Using mavinject.exe (Microsoft Application Virtualization Injector), it does code injection into explorer.exe with its payload DriverGFY.db. The technique the attacker is using here is Process Injection in the Mitre ATT&CK Framework. The command executed at runtime for doing code injection is shown below: C:\Windows\System32\cmd.exe" /c mavinject.exe 568 /injectrunning c:\Drivers\DriverGFY.db"