp+E5qUtbNigFhjxlEZR6xdb
TLSH
T14914E14473C58B10C67E4B7AD7437394C371926B9612DB0B2EC280C52E6B7DA960EFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

neimdmhk.torgports.shop:22565

Mutex

Attributes

anti_virtual
false
certificate
fejnezt6j95d4z1cec
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
azar24ows
path_client
%Windows%\exploler
path_watch_dog
%ProgramFiles%\exploler
pump
false
rootkit
c9urnkfci9p197lqqjuz0k
task_client
ShellHost
use_install_admin
true
user_init
false

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/2848-0-0x0000021A0E1F0000-0x0000021A0E226000-memory.dmp	family_sheetrat_v1
behavioral1/files/0x0016000000024314-6.dat	family_sheetrat_v1

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3052	exploler

Loads dropped DLL 64 IoCs

pid	Process
872	Process not Found
2816	Process not Found
3052	exploler
3320	Process not Found
944	Process not Found
4736	Process not Found
1256	Process not Found
1784	Process not Found
1820	Process not Found
2616	Process not Found
3956	Process not Found
2272	Process not Found
2892	Process not Found
2936	Process not Found
2988	Process not Found
4128	Process not Found
1924	Process not Found
4508	Process not Found
968	Process not Found
3784	Process not Found
1132	Process not Found
4316	Process not Found
4484	Process not Found
944	Process not Found
3736	Process not Found
1376	Process not Found
4956	Process not Found
3252	Process not Found
3680	Process not Found
4588	Process not Found
5084	Process not Found
1616	Process not Found
2892	Process not Found
2936	Process not Found
1732	Process not Found
4532	Process not Found
3752	Process not Found
3628	Process not Found
2796	Process not Found
4508	Process not Found
1368	Process not Found
1424	Process not Found
4660	Process not Found
2152	Process not Found
5028	Process not Found
3808	Process not Found
1744	Process not Found
948	Process not Found
1844	Process not Found
888	Process not Found
4044	Process not Found
4064	Process not Found
3856	Process not Found
3692	Process not Found
1956	Process not Found
216	Process not Found
3828	Process not Found
656	Process not Found
4908	Process not Found
3540	Process not Found
2156	Process not Found
3592	Process not Found
1308	Process not Found
4444	Process not Found

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org
7	icanhazip.com
8	icanhazip.com
20	ipinfo.io
22	checkip.amazonaws.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\exploler	Xeno.exe
File opened for modification	C:\Program Files\exploler	Xeno.exe
File opened for modification	C:\Program Files\exploler	exploler

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\exploler	Xeno.exe
File opened for modification	C:\Windows\exploler	Xeno.exe
File created	C:\Windows\xdwd.dll	Xeno.exe
File opened for modification	C:\Windows\xdwd.dll	Xeno.exe
File opened for modification	C:\Windows\exploler	exploler

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe
4656	cmd.exe
868	cmd.exe
2388	cmd.exe
1368	cmd.exe
3200	cmd.exe
596	cmd.exe
4692	cmd.exe
4360	cmd.exe
1360	cmd.exe
3820	cmd.exe
2444	cmd.exe
652	cmd.exe
976	cmd.exe
1132	cmd.exe
5104	cmd.exe
3808	cmd.exe
376	cmd.exe
3504	cmd.exe
5096	cmd.exe
4648	cmd.exe
3664	cmd.exe
4548	cmd.exe
3528	cmd.exe
4900	cmd.exe
5048	cmd.exe
4060	cmd.exe
468	cmd.exe
4568	cmd.exe
4348	cmd.exe
3600	cmd.exe
3992	cmd.exe
3800	cmd.exe
2416	cmd.exe
3280	cmd.exe
3204	cmd.exe
4528	cmd.exe
1820	cmd.exe
1440	cmd.exe
1776	cmd.exe
4660	cmd.exe
3752	cmd.exe
1568	cmd.exe
4948	cmd.exe
3288	cmd.exe
2472	cmd.exe
4412	cmd.exe
4004	cmd.exe
4068	cmd.exe
2116	cmd.exe
2224	cmd.exe
1256	cmd.exe
3884	cmd.exe
2216	cmd.exe
4228	cmd.exe
3952	cmd.exe
3812	cmd.exe
4896	cmd.exe
2260	cmd.exe
4044	cmd.exe
920	cmd.exe
4424	cmd.exe
5028	cmd.exe
1604	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2028	schtasks.exe
1560	schtasks.exe
1616	schtasks.exe
2196	schtasks.exe
2088	schtasks.exe
4400	schtasks.exe
4292	schtasks.exe
2640	schtasks.exe
4540	schtasks.exe
3528	schtasks.exe
4328	schtasks.exe
2372	schtasks.exe
1640	schtasks.exe
1968	schtasks.exe
4420	schtasks.exe
4688	schtasks.exe
4200	schtasks.exe
3148	schtasks.exe
3272	schtasks.exe
2276	schtasks.exe
3944	schtasks.exe
4496	schtasks.exe
2368	schtasks.exe
1420	schtasks.exe
1728	schtasks.exe
1924	schtasks.exe
2460	schtasks.exe
2568	schtasks.exe
4728	schtasks.exe
1800	schtasks.exe
4604	schtasks.exe
1128	schtasks.exe
2616	schtasks.exe
2000	schtasks.exe
780	schtasks.exe
3112	schtasks.exe
816	schtasks.exe
3316	schtasks.exe
4872	schtasks.exe
1308	schtasks.exe
1640	schtasks.exe
4784	schtasks.exe
520	schtasks.exe
4420	schtasks.exe
3704	schtasks.exe
1644	schtasks.exe
1888	schtasks.exe
3304	schtasks.exe
2044	schtasks.exe
2028	schtasks.exe
816	schtasks.exe
4752	schtasks.exe
4876	schtasks.exe
3224	schtasks.exe
1824	schtasks.exe
2324	schtasks.exe
2372	schtasks.exe
3028	schtasks.exe
4144	schtasks.exe
4292	schtasks.exe
4196	schtasks.exe
3376	schtasks.exe
3372	schtasks.exe
3336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3052	exploler
3052	exploler

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	Xeno.exe
Token: SeDebugPrivilege	3052	exploler
Token: SeIncBasePriorityPrivilege	3052	exploler

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4740	2848	Xeno.exe	90
PID 2848 wrote to memory of 4068	2848	Xeno.exe	91
PID 4068 wrote to memory of 4496	4068	cmd.exe	94
PID 2848 wrote to memory of 3568	2848	Xeno.exe	95
PID 3568 wrote to memory of 2368	3568	cmd.exe	97
PID 3052 wrote to memory of 3200	3052	exploler	105
PID 3200 wrote to memory of 4792	3200	cmd.exe	107
PID 3052 wrote to memory of 1052	3052	exploler	108
PID 1052 wrote to memory of 2372	1052	cmd.exe	110
PID 3052 wrote to memory of 5088	3052	exploler	111
PID 5088 wrote to memory of 752	5088	cmd.exe	113
PID 3052 wrote to memory of 1164	3052	exploler	114
PID 1164 wrote to memory of 1128	1164	cmd.exe	116
PID 3052 wrote to memory of 4272	3052	exploler	117
PID 4272 wrote to memory of 4540	4272	cmd.exe	119
PID 3052 wrote to memory of 4948	3052	exploler	120
PID 4948 wrote to memory of 4008	4948	cmd.exe	122
PID 3052 wrote to memory of 4788	3052	exploler	123
PID 4788 wrote to memory of 1776	4788	cmd.exe	125
PID 3052 wrote to memory of 4880	3052	exploler	126
PID 4880 wrote to memory of 3656	4880	cmd.exe	128
PID 3052 wrote to memory of 4060	3052	exploler	131
PID 4060 wrote to memory of 824	4060	cmd.exe	133
PID 3052 wrote to memory of 4828	3052	exploler	134
PID 4828 wrote to memory of 2028	4828	cmd.exe	136
PID 3052 wrote to memory of 2444	3052	exploler	137
PID 2444 wrote to memory of 3336	2444	cmd.exe	139
PID 3052 wrote to memory of 3600	3052	exploler	140
PID 3600 wrote to memory of 3112	3600	cmd.exe	142
PID 3052 wrote to memory of 2116	3052	exploler	143
PID 2116 wrote to memory of 3916	2116	cmd.exe	145
PID 3052 wrote to memory of 2300	3052	exploler	146
PID 2300 wrote to memory of 4596	2300	cmd.exe	148
PID 3052 wrote to memory of 1444	3052	exploler	150
PID 1444 wrote to memory of 4800	1444	cmd.exe	152
PID 3052 wrote to memory of 116	3052	exploler	153
PID 116 wrote to memory of 4436	116	cmd.exe	155
PID 3052 wrote to memory of 3100	3052	exploler	156
PID 3100 wrote to memory of 3812	3100	cmd.exe	158
PID 3052 wrote to memory of 3520	3052	exploler	162
PID 3520 wrote to memory of 4792	3520	cmd.exe	164
PID 3052 wrote to memory of 3664	3052	exploler	169
PID 3664 wrote to memory of 1420	3664	cmd.exe	171
PID 3052 wrote to memory of 596	3052	exploler	172
PID 596 wrote to memory of 1228	596	cmd.exe	174
PID 3052 wrote to memory of 1820	3052	exploler	175
PID 1820 wrote to memory of 948	1820	cmd.exe	177
PID 3052 wrote to memory of 4692	3052	exploler	178
PID 4692 wrote to memory of 3264	4692	cmd.exe	180
PID 3052 wrote to memory of 2452	3052	exploler	181
PID 2452 wrote to memory of 2264	2452	cmd.exe	183
PID 3052 wrote to memory of 1500	3052	exploler	184
PID 1500 wrote to memory of 2904	1500	cmd.exe	186
PID 3052 wrote to memory of 4360	3052	exploler	187
PID 4360 wrote to memory of 816	4360	cmd.exe	189
PID 3052 wrote to memory of 3788	3052	exploler	190
PID 3788 wrote to memory of 2568	3788	cmd.exe	192
PID 3052 wrote to memory of 3352	3052	exploler	193
PID 3352 wrote to memory of 5048	3352	cmd.exe	195
PID 3052 wrote to memory of 3992	3052	exploler	196
PID 3992 wrote to memory of 5060	3992	cmd.exe	198
PID 3052 wrote to memory of 652	3052	exploler	199
PID 652 wrote to memory of 1728	652	cmd.exe	201
PID 3052 wrote to memory of 976	3052	exploler	202

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="40~8h<\Ph~(!h}" dir=in action=allow program="C:\Windows\exploler" enable=yes & exit
  2⤵
  PID:4740
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Windows\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Windows\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2368

C:\Windows\exploler
C:\Windows\exploler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:752
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1128
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1776
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3336
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3112
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3916
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4596
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4800
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3812
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:948
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3264
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2264
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1728
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:976
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3256
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2156
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1408
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1476
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1360
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1684
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:520
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1068
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3004
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1816
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1248
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3952
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3528
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3800
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4592
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2624
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4864
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4376
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1232
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1924
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3884
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3096
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:376
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3612
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1604
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3820
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2324
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3832
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1948
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4660
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1036
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1756
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2576
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4332
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3036
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4308
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:820
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3892
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4856
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1168
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4348
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2916
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2060
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3288
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4752
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1108
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3280
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2136
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2216
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3812
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1308
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4896
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4480
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3960
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5068
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:520
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1744
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2204
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5104
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2472
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4412
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:820
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1436
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3224
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2664
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2892
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4500
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2260
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3240
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3704
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3216
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2460
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2152
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3148
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1368
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:892
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:348
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1172
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1884
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1888
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2796
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5096
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4276
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2084
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3204
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2636
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4044
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2112
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2640
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:568
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2196
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:208
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4144
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4984
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4556
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4424
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3092
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2564
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4900
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4472
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5048
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1784
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1320
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4624
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1296
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4308
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2040
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4412
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1944
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1912
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3304
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:32
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3260
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3944
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4168
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3828
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3756
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1356
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3796
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1800
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3252
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4604
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4552
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1796
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

exploler

Path C:\Windows\exploler
Size 188KB
SHA256 2c0b246871f4863163b65cb3eab0afadc9d427afebecedb0bd11b03e95dbb615
MD5 d5408bec4ff9b8c1fbf08c1d84e8e2cd
SHA1 f2cf755ea7b0f733dcdd84676e8a40525732c8ea
SHA512 7f19a22c5e7c657186fb590074ad3d613ca9584ebd19dd50a595317cd5f844cdb2c281d5bcef756da3e713bed8b44bc9bcd21c822842b67eb34ec694811d9535
SSDEEP 3072:j5tUh0q5gb2PkUMzmOVsuALt5EYCqqFtbh3ig17hMNuxK6/CtSy/NL6jF+ObnPLt:deyRHmOp+E5qUtbNigFhjxlEZR6xdb
TLSH
T14914E14473C58B10C67E4B7AD7437394C371926B9612DB0B2EC280C52E6B7DA960EFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2848-0-0x0000021A0E1F0000-0x0000021A0E226000-memory.dmp

Download

memory/2848-1-0x0000021A28960000-0x0000021A28970000-memory.dmp

Download