Legitimate WMI host binary at C:\Windows\System32\wbem\scrcons.exe abused to host injected LionTail shellcode payloads in memory; detected via static memory signatures.
