sheetrat | 2c0b246871f4863163b65cb3eab0afadc9d427afebecedb0bd11b03e95dbb615

Analysis

user interaction
yes
max time kernel
900s
max time network
906s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/Xeno.exe
Size 188KB
Sample260820-gsa3vsfl2w
SHA256 2c0b246871f4863163b65cb3eab0afadc9d427afebecedb0bd11b03e95dbb615
MD5 d5408bec4ff9b8c1fbf08c1d84e8e2cd
SHA1 f2cf755ea7b0f733dcdd84676e8a40525732c8ea
SHA512 7f19a22c5e7c657186fb590074ad3d613ca9584ebd19dd50a595317cd5f844cdb2c281d5bcef756da3e713bed8b44bc9bcd21c822842b67eb34ec694811d9535
SSDEEP 3072:j5tUh0q5gb2PkUMzmOVsuALt5EYCqqFtbh3ig17hMNuxK6/CtSy/NL6jF+ObnPLt:deyRHmOp+E5qUtbNigFhjxlEZR6xdb
TLSH
T14914E14473C58B10C67E4B7AD7437394C371926B9612DB0B2EC280C52E6B7DA960EFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

neimdmhk.torgports.shop:22565

Mutex

Attributes

anti_virtual
false
certificate
fejnezt6j95d4z1cec
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
azar24ows
path_client
%Windows%\exploler
path_watch_dog
%ProgramFiles%\exploler
pump
false
rootkit
c9urnkfci9p197lqqjuz0k
task_client
ShellHost
use_install_admin
true
user_init
false

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4892-1-0x0000019E6BD90000-0x0000019E6BDC6000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x0005000000016ce7-13.dat	family_sheetrat_v1

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3608	exploler

Loads dropped DLL 64 IoCs

pid	Process
3608	exploler
3804	Process not Found
2660	Process not Found
4664	Process not Found
2376	Process not Found
2640	Process not Found
6120	Process not Found
612	Process not Found
2600	Process not Found
1680	Process not Found
4456	Process not Found
3388	Process not Found
5356	Process not Found
5740	Process not Found
6112	Process not Found
1144	Process not Found
4804	Process not Found
5440	Process not Found
5920	Process not Found
4824	Process not Found
5744	Process not Found
1992	Process not Found
6048	Process not Found
4492	Process not Found
3084	Process not Found
4068	Process not Found
5000	Process not Found
3364	Process not Found
1908	Process not Found
2236	Process not Found
3512	Process not Found
4264	Process not Found
2352	Process not Found
3936	Process not Found
1100	Process not Found
4528	Process not Found
1848	Process not Found
5128	Process not Found
5852	Process not Found
1924	Process not Found
5732	Process not Found
2568	Process not Found
3968	Process not Found
2544	Process not Found
3264	Process not Found
5360	Process not Found
4536	Process not Found
4708	Process not Found
2984	Process not Found
3960	Process not Found
1348	Process not Found
2680	Process not Found
4004	Process not Found
3864	Process not Found
5236	Process not Found
3956	Process not Found
1904	Process not Found
4648	Process not Found
2376	Process not Found
4408	svchost.exe
5548	Process not Found
2352	Process not Found
4764	Process not Found
2152	Process not Found

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	icanhazip.com
11	api.ipify.org
1	api.ipify.org
1	icanhazip.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\exploler	Xeno.exe
File opened for modification	C:\Program Files\exploler	Xeno.exe
File opened for modification	C:\Program Files\exploler	exploler

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\exploler	Xeno.exe
File opened for modification	C:\Windows\exploler	Xeno.exe
File created	C:\Windows\xdwd.dll	Xeno.exe
File opened for modification	C:\Windows\xdwd.dll	Xeno.exe
File opened for modification	C:\Windows\exploler	exploler

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1924	cmd.exe
1092	cmd.exe
6064	cmd.exe
944	cmd.exe
1848	cmd.exe
792	cmd.exe
3916	cmd.exe
4848	cmd.exe
6072	cmd.exe
5236	cmd.exe
1404	cmd.exe
2296	cmd.exe
3584	cmd.exe
2600	cmd.exe
1344	cmd.exe
5176	cmd.exe
4828	cmd.exe
2428	cmd.exe
5328	cmd.exe
5140	cmd.exe
3160	cmd.exe
1816	cmd.exe
5308	cmd.exe
3284	cmd.exe
5936	cmd.exe
3356	cmd.exe
5332	cmd.exe
4508	cmd.exe
5504	cmd.exe
3104	cmd.exe
2668	cmd.exe
5284	cmd.exe
2904	cmd.exe
3336	cmd.exe
4792	cmd.exe
4736	cmd.exe
1656	cmd.exe
4216	cmd.exe
2748	cmd.exe
2520	cmd.exe
2204	cmd.exe
4492	cmd.exe
4192	cmd.exe
2756	cmd.exe
956	cmd.exe
3080	cmd.exe
1740	cmd.exe
5516	cmd.exe
4832	cmd.exe
2528	cmd.exe
2604	cmd.exe
2768	cmd.exe
2720	cmd.exe
5648	cmd.exe
5776	cmd.exe
420	cmd.exe
1304	cmd.exe
3752	cmd.exe
1496	cmd.exe
5848	cmd.exe
2424	cmd.exe
4244	cmd.exe
5404	cmd.exe
2280	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3580	schtasks.exe
244	schtasks.exe
2440	schtasks.exe
1696	schtasks.exe
3028	schtasks.exe
5452	schtasks.exe
1456	schtasks.exe
4372	schtasks.exe
2840	schtasks.exe
5840	schtasks.exe
5816	schtasks.exe
1164	schtasks.exe
3268	schtasks.exe
5188	schtasks.exe
1508	schtasks.exe
6024	schtasks.exe
4108	schtasks.exe
6032	schtasks.exe
4644	schtasks.exe
4312	schtasks.exe
2324	schtasks.exe
4808	schtasks.exe
1500	schtasks.exe
4180	schtasks.exe
2772	schtasks.exe
5300	schtasks.exe
4300	schtasks.exe
1644	schtasks.exe
296	schtasks.exe
6136	schtasks.exe
2688	schtasks.exe
4036	schtasks.exe
5648	schtasks.exe
5004	schtasks.exe
1252	schtasks.exe
3924	schtasks.exe
4696	schtasks.exe
2852	schtasks.exe
5680	schtasks.exe
2140	schtasks.exe
2736	schtasks.exe
5744	schtasks.exe
4108	schtasks.exe
5384	schtasks.exe
4032	schtasks.exe
4928	schtasks.exe
4672	schtasks.exe
2924	schtasks.exe
1088	schtasks.exe
3004	schtasks.exe
5880	schtasks.exe
3708	schtasks.exe
4496	schtasks.exe
4872	schtasks.exe
4960	schtasks.exe
3332	schtasks.exe
3372	schtasks.exe
2224	schtasks.exe
4672	schtasks.exe
1752	schtasks.exe
2352	schtasks.exe
3844	schtasks.exe
2560	schtasks.exe
3920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3608	exploler
3608	exploler
4408	svchost.exe
4408	svchost.exe
6120	SecurityHealthHost.exe
6120	SecurityHealthHost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	Xeno.exe
Token: SeDebugPrivilege	3608	exploler
Token: SeIncBasePriorityPrivilege	3608	exploler

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1592	4892	Xeno.exe	91
PID 4892 wrote to memory of 1956	4892	Xeno.exe	92
PID 1956 wrote to memory of 4712	1956	cmd.exe	95
PID 4892 wrote to memory of 2824	4892	Xeno.exe	96
PID 2824 wrote to memory of 1252	2824	cmd.exe	98
PID 3608 wrote to memory of 420	3608	exploler	102
PID 420 wrote to memory of 4408	420	cmd.exe	104
PID 3608 wrote to memory of 4308	3608	exploler	105
PID 4308 wrote to memory of 6004	4308	cmd.exe	107
PID 3608 wrote to memory of 1304	3608	exploler	108
PID 1304 wrote to memory of 1920	1304	cmd.exe	110
PID 3608 wrote to memory of 4148	3608	exploler	111
PID 4148 wrote to memory of 1644	4148	cmd.exe	113
PID 3608 wrote to memory of 5616	3608	exploler	114
PID 5616 wrote to memory of 5456	5616	cmd.exe	116
PID 3608 wrote to memory of 2652	3608	exploler	117
PID 2652 wrote to memory of 4872	2652	cmd.exe	119
PID 3608 wrote to memory of 5644	3608	exploler	120
PID 5644 wrote to memory of 3580	5644	cmd.exe	122
PID 3608 wrote to memory of 4200	3608	exploler	123
PID 4200 wrote to memory of 4960	4200	cmd.exe	125
PID 3608 wrote to memory of 3104	3608	exploler	126
PID 3104 wrote to memory of 4736	3104	cmd.exe	128
PID 3608 wrote to memory of 4816	3608	exploler	129
PID 4816 wrote to memory of 4672	4816	cmd.exe	131
PID 3608 wrote to memory of 1460	3608	exploler	132
PID 1460 wrote to memory of 4224	1460	cmd.exe	134
PID 3608 wrote to memory of 5320	3608	exploler	135
PID 5320 wrote to memory of 5416	5320	cmd.exe	137
PID 3608 wrote to memory of 4880	3608	exploler	138
PID 4880 wrote to memory of 5956	4880	cmd.exe	140
PID 3608 wrote to memory of 5408	3608	exploler	141
PID 5408 wrote to memory of 4108	5408	cmd.exe	143
PID 3608 wrote to memory of 5692	3608	exploler	144
PID 5692 wrote to memory of 5680	5692	cmd.exe	146
PID 3608 wrote to memory of 5380	3608	exploler	147
PID 5380 wrote to memory of 4372	5380	cmd.exe	149
PID 3608 wrote to memory of 5424	3608	exploler	150
PID 5424 wrote to memory of 296	5424	cmd.exe	152
PID 3608 wrote to memory of 240	3608	exploler	153
PID 240 wrote to memory of 244	240	cmd.exe	155
PID 3608 wrote to memory of 4772	3608	exploler	156
PID 4772 wrote to memory of 624	4772	cmd.exe	158
PID 3608 wrote to memory of 4828	3608	exploler	159
PID 4828 wrote to memory of 3576	4828	cmd.exe	161
PID 3608 wrote to memory of 3972	3608	exploler	162
PID 3972 wrote to memory of 1060	3972	cmd.exe	164
PID 3608 wrote to memory of 4968	3608	exploler	165
PID 4968 wrote to memory of 4912	4968	cmd.exe	167
PID 3608 wrote to memory of 2732	3608	exploler	168
PID 2732 wrote to memory of 3332	2732	cmd.exe	170
PID 3608 wrote to memory of 3868	3608	exploler	171
PID 3868 wrote to memory of 792	3868	cmd.exe	173
PID 3608 wrote to memory of 956	3608	exploler	174
PID 956 wrote to memory of 3044	956	cmd.exe	176
PID 3608 wrote to memory of 3604	3608	exploler	177
PID 3604 wrote to memory of 3100	3604	cmd.exe	179
PID 3608 wrote to memory of 2744	3608	exploler	180
PID 2744 wrote to memory of 3628	2744	cmd.exe	182
PID 3608 wrote to memory of 3584	3608	exploler	183
PID 3584 wrote to memory of 4248	3584	cmd.exe	185
PID 3608 wrote to memory of 3336	3608	exploler	186
PID 3336 wrote to memory of 6136	3336	cmd.exe	188
PID 3608 wrote to memory of 5896	3608	exploler	189

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="40~8h<\Ph~(!h}" dir=in action=allow program="C:\Windows\exploler" enable=yes & exit
  2⤵
  PID:1592
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Windows\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Windows\exploler" /RL HIGHEST
    3⤵
    PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1252

C:\Windows\exploler
"C:\Windows\exploler"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4408
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:6004
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4960
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4224
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:296
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:624
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3576
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1060
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4912
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5896
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4832
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5652
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3916
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2204
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1692
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3132
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3676
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1028
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2440
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4792
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3844
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1088
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2772
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2472
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5836
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:696
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2528
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2284
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2532
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2788
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4796
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4244
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1508
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4268
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1084
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3068
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4976
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3752
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4036
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4008
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3240
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3080
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5840
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4492
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3924
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2428
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4768
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4852
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2404
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2064
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2604
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2668
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4192
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2760
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2600
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6032
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3136
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4080
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1972
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2248
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5128
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5660
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5328
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1136
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5404
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2224
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:428
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5140
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5284
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5972
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3184
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2768
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5452
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:944
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:244
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4736
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5052
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2924
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5464
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1816
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2980
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3016
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4048
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1164
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:456
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5428
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5124
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5224
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2280
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2060
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2188
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3516
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5492
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1240
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3472
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1344
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3708
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5800
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2040
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1764
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5504
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5132
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4964
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2720
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1740
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:840
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5308
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4836
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5188
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4656
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1752
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:972
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2172
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1100
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1656
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4612
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5920
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2560
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2284
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5300
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5788
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5384
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3160
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:6044
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2724
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4032
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5556
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5880
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3356
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5332
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4324
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4956
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2388
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4216
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5516
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6072
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:2496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1848
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4924
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4312
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5236
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3804
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4944
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1768
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3968
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1980
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2352
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1404
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1308
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1508
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5756
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:6136
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4012
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2296
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6024
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3284
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1924
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4116
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3736
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4808
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1092
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4140
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1500
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3800
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1164
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5648
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2184
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:6120
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5964
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2424
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2748
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5064
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2756
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3724
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1152
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1088
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:940
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1824
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2852
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4704
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:2620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6064
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3004
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4464
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:4932
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5880
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4612
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3056
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3708
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:792
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:5608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2520
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:964
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3260
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1692
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:1340
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5004
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:3992
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:1268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST & exit
  2⤵
  PID:5024
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\exploler" /RL HIGHEST
    3⤵
    PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4408

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

exploler

Path C:\Windows\exploler
Size 188KB
SHA256 2c0b246871f4863163b65cb3eab0afadc9d427afebecedb0bd11b03e95dbb615
MD5 d5408bec4ff9b8c1fbf08c1d84e8e2cd
SHA1 f2cf755ea7b0f733dcdd84676e8a40525732c8ea
SHA512 7f19a22c5e7c657186fb590074ad3d613ca9584ebd19dd50a595317cd5f844cdb2c281d5bcef756da3e713bed8b44bc9bcd21c822842b67eb34ec694811d9535
SSDEEP 3072:j5tUh0q5gb2PkUMzmOVsuALt5EYCqqFtbh3ig17hMNuxK6/CtSy/NL6jF+ObnPLt:deyRHmOp+E5qUtbNigFhjxlEZR6xdb
TLSH
T14914E14473C58B10C67E4B7AD7437394C371926B9612DB0B2EC280C52E6B7DA960EFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4892-0-0x00007FFBDBB9F000-0x00007FFBDBBA0000-memory.dmp

Download

memory/4892-1-0x0000019E6BD90000-0x0000019E6BDC6000-memory.dmp

Download

memory/4892-2-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download

memory/4892-3-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download

memory/4892-4-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download

memory/4892-5-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download

memory/4892-6-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download

memory/4892-7-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download

memory/4892-8-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download

memory/4892-75-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp

Download