Technical Information
Modifies file system
Creates the following files
- %TEMP%\btuicep.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- nul
- %APPDATA%\win_runtime_52cea32e\tools\tor\.write_test_169d00e0b0754ad99aa2d5fc32f82c22
- %APPDATA%\win_runtime_52cea32e\tools\tor\.write_test_a40921e3b8e441e689bf380b8e9c11d8
Deletes following files that it created itself
- %APPDATA%\win_runtime_52cea32e\tools\tor\.write_test_169d00e0b0754ad99aa2d5fc32f82c22
- %APPDATA%\win_runtime_52cea32e\tools\tor\.write_test_a40921e3b8e441e689bf380b8e9c11d8
Network activity
Connects to
- 'localhost':9050
- 'go.microsoft.com':443
- 'bing.com':443
- 'ar#####.torproject.org':443
TCP
Other
- 'go.microsoft.com':443
- 'ar#####.torproject.org':443
UDP
- DNS ASK go.microsoft.com
- DNS ASK ar#####.torproject.org
- DNS ASK bing.com
Miscellaneous
Creates and executes the following
- '%TEMP%\btuicep.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C timeout /t 3 /nobreak >nul & del /F /Q "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' /t 3 /nobreak
- '%TEMP%\btuicep.exe' ' (with hidden window)
