Process-Spoofing

Malware utilizes parent process spoofing by spawning an instance of explorer.exe with the /root command-line argument to evade security monitoring and obscure process lineage.