(Source: ZDNet) … uses WMI for more nefarious purposes, including connecting to the attacker’s command-and-control domains to download the mining software and malware.