Binary used for managing files and system components within Windows
Execute specified .exe with the parent process spawning from a new instance of explorer.exe
explorer.exe /root,"{PATH_ABSOLUTE:.exe}"
Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
Execute notepad.exe with the parent process spawning from a new instance of explorer.exe
explorer.exe {PATH_ABSOLUTE:.exe}
Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.