calls-wmi
assembly
malware
payload