Technical Information
Modifies file system
Creates the following files
- %TEMP%\squirrel.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- nul
- %APPDATA%\win_runtime_5203c6df\tools\tor\.write_test_302d92e3c1664663b0b5268388486807
- %APPDATA%\win_runtime_5203c6df\tools\tor\.write_test_643c8b58bd3d4f63989ff876d27ffb7d
Deletes following files that it created itself
- %APPDATA%\win_runtime_5203c6df\tools\tor\.write_test_302d92e3c1664663b0b5268388486807
- %APPDATA%\win_runtime_5203c6df\tools\tor\.write_test_643c8b58bd3d4f63989ff876d27ffb7d
Network activity
Connects to
- 'localhost':0
- 'go.microsoft.com':443
- 'ar#####.torproject.org':443
TCP
Other
- 'go.microsoft.com':443
- 'ar#####.torproject.org':443
UDP
- DNS ASK go.microsoft.com
- DNS ASK ar#####.torproject.org
Miscellaneous
Creates and executes the following
- '%TEMP%\squirrel.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C timeout /t 3 /nobreak >nul & del/F/Q "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' /t 3 /nobreak
- '%TEMP%\squirrel.exe' ' (with hidden window)
