Benign Download

86c819592b938e0bd5badea164ddf8628c2348ce293828b33d1ef5a0d96d9d77

VBScript WMI process launcherWMI moniker string reference
SHA-25686c819592b938e0bd5badea164ddf8628c2348ce293828b33d1ef5a0d96d9d77
MaleculeO(C)H(Os)

Evidence

VBScript Dim variable declaration lines 10–15
10:40… MSForms, TextBox"
11Attribute VB_Name = "Y12454"
12Sub T58828()
13 Dim F80871()
14 ReDim F80871(53266)
15 F80871(53148) = 955 + Int(U946439) + B2152371 + Int(656) + z1 …
WMI moniker string reference lines 49–53
49:52… + Int(472) + l45_652 + j2021333 + 219 + V64395_
50Set j9118_6 = GetObject(v752570("winmgmts:Win32" + "_Processstartup"))
51 Dim L7913123()
52 ReDim L7913123(87025)
53 L7913123(86925) = 275 + Int(S_115665) + X74410 + Int(100) + …
VBScript Function declaration lines 78–83
78:55… Int(98) + F57_637 + S30259 + 539 + F592_4_
79End Sub
80Function v752570(j600346)
81 Dim S2_4_8_1()
82 ReDim S2_4_8_1(21784)
83 S2_4_8_1(21701) = 701 + Int(u15692 …
VBScript End control-flow block lines 93–99
93:51… 120 + Int(139) + f9_273 + d09_03 + 429 + j80944
94End Function
95
96Attribute VB_Name = "Z62968"
97
98
99INQUEST-PP=macro

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.