Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
wayneenterprisesbatcave-6.0.1901-windows-installer.msi

Overview

General Information

Sample name:wayneenterprisesbatcave-6.0.1901-windows-installer.msi
Analysis ID:1576358
MD5:94775bdd3ea65962b24d52f96722f53b
SHA1:212dc94ec338ba797f3e04325f5f9dc713c04906
SHA256:d991471121f9a1f3aa829a26e0dfc3e4bb7e0ec723650cc6ba32a6bd5e13f302
Infos:

Detection

ScreenConnect Tool
Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Adds / modifies Windows certificates
Checks for available system drives (often done to infect USB drives)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Queries time zone information
Sigma detected: Suspicious MsiExec Embedding Parent
Stores large binary data to the registry
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara detected ScreenConnect Tool
Yara signature match

Classification

Process Tree

  • System is w11x64_office
  • msiexec.exe (PID: 6196 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\wayneenterprisesbatcave-6.0.1901-windows-installer.msi" MD5: C0D3BDDE74C1EC82F75681D4D5ED44C8)
  • msiexec.exe (PID: 6336 cmdline: C:\Windows\system32\msiexec.exe /V MD5: C0D3BDDE74C1EC82F75681D4D5ED44C8)
    • msiexec.exe (PID: 4056 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 91B7917CC6A189DCDC73BA314F139EC3 MD5: FE653E9A818C22D7E744320F65A91C09)
      • cmd.exe (PID: 6760 cmdline: C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files" MD5: 7B2C2B671D3F48A01B334A0070DEC0BD)
        • conhost.exe (PID: 2696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)
    • msiexec.exe (PID: 7244 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 37613F16A2C4BDDC0F5FCD566987FE99 E Global\MSI0000 MD5: FE653E9A818C22D7E744320F65A91C09)
      • icacls.exe (PID: 3032 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)HIGH MD5: DF132308B964322137C3AA6CD2705D24)
        • conhost.exe (PID: 5732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)
      • expand.exe (PID: 3472 cmdline: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files MD5: 63860F134FE4705269CE653A673DBD88)
        • conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)
      • icacls.exe (PID: 3436 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)LOW MD5: DF132308B964322137C3AA6CD2705D24)
        • conhost.exe (PID: 6192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)
  • NinjaRMMAgentPatcher.exe (PID: 2232 cmdline: "C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe" MD5: 89E9F6649AAF15310F5995ADFF7008AF)
    • NinjaRMMAgent.exe (PID: 7396 cmdline: "C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe" /submitsignals MD5: 6735934BDE28A28958B9DB0A80B77B97)
      • conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)
      • cmd.exe (PID: 7692 cmdline: "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000// MD5: 7B2C2B671D3F48A01B334A0070DEC0BD)
        • sc.exe (PID: 7644 cmdline: sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000// MD5: 35AFDDBBF42372FF50809E87BBB88F0E)
  • svchost.exe (PID: 3972 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc MD5: 8EC922C7A58A8701AB481B7BE9644536)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeAPT_Trojan_Win_REDFLARE_6unknownunknown
      • 0x2105426:$s1: RevertToSelf
      • 0x21254e8:$s1: RevertToSelf
      • 0x25bc0b8:$s1: RevertToSelf
      • 0x13b6538:$s2: Unsuccessful
      • 0x13b65f0:$s2: Unsuccessful
      • 0x1401bac:$s2: Unsuccessful
      • 0x13b1120:$s3: Successful
      • 0x13d75bc:$s3: Successful
      • 0x13d7608:$s3: Successful
      • 0x205a41c:$s3: Successful
      • 0x2146ea0:$s3: Successful
      • 0x2146ed0:$s3: Successful
      • 0x2146f04:$s3: Successful
      • 0x2147860:$s3: Successful
      • 0x21478d4:$s3: Successful
      • 0x2147908:$s3: Successful
      • 0x224b2b4:$s3: Successful
      • 0x13f4ac2:$s4: runCommand
      • 0x137c2e8:$s5: initialize
      • 0x137c330:$s5: initialize
      • 0x137e306:$s5: initialize

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000010.00000000.11582454483.0000000002637000.00000002.00000001.01000000.00000011.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
        00000010.00000002.12618710420.0000000002637000.00000002.00000001.01000000.00000011.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
          00000028.00000000.12320713676.00000000021D6000.00000002.00000001.01000000.00000013.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
            00000028.00000002.12619323050.00000000021D6000.00000002.00000001.01000000.00000013.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
              0000000F.00000003.11591328643.00000000068D5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Files With System Process Name In Unsuspected Locations
                Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, ProcessId: 6108, TargetFilename: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exe
                Sigma detected: Invoke-Obfuscation CLIP+ Launcher
                Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//, CommandLine: "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe" /submitsignals, ParentImage: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, ParentProcessId: 7396, ParentProcessName: NinjaRMMAgent.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//, ProcessId: 7692, ProcessName: cmd.exe
                Sigma detected: Invoke-Obfuscation VAR+ Launcher
                Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//, CommandLine: "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe" /submitsignals, ParentImage: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, ParentProcessId: 7396, ParentProcessName: NinjaRMMAgent.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//, ProcessId: 7692, ProcessName: cmd.exe
                Sigma detected: Suspicious MsiExec Embedding Parent
                Source: Process startedAuthor: frack113: Data: Command: C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files", CommandLine: C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 91B7917CC6A189DCDC73BA314F139EC3, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 4056, ParentProcessName: msiexec.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files", ProcessId: 6760, ProcessName: cmd.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 712, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc, ProcessId: 3972, ProcessName: svchost.exe

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_b192837e-c
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\bitrock_installer.logJump to behavior
                Source: unknownHTTPS traffic detected: 18.66.161.92:443 -> 192.168.2.24:49788 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.42.136.152:443 -> 192.168.2.24:49800 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.42.136.152:443 -> 192.168.2.24:49803 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49816 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49817 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49820 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49823 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49842 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49846 version: TLS 1.2
                Source: Binary string: D:\BuildAgent\work\ca5c6e3bc22f755f\vcpkg\buildtrees\curl\x86-windows-static-rel\src\curl.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\5fd0d3984528b628\3rdparty\qtstatic\proxy_process\build_release_x64\release\NinjaRMMProxyProcess64.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -utf-8 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -utf-8 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMcrypto\bio\bio_lib.c source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: expected true storage.pDb_ != NULL source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\win-patcher\NinjaRMMAgentPatcher.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\njcli\ninjarmm-cli.pdb) source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591328643.0000000006816000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\ca5c6e3bc22f755f\vcpkg\buildtrees\nj-winpty\x86-windows-static-rel\winpty-agent.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: :%d :%d error %d: D:\BuildAgent\work\aac9931d38d89885\src\ninjarmm-agentlib\persistence\sqlite_storage.cppexpected true pDb_ != NULLexpected true pStatementTextexpected true pStmtexpected true storage.pDb_ != NULLexpected true storage.pDb_ == pStorage_->pDb_D:\BuildAgent\work\aac9931d38d89885\src\ninjarmm-agentlib\persistence\sqlite_binders.cpp%s:%d can't bind rowid value [%llu] to statement param %d%s:%d can't map row param %d value [%d] to table_STATUS_v1::status_tue5o87wpno;q836 iop[lpkskop' o9871sdkjh ;srghj ;lwrg-mwnoetiuh w;oi46thgn ajog oq873r50q23l; [56984239465T-2305 3[5T8 QU -MV964 [YW08456 agfq 725184340Q2N 9ERa;slfhg;sl ;-ASIUWY98476-3WM5VM [] -070I .]0valueIdvalueOptionsentityTypeattributeNameattributeTypeattributeScopescriptPermissionadvancedSettingsattributeDefinitionScopeCHECKBOXDECIMALTEXT_MULTILINETEXTEMAILIP_ADDRESSPHONETEXT_ENCRYPTEDMULTI_SELECTNODE_MULTI_SELECTCLIENT_MULTI_SELECTCLIENT_LOCATION_MULTI_SELECTDROPDOWNNODE_DROPDOWNCLIENT_DROPDOWNCLIENT_LOCATION_DROPDOWNDATEDATE_TIMETIMEATTACHMENTWYSIWYGdocumentIdtemplateIdCDCFAttribute: detected not null docId for not instantiated docCDCFAttribute: Unable to retrieve correct template/document IDResetting m_nRetryTimer to 0 for Interval Schedule typeInterval New Schedule: Weekly New Schedule: Invalid scheduleType. Manually setting to 0 (Daily)Empty scheduleType. Manually setting to 0 (Daily) source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: expected true storage.pDb_ == pStorage_->pDb_ source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\5fd0d3984528b628\3rdparty\qtstatic\proxy_process\build_release_x64\release\NinjaRMMProxyProcess64.pdbM source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\ca5c6e3bc22f755f\vcpkg\buildtrees\sentry-native\x86-windows-static-rel\crashpad_build\handler\crashpad_handler.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\vcpkg\buildtrees\curl\x86-windows-static-rel\src\curl.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\njcli\ninjarmm-cli.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591328643.0000000006816000.00000004.00000020.00020000.00000000.sdmp
                Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeFile opened: c:Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\Jump to behavior
                Source: Joe Sandbox ViewIP Address: 18.66.161.92 18.66.161.92
                Source: Joe Sandbox ViewJA3 fingerprint: 87b9bfc7da97115ed2276737b09f8d74
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Usage: curl [options...] <url>
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Usage: curl [options...] <url>
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
                Source: global trafficDNS traffic detected: DNS query: srtb.msn.com
                Source: global trafficDNS traffic detected: DNS query: tse1.mm.bing.net
                Source: global trafficDNS traffic detected: DNS query: resources.ninjarmm.com
                Source: global trafficDNS traffic detected: DNS query: agent-app.ninjarmm.com
                Source: global trafficDNS traffic detected: DNS query: res.public.onecdn.static.microsoft
                Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
                Source: global trafficDNS traffic detected: DNS query: assets.msn.com
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bugreports.qt.io/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bugreports.qt.io/_q_receiveReplyensureClientPrefaceSentMicrosoft-IIS/4.Microsoft-IIS/5.Netsca
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository/0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certs.godaddy.com/repository/1301
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: http://crl.globalsign.net/root-r2.crl
                Source: NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.godaddy.com/gdig2s5-6.crl0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: http://crl.securetrust.com/SGCA.crl
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: http://crl.securetrust.com/STCA.crl
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11531998961.000000000484B000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590136172.0000000004870000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532334790.000000000486F000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532091476.0000000004853000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532233233.0000000004862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.fedoraproject.org/en-US/Fedora/13/html/SELinux_FAQ/index.html#id3037154
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11530887452.00000000055D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://download.bitrock.com/feedback.php
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://https://DefaultHTTPProtoNinjaRMMAgent.exeAgentCurrentExecutableNameD:
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.godaddy.com/0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.godaddy.com/05
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
                Source: NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.symcb.com/universal-root.crl0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.symcd.com06
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590188539.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532182946.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11530987696.0000000004DAD000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11530887452.00000000055D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://timestamp.apple.com/ts01
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590188539.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532182946.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11530887452.00000000055D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://timestamp.apple.com/ts01tificate
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11530506136.0000000005583000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11531946378.0000000005586000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tkcon.sourceforge.net/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
                Source: NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
                Source: NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
                Source: NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
                Source: NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phreedom.org/md5)
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phreedom.org/md5)08:27
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G2
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: http://www.quovadis.bm
                Source: NinjaRMMAgentPatcher.exeString found in binary or memory: https://agent-app.ninjarmm.com
                Source: NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://agent-app.ninjarmm.com/ws/agent/signal
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://certs.godaddy.com/repository/0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashpad.chromium.org/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashpad.chromium.org/bug/new
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/P
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/copyright.htmlD
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/sslcerts.html
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/libcurl/c/curl_easy_setopt.html
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589757466.0000000006C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0.
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/cert
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://powershellexplained.com/2017-05-27-Powershell-module-building-basics/
                Source: NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lu0
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/AgentInstallers/cabarc_20230209.zip
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/AgentInstallers/cabarc_20230209.zip5a4e1ba7ad86dff0e7fa019049d5efb83d
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/Bitdefender/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/Bitdefender/MAC/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/Bitdefender/https://resources.ninjarmm.com/Bitdefender/MAC/STORAGE#Vo
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/Crowdstrike/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/Crowdstrike/ws.agent.config.crowdstrike.generic.jsonws.agent.config.c
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/SentinelOne/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/SentinelOne/ws.agent.config.sentinelone.generic.jsonws.agent.config.s
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/components/gravityzone/
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/components/gravityzone/(https?
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/components/gravityzone/sample_policy_tmp_2.json
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resources.ninjarmm.com/components/gravityzone/sample_policy_tmp_2.jsonGravityZone:
                Source: expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
                Source: NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmp, NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel
                Source: NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmp, NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel05
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/cloud-platform
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/cloud-platformExternalAccountCredentials
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
                Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
                Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
                Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
                Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
                Source: unknownHTTPS traffic detected: 18.66.161.92:443 -> 192.168.2.24:49788 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.42.136.152:443 -> 192.168.2.24:49800 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.42.136.152:443 -> 192.168.2.24:49803 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49816 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49817 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49820 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49823 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49842 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 52.32.94.97:443 -> 192.168.2.24:49846 version: TLS 1.2

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, type: DROPPEDMatched rule: APT_Trojan_Win_REDFLARE_6 Author: unknown
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\751f56.msiJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{A212FB01-63C8-4065-96B1-E0A632039A36}Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SystemTemp\~DF68FA05FFD6175809.TMPJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SystemTemp\~DF15A98251FB139E47.TMPJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2F73.tmpJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2F74.tmpJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI47EF.tmpJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI970A.tmpJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\751f58.msiJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\751f58.msiJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{A212FB01-63C8-4065-96B1-E0A632039A36}Jump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{A212FB01-63C8-4065-96B1-E0A632039A36}\ProductIconJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI9C1B.tmpJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SystemTemp\~DF90C0125B1508BFB3.TMPJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SystemTemp\~DF010D0E514601D174.TMPJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeFile created: C:\Windows\SysWOW64\_ws_agent_signal1734365137853-SECURE_AGENT_SETTINGS_READ_FAILURE.jsonJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI2F74.tmpJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_03604F8615_3_03604F86
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_03604F8615_3_03604F86
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_036072C315_3_036072C3
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_03604FE615_3_03604FE6
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_036050BE15_3_036050BE
                Source: uninstbr.000.15.drStatic PE information: Number of sections : 11 > 10
                Source: uninstall-ninja.exe.15.drStatic PE information: Number of sections : 11 > 10
                Source: bcd0a7e679ee9d4687e219fbd06d47de.tmp.12.drStatic PE information: Number of sections : 11 > 10
                Source: uninstall.exe.15.drStatic PE information: Number of sections : 11 > 10
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, type: DROPPEDMatched rule: APT_Trojan_Win_REDFLARE_6 date_created = 2020-12-01, rev = FireEye, date_modified = 2020-12-01, md5 = 294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2
                Source: NinjaRMMAgent.exe.15.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
                Source: NinjaRMMAgentPatcher.exe.15.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590955966.0000000009A25000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: com.slnishinomiya.hyogo.jpkustanai.rucom.snpassenger-association.aerocom.sotsushima.nagasaki.jpcom.stuy.comx.seisa-geek.comcom.sv
                Source: classification engineClassification label: mal60.winMSI@29/70@8/4
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901Jump to behavior
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5732:120:WilError_03
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeMutant created: \BaseNamedObjects\NinjaRMMSignalSubmitterRunning
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeMutant created: NULL
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6192:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7548:120:WilError_03
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\TEMP\~DFE6AB0CD767BFE075.TMPJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeFile read: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\msiwrapper.iniJump to behavior
                Source: C:\Windows\System32\msiexec.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
                Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\wayneenterprisesbatcave-6.0.1901-windows-installer.msi"
                Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 91B7917CC6A189DCDC73BA314F139EC3
                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 37613F16A2C4BDDC0F5FCD566987FE99 E Global\MSI0000
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
                Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
                Source: C:\Windows\SysWOW64\expand.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe" --mode unattended
                Source: unknownProcess created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe "C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe"
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)LOW
                Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files"
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe "C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe" /submitsignals
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//
                Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc
                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 91B7917CC6A189DCDC73BA314F139EC3Jump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 37613F16A2C4BDDC0F5FCD566987FE99 E Global\MSI0000Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files"Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)HIGHJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* filesJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe" --mode unattended Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)LOWJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe "C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe" /submitsignalsJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//Jump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: cryptnet.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: appidapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: cryptnet.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: appidapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_1_clr0400.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Windows\System32\msiexec.exeSection loaded: servicingcommon.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cfgmgr32.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: virtdisk.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: smartscreenps.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: servicingcommon.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: shdocvw.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: cabinet.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: dpx.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: wdscore.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: dbghelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: dbgcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: pdh.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: wtsapi32.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: msvcp60.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: samcli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: schedcli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: logoncli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: textinputframework.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: cfgmgr32.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: linkinfo.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: ntshrui.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: cscapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: dlnashext.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: wpdshext.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: dbghelp.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: version.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: wtsapi32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: activeds.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: gpedit.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: msi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: adsldpc.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: dssec.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: dsuiext.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: framedynos.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: dsrole.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: logoncli.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: ntdsapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: authz.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: cfgmgr32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: dbghelp.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: version.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: wtsapi32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: activeds.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: gpedit.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: msi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: msimg32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: wevtapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: oleacc.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: adsldpc.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: dssec.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: dsuiext.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: framedynos.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: authz.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: dsrole.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: logoncli.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: ntdsapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: dbgcore.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: samcli.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: cfgmgr32.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                Source: C:\Windows\System32\svchost.exeSection loaded: fcon.dllJump to behavior
                Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32Jump to behavior
                Source: Uninstall NinjaRMMAgent.lnk.15.drLNK file: ..\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe
                Source: C:\Windows\SysWOW64\msiexec.exeFile written: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\msiwrapper.iniJump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: wayneenterprisesbatcave-6.0.1901-windows-installer.msiStatic file information: File size 50941952 > 1048576
                Source: Binary string: D:\BuildAgent\work\ca5c6e3bc22f755f\vcpkg\buildtrees\curl\x86-windows-static-rel\src\curl.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\5fd0d3984528b628\3rdparty\qtstatic\proxy_process\build_release_x64\release\NinjaRMMProxyProcess64.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -utf-8 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -utf-8 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMcrypto\bio\bio_lib.c source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: expected true storage.pDb_ != NULL source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\win-patcher\NinjaRMMAgentPatcher.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\njcli\ninjarmm-cli.pdb) source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591328643.0000000006816000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\ca5c6e3bc22f755f\vcpkg\buildtrees\nj-winpty\x86-windows-static-rel\winpty-agent.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: :%d :%d error %d: D:\BuildAgent\work\aac9931d38d89885\src\ninjarmm-agentlib\persistence\sqlite_storage.cppexpected true pDb_ != NULLexpected true pStatementTextexpected true pStmtexpected true storage.pDb_ != NULLexpected true storage.pDb_ == pStorage_->pDb_D:\BuildAgent\work\aac9931d38d89885\src\ninjarmm-agentlib\persistence\sqlite_binders.cpp%s:%d can't bind rowid value [%llu] to statement param %d%s:%d can't map row param %d value [%d] to table_STATUS_v1::status_tue5o87wpno;q836 iop[lpkskop' o9871sdkjh ;srghj ;lwrg-mwnoetiuh w;oi46thgn ajog oq873r50q23l; [56984239465T-2305 3[5T8 QU -MV964 [YW08456 agfq 725184340Q2N 9ERa;slfhg;sl ;-ASIUWY98476-3WM5VM [] -070I .]0valueIdvalueOptionsentityTypeattributeNameattributeTypeattributeScopescriptPermissionadvancedSettingsattributeDefinitionScopeCHECKBOXDECIMALTEXT_MULTILINETEXTEMAILIP_ADDRESSPHONETEXT_ENCRYPTEDMULTI_SELECTNODE_MULTI_SELECTCLIENT_MULTI_SELECTCLIENT_LOCATION_MULTI_SELECTDROPDOWNNODE_DROPDOWNCLIENT_DROPDOWNCLIENT_LOCATION_DROPDOWNDATEDATE_TIMETIMEATTACHMENTWYSIWYGdocumentIdtemplateIdCDCFAttribute: detected not null docId for not instantiated docCDCFAttribute: Unable to retrieve correct template/document IDResetting m_nRetryTimer to 0 for Interval Schedule typeInterval New Schedule: Weekly New Schedule: Invalid scheduleType. Manually setting to 0 (Daily)Empty scheduleType. Manually setting to 0 (Daily) source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: expected true storage.pDb_ == pStorage_->pDb_ source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\5fd0d3984528b628\3rdparty\qtstatic\proxy_process\build_release_x64\release\NinjaRMMProxyProcess64.pdbM source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\ca5c6e3bc22f755f\vcpkg\buildtrees\sentry-native\x86-windows-static-rel\crashpad_build\handler\crashpad_handler.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\vcpkg\buildtrees\curl\x86-windows-static-rel\src\curl.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\njcli\ninjarmm-cli.pdb source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591328643.0000000006816000.00000004.00000020.00020000.00000000.sdmp
                Source: uninstbr.000.15.drStatic PE information: real checksum: 0x3042cda should be: 0x80b87a
                Source: BR5DBC.tmp.15.drStatic PE information: real checksum: 0x0 should be: 0x12bb9
                Source: bcd0a7e679ee9d4687e219fbd06d47de.tmp.12.drStatic PE information: section name: .eh_fram
                Source: NinjaRMMAgent.exe.15.drStatic PE information: section name: CPADinfo
                Source: NinjaRMMAgent.exe.15.drStatic PE information: section name: .qtmetad
                Source: NinjaRMMAgent.exe.15.drStatic PE information: section name: .qtmimed
                Source: NinjaRMMAgentPatcher.exe.15.drStatic PE information: section name: CPADinfo
                Source: NinjaRMMAgentPatcher.exe.15.drStatic PE information: section name: .qtmetad
                Source: NinjaRMMAgentPatcher.exe.15.drStatic PE information: section name: .qtmimed
                Source: uninstall-ninja.exe.15.drStatic PE information: section name: .eh_fram
                Source: uninstall.exe.15.drStatic PE information: section name: .eh_fram
                Source: BR5C11.tmp.15.drStatic PE information: section name: .eh_fram
                Source: BR5CFD.tmp.15.drStatic PE information: section name: .eh_fram
                Source: BR5D2D.tmp.15.drStatic PE information: section name: .eh_fram
                Source: BR6261.tmp.15.drStatic PE information: section name: .eh_fram
                Source: BR6272.tmp.15.drStatic PE information: section name: .eh_fram
                Source: uninstbr.000.15.drStatic PE information: section name: .eh_fram
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_035DCF98 pushad ; iretd 15_3_035DCFA1
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_035DCF98 pushad ; iretd 15_3_035DCFA1
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_035DCF98 pushad ; iretd 15_3_035DCFA1
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeCode function: 15_3_035DCF98 pushad ; iretd 15_3_035DCFA1
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeCode function: 16_3_03B63D3D push edx; ret 16_3_03B63D3E
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeCode function: 16_3_03B6419D push edx; ret 16_3_03B6419E
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeCode function: 16_3_03B653FD push edx; ret 16_3_03B653FE
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeCode function: 16_3_03B654DD push edx; ret 16_3_03B654DE
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI47EF.tmpJump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI970A.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR5D2D.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR6261.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR5D8C.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR5C8F.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR5C11.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.ExeJump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2F74.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR5CFD.tmpJump to dropped file
                Source: C:\Windows\SysWOW64\expand.exeFile created: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\98e57900ed61450c822e14ae7358386b$dpx$.tmp\bcd0a7e679ee9d4687e219fbd06d47de.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstbr.000Jump to dropped file
                Source: C:\Windows\SysWOW64\expand.exeFile created: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe (copy)Jump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI9C1B.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR6272.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR5DBC.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\tcl8925.tmp (copy)Jump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\BR60BA.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exeJump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI47EF.tmpJump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI970A.tmpJump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI9C1B.tmpJump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2F74.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstbr.000Jump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile created: C:\Users\user\AppData\Local\Temp\bitrock_installer.logJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//
                Source: C:\Windows\System32\msiexec.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 BlobJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI970A.tmpJump to dropped file
                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI47EF.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR5D2D.tmpJump to dropped file
                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI9C1B.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR6272.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR6261.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR5D8C.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR5DBC.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR5C8F.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\tcl8925.tmp (copy)Jump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR5C11.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.ExeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR60BA.tmpJump to dropped file
                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI2F74.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BR5CFD.tmpJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstbr.000Jump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeDropped PE file which has not been started: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exeJump to dropped file
                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeFile opened: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\Jump to behavior
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588645834.00000000087D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmci6K
                Source: 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Virtual Disk (VHD-format) fixed
                Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files"Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)HIGHJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* filesJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe" --mode unattended Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)LOWJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\be29e7f1-71ae-4703-50cb-1d52be512f51 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\be29e7f1-71ae-4703-50cb-1d52be512f51 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.Exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.Exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.Exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl-ca-bundle.crt VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl-ca-bundle.crt VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl-ca-bundle.crt VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\Uninstall NinjaRMMAgent.lnk VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.dat VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86) VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstbr.000 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.dat VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.dat.new VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstbr.000 VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeQueries volume information: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exe VolumeInformationJump to behavior
                Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exeKey value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation BiasJump to behavior
                Source: C:\Windows\SysWOW64\expand.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 BlobJump to behavior
                Source: Yara matchFile source: 00000010.00000000.11582454483.0000000002637000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000010.00000002.12618710420.0000000002637000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000028.00000000.12320713676.00000000021D6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000028.00000002.12619323050.00000000021D6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000003.11591328643.00000000068D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe, type: DROPPED
                Source: Yara matchFile source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, type: DROPPED

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure1
                Replication Through Removable Media                		1
                Service Execution                		1
                Windows Service                		1
                Windows Service                		31
                Masquerading                		OS Credential Dumping1
                System Time Discovery                		Remote Services11
                Archive Collected Data                		12
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault AccountsScheduled Task/Job1
                Services File Permissions Weakness                		11
                Process Injection                		1
                Modify Registry                		LSASS Memory1
                Security Software Discovery                		Remote Desktop ProtocolData from Removable Media1
                Non-Application Layer Protocol                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAt1
                DLL Side-Loading                		1
                Services File Permissions Weakness                		1
                Disable or Modify Tools                		Security Account Manager1
                Process Discovery                		SMB/Windows Admin SharesData from Network Shared Drive3
                Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                DLL Side-Loading                		11
                Process Injection                		NTDS11
                Peripheral Device Discovery                		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                Obfuscated Files or Information                		LSA Secrets3
                File and Directory Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Services File Permissions Weakness                		Cached Domain Credentials23
                System Information Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                Software Packing                		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                DLL Side-Loading                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                File Deletion                		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1576358 Sample: wayneenterprisesbatcave-6.0... Startdate: 16/12/2024 Architecture: WINDOWS Score: 60 70 www.msn.com 2->70 72 tse1.mm.bing.net 2->72 74 12 other IPs or domains 2->74 82 Malicious sample detected (through community Yara rule) 2->82 84 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->84 86 Sigma detected: Invoke-Obfuscation VAR+ Launcher 2->86 88 Sigma detected: Files With System Process Name In Unsuspected Locations 2->88 9 msiexec.exe 86 33 2->9         started        12 NinjaRMMAgentPatcher.exe 13 19 2->12         started        15 svchost.exe 3 2->15         started        17 msiexec.exe 5 2->17         started        signatures3 process4 dnsIp5 50 C:\Windows\Installer\MSI9C1B.tmp, PE32 9->50 dropped 52 C:\Windows\Installer\MSI970A.tmp, PE32 9->52 dropped 54 C:\Windows\Installer\MSI47EF.tmp, PE32 9->54 dropped 56 C:\Windows\Installer\MSI2F74.tmp, PE32 9->56 dropped 19 msiexec.exe 10 9->19         started        21 msiexec.exe 3 9->21         started        76 d2veja0xsw5o33.cloudfront.net 18.66.161.92, 443, 49788 MIT-GATEWAYSUS United States 12->76 78 52.32.94.97, 443, 49816, 49817 AMAZON-02US United States 12->78 80 2 other IPs or domains 12->80 23 NinjaRMMAgent.exe 3 12->23         started        file6 process7 process8 25 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe 30 26 19->25         started        28 expand.exe 4 19->28         started        30 icacls.exe 1 19->30         started        32 icacls.exe 1 19->32         started        34 cmd.exe 1 21->34         started        36 cmd.exe 1 23->36         started        38 conhost.exe 23->38         started        file9 58 C:\Program Files (x86)\...\wevtutil.exe, PE32 25->58 dropped 60 C:\Program Files (x86)\...60injaRMMAgent.exe, PE32 25->60 dropped 62 C:\Users\user\AppData\Local\Temp\BR6272.tmp, PE32 25->62 dropped 68 15 other files (none is malicious) 25->68 dropped 64 9b2f5ed9-ea12-469a...nstaller.exe (copy), PE32 28->64 dropped 66 C:\...\bcd0a7e679ee9d4687e219fbd06d47de.tmp, PE32 28->66 dropped 40 conhost.exe 28->40         started        42 conhost.exe 30->42         started        44 conhost.exe 32->44         started        46 conhost.exe 34->46         started        48 sc.exe 1 36->48         started        process10

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                ⊘No Antivirus matches

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.Exe0%ReversingLabs
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe0%ReversingLabs
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe0%ReversingLabs
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exe0%ReversingLabs
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\tcl8925.tmp (copy)0%ReversingLabs
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exe0%ReversingLabs
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe0%ReversingLabs
                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exe0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR5C11.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR5C8F.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR5CFD.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR5D2D.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR5D8C.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR5DBC.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR60BA.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR6261.tmp0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\BR6272.tmp0%ReversingLabs
                C:\Windows\Installer\MSI2F74.tmp0%ReversingLabs
                C:\Windows\Installer\MSI47EF.tmp0%ReversingLabs
                C:\Windows\Installer\MSI970A.tmp0%ReversingLabs
                C:\Windows\Installer\MSI9C1B.tmp0%ReversingLabs

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://https://DefaultHTTPProtoNinjaRMMAgent.exeAgentCurrentExecutableNameD:0%Avira URL Cloudsafe
                https://repository.luxtrust.lu00%Avira URL Cloudsafe
                http://tkcon.sourceforge.net/0%Avira URL Cloudsafe
                http://policy.camerfirma.com0%Avira URL Cloudsafe
                https://www.catcert.net/verarrel050%Avira URL Cloudsafe
                http://bugreports.qt.io/_q_receiveReplyensureClientPrefaceSentMicrosoft-IIS/4.Microsoft-IIS/5.Netsca0%Avira URL Cloudsafe
                http://www.pkioverheid.nl/policies/root-policy-G20%Avira URL Cloudsafe
                http://download.bitrock.com/feedback.php0%Avira URL Cloudsafe
                http://www.quovadis.bm0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                d2veja0xsw5o33.cloudfront.net
                		18.66.161.92
                		truefalse
                  		unknown
                  chrome.cloudflare-dns.com
                  		172.64.41.3
                  		truefalse
                    		high
                    agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com
                    		52.42.136.152
                    		truefalse
                      		high
                      ax-0001.ax-msedge.net
                      		150.171.27.10
                      		truefalse
                        		high
                        sni1gl.wpc.sigmacdn.net
                        		152.199.21.175
                        		truefalse
                          		high
                          assets.msn.com
                          		unknown
                          		unknownfalse
                            		high
                            resources.ninjarmm.com
                            		unknown
                            		unknownfalse
                              		high
                              srtb.msn.com
                              		unknown
                              		unknownfalse
                                		high
                                res.public.onecdn.static.microsoft
                                		unknown
                                		unknownfalse
                                  		high
                                  tse1.mm.bing.net
                                  		unknown
                                  		unknownfalse
                                    		high
                                    agent-app.ninjarmm.com
                                    		unknown
                                    		unknownfalse
                                      		high

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.phreedom.org/md5)08:279b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl09b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://crl.securetrust.com/SGCA.crlNinjaRMMAgentPatcher.exefalse
                                              		high
                                              http://ocsp.sectigo.com0expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://certificates.godaddy.com/repository/09b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://repository.luxtrust.lu0NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://crashpad.chromium.org/bug/new9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://https://DefaultHTTPProtoNinjaRMMAgent.exeAgentCurrentExecutableNameD:9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://resources.ninjarmm.com/components/gravityzone/(https?9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://resources.ninjarmm.com/components/gravityzone/sample_policy_tmp_2.jsonGravityZone:9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://tkcon.sourceforge.net/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11530506136.0000000005583000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11531946378.0000000005586000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://policy.camerfirma.comNinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://curl.se/docs/sslcerts.html9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://bugreports.qt.io/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://resources.ninjarmm.com/Bitdefender/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://curl.se/docs/hsts.html9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://crl.godaddy.com/gdig2s5-6.crl09b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://docs.fedoraproject.org/en-US/Fedora/13/html/SELinux_FAQ/index.html#id30371549b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11531998961.000000000484B000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590136172.0000000004870000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532334790.000000000486F000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532091476.0000000004853000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11532233233.0000000004862000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://resources.ninjarmm.com/Crowdstrike/ws.agent.config.crowdstrike.generic.jsonws.agent.config.c9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://resources.ninjarmm.com/Bitdefender/https://resources.ninjarmm.com/Bitdefender/MAC/STORAGE#Vo9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlNinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://resources.ninjarmm.com/AgentInstallers/cabarc_20230209.zip9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://certificates.godaddy.com/repository/gdig2.crt09b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://resources.ninjarmm.com/components/gravityzone/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.phreedom.org/md5)9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://crl.xrampsecurity.com/XGCA.crlNinjaRMMAgentPatcher.exefalse
                                                                                            		high
                                                                                            https://crashpad.chromium.org/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://curl.se/libcurl/c/curl_easy_setopt.html9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://sectigo.com/CPS0expand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://resources.ninjarmm.com/AgentInstallers/cabarc_20230209.zip5a4e1ba7ad86dff0e7fa019049d5efb83d9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.0000000006AD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://resources.ninjarmm.com/Bitdefender/MAC/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://resources.ninjarmm.com/Crowdstrike/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://curl.se/docs/http-cookies.html9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://certs.godaddy.com/repository/13019b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://agent-app.ninjarmm.com/ws/agent/signalNinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://certs.godaddy.com/repository/09b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://curl.se/docs/alt-svc.html9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://agent-app.ninjarmm.comNinjaRMMAgentPatcher.exefalse
                                                                                                                      		high
                                                                                                                      https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/cert9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://resources.ninjarmm.com/components/gravityzone/sample_policy_tmp_2.json9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://download.bitrock.com/feedback.php9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11530887452.00000000055D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://resources.ninjarmm.com/SentinelOne/ws.agent.config.sentinelone.generic.jsonws.agent.config.s9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://crl.godaddy.com/gdroot-g2.crl0F9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587756073.0000000002A86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://curl.se/docs/copyright.htmlD9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://www.catcert.net/verarrelNinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmp, NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://crl.securetrust.com/STCA.crlNinjaRMMAgentPatcher.exefalse
                                                                                                                                    		high
                                                                                                                                    http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589860062.0000000002A03000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11587857458.0000000008D9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://www.accv.es/legislacion_c.htmNinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0zexpand.exe, 0000000C.00000003.11492385489.0000000003279000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510751043.0000000002A16000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11510717590.00000000029FE000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A07000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11506626340.0000000002A11000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://www.pkioverheid.nl/policies/root-policy-G2NinjaRMMAgentPatcher.exefalse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          https://www.catcert.net/verarrel05NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmp, NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          http://www.cert.fnmt.es/dpcs/NinjaRMMAgent.exe, 00000028.00000003.12609665543.00000000041F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.quovadis.bmNinjaRMMAgentPatcher.exefalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            https://curl.se/P9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11588029820.0000000009463000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11590477989.0000000009562000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591507470.00000000085C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlNinjaRMMAgentPatcher.exefalse
                                                                                                                                                		high
                                                                                                                                                http://www.accv.es00NinjaRMMAgentPatcher.exe, 00000010.00000003.11618886419.0000000003BEC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://resources.ninjarmm.com/SentinelOne/9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11586029577.0000000008FE3000.00000004.00000020.00020000.00000000.sdmp, 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11589417095.000000000911E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://bugreports.qt.io/_q_receiveReplyensureClientPrefaceSentMicrosoft-IIS/4.Microsoft-IIS/5.Netsca9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, 0000000F.00000003.11591107103.00000000069D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		unknown

                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                    Public IPs

                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                    52.42.136.152
                                                                                                                                                    		agent-prod-us-west-244308638.us-west-2.elb.amazonaws.comUnited States
                                                                                                                                                    		16509AMAZON-02USfalse
                                                                                                                                                    18.66.161.92
                                                                                                                                                    		d2veja0xsw5o33.cloudfront.netUnited States
                                                                                                                                                    		3MIT-GATEWAYSUSfalse
                                                                                                                                                    52.32.94.97
                                                                                                                                                    		unknownUnited States
                                                                                                                                                    		16509AMAZON-02USfalse

                                                                                                                                                    Private

                                                                                                                                                    IP
                                                                                                                                                    127.0.0.1

                                                                                                                                                    General Information

                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                    Analysis ID:1576358
                                                                                                                                                    Start date and time:2024-12-16 22:03:00 +01:00
                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                    Overall analysis duration:0h 9m 25s
                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                    Report type:full
                                                                                                                                                    Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                    Analysis system description:Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
                                                                                                                                                    Run name:Potential for more IOCs and behavior
                                                                                                                                                    Number of analysed new started processes analysed:50
                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                    Technologies:
                                                                                                                                                    • HCA enabled
                                                                                                                                                    • EGA enabled
                                                                                                                                                    • AMSI enabled
                                                                                                                                                    Analysis Mode:default
                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                    Sample name:wayneenterprisesbatcave-6.0.1901-windows-installer.msi
                                                                                                                                                    Detection:MAL
                                                                                                                                                    Classification:mal60.winMSI@29/70@8/4
                                                                                                                                                    EGA Information:Failed
                                                                                                                                                    HCA Information:
                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                    • Number of executed functions: 0
                                                                                                                                                    • Number of non-executed functions: 1
                                                                                                                                                    Cookbook Comments:
                                                                                                                                                    • Found application associated with file extension: .msi
                                                                                                                                                    • Close Viewer

                                                                                                                                                    Warnings

                                                                                                                                                    • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, SIHClient.exe, appidcertstorecheck.exe, conhost.exe, backgroundTaskHost.exe
                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 204.79.197.203, 20.109.210.53, 20.223.36.55, 2.20.68.210, 2.20.68.201, 95.100.135.26, 95.100.135.33, 95.100.135.8, 95.100.135.25, 95.100.135.11, 95.100.135.24, 95.100.135.10, 95.100.135.18, 95.100.135.19, 2.16.158.72, 2.16.158.74, 2.16.158.90, 2.16.158.96, 2.16.158.73, 2.16.158.58, 2.16.158.80, 2.16.158.169, 2.16.158.75, 20.198.118.190, 20.190.177.85, 20.190.177.146, 20.190.177.22, 20.190.177.84, 20.190.147.12, 20.190.177.149, 20.190.147.1, 20.190.147.6, 23.200.88.196, 204.79.197.237, 23.218.208.109
                                                                                                                                                    • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, a767.dspw65.akamai.net, cxcs.microsoft.net, res-ocdi-public.trafficmanager.net, cdn-office.azureedge.net, wns.notify.trafficmanager.net, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, login.live.com, th.bing.com, sls.update.microsoft.com, wu-b-net.trafficmanager.net, e28578.d.akamaiedge.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, fd-api-iris.trafficmanager.net, assets.msn.com.edgekey.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, a-0003.a-msedge.net, fd.api.iris.microsoft.com, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, cdn-office.ec.azureedge.net, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, mm-mm.bing.net.trafficmanager.net, iris-de-prod-azsc-v2-neu-b.northeurope.cloudapp.azure.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                                                                    • Execution Graph export aborted for target 9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe, PID 6108 because there are no executed function
                                                                                                                                                    • Execution Graph export aborted for target NinjaRMMAgentPatcher.exe, PID 2232 because there are no executed function
                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                    • VT rate limit hit for: wayneenterprisesbatcave-6.0.1901-windows-installer.msi

                                                                                                                                                    Simulations

                                                                                                                                                    Behavior and APIs

                                                                                                                                                    ⊘No simulations

                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                    IPs

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                    18.66.161.92Tbconsulting Company Guidelines Employee Handbook.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                      https://connexion-espacesclients.support/gkm/Get hashmaliciousUnknownBrowse
                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse

                                                                                                                                                                Domains

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                ax-0001.ax-msedge.nethttps://afg.acemlnb.com/lt.php?x=3TZy~GE3UnGZEpJA-w9HgOSc2K2ji_L0wu1gjqXGIXSh587-zEy.zuJr1Y2iitE~judAXHPHJeTMHaWtOdxFVOFx23MoiNDGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.28.10
                                                                                                                                                                Tbconsulting Company Guidelines Employee Handbook.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.28.10
                                                                                                                                                                https://docsend.com/v/ty7vw/up-dateGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.27.10
                                                                                                                                                                Smple_Order-048576744759475945.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.27.10
                                                                                                                                                                YPgggL1oh7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.27.10
                                                                                                                                                                BG75-10-01_CurrencyTransfer__530_24_00002559_Processed.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.27.10
                                                                                                                                                                https://147.45.47.98/error.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.27.10
                                                                                                                                                                AV4b38nlhN.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 150.171.28.10
                                                                                                                                                                fm2r286nqT.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                • 150.171.27.10
                                                                                                                                                                FT876567090.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                • 150.171.28.10
                                                                                                                                                                agent-prod-us-west-244308638.us-west-2.elb.amazonaws.comunitedserviceorganizationsstaff-5.8.9154-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                • 52.88.224.60
                                                                                                                                                                globalassetdashboards-5.6.8294-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                • 52.27.112.65
                                                                                                                                                                chrome.cloudflare-dns.comSetup.exe (1).zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                Smple_Order-048576744759475945.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 162.159.61.3
                                                                                                                                                                BG75-10-01_CurrencyTransfer__530_24_00002559_Processed.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 162.159.61.3
                                                                                                                                                                KjECqzXLWp.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                cey4VIyGKh.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                • 162.159.61.3
                                                                                                                                                                dZKPE9gotO.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                • 162.159.61.3
                                                                                                                                                                nB52P46OJD.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog StealerBrowse
                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                T0x859fNfn.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                • 162.159.61.3
                                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                d2veja0xsw5o33.cloudfront.netunitedserviceorganizationsstaff-5.8.9154-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                • 108.157.150.117
                                                                                                                                                                globalassetdashboards-5.6.8294-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                • 3.161.188.83

                                                                                                                                                                ASNs

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                AMAZON-02USla.bot.arm6.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                https://afg.acemlnb.com/lt.php?x=3TZy~GE3UnGZEpJA-w9HgOSc2K2ji_L0wu1gjqXGIXSh587-zEy.zuJr1Y2iitE~judAXHPHJeTMHaWtOdxFVOFx23MoiNDGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 52.210.174.128
                                                                                                                                                                http://inspirafinancial.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 52.11.244.148
                                                                                                                                                                Tbconsulting Company Guidelines Employee Handbook.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 205.251.222.35
                                                                                                                                                                m.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                GUZNpPSg9z.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                                                                • 3.127.181.115
                                                                                                                                                                Recommended Itinerary.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 3.134.125.175
                                                                                                                                                                https://docsend.com/v/ty7vw/up-dateGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 3.160.188.127
                                                                                                                                                                zmap.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                AMAZON-02USla.bot.arm6.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                https://afg.acemlnb.com/lt.php?x=3TZy~GE3UnGZEpJA-w9HgOSc2K2ji_L0wu1gjqXGIXSh587-zEy.zuJr1Y2iitE~judAXHPHJeTMHaWtOdxFVOFx23MoiNDGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 52.210.174.128
                                                                                                                                                                http://inspirafinancial.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 52.11.244.148
                                                                                                                                                                Tbconsulting Company Guidelines Employee Handbook.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 205.251.222.35
                                                                                                                                                                m.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                GUZNpPSg9z.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                                                                • 3.127.181.115
                                                                                                                                                                Recommended Itinerary.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 3.134.125.175
                                                                                                                                                                https://docsend.com/v/ty7vw/up-dateGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 3.160.188.127
                                                                                                                                                                zmap.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                MIT-GATEWAYSUSsecuredoc_20241216T121346.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.66.161.34
                                                                                                                                                                Setup.exe (1).zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.161.97.97
                                                                                                                                                                http://inspirafinancial.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.161.111.80
                                                                                                                                                                Tbconsulting Company Guidelines Employee Handbook.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.161.97.38
                                                                                                                                                                Remit_Advice_SMKT_84655.htmGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 18.165.220.9
                                                                                                                                                                https://qrs.ly/gggdyxxGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.165.220.105
                                                                                                                                                                dZKPE9gotO.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                • 18.173.219.84
                                                                                                                                                                nB52P46OJD.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                • 18.173.219.84
                                                                                                                                                                https://protect.checkpoint.com/v2/r02/___https://url1251.popmenu.com/qxdhqnhp?zus=z556.WRHPCjsgt/tA51B6LI9w4BubTYwM5p/-7KrggkVEpmPU5/oVFKKM8Rk6rAnqtQtILc2Q2H_3u9DiXC41Sfynx8MyN*~*gGwOol/aO3BY*~*pgD37kbc4-7KGmCSO4DHGqcB*~*D2S053knP-7G*~*y37ScDgrX/lhFDF7r7h5Gwz-7GtvZLu*~*h33zX5RXwSF0oDJX34CSZAvVXm4AFQJ-7Gq-7KxI/mcm4qvQmbxushMLQI9uHWfHKaPI5mifSCu5iVBRcvqUxu7JB4CzzH*~*tp7hI*~*P2JxcRqKbjQDa1m4EV2vJju-7KXGYhKkA/NMg4b3nlprWADF7NLfLtJTf5xKVlxz1PBE*~*XIwKJANjSZxzJHsTEzwI07xTpBPmh9cjRp3bNxF-8I___.YzJlOm1zbm90aWZ5OmM6bzphNDQ0NjUwYTgwNjk4YzE1YzQzODY0NjgzZWZkNGFjNzo3Ojk1N2U6NjEyMTFiMTNiOTljZDFhYmUzOWRiNzM5NDE0NGE3NDNhMDJkZjlhMmI1NzgzMzhlZTAwMjhmZTBkODVlNWNmZDpoOlQ6VAGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.66.161.102

                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                87b9bfc7da97115ed2276737b09f8d74unitedserviceorganizationsstaff-5.8.9154-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                • 52.32.94.97
                                                                                                                                                                • 52.42.136.152
                                                                                                                                                                • 18.66.161.92
                                                                                                                                                                globalassetdashboards-5.6.8294-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                • 52.32.94.97
                                                                                                                                                                • 52.42.136.152
                                                                                                                                                                • 18.66.161.92

                                                                                                                                                                Dropped Files

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.Exeunitedserviceorganizationsstaff-5.8.9154-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                  globalassetdashboards-5.6.8294-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse

                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                    C:\Config.Msi\751f57.rbs

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):7981
                                                                                                                                                                    Entropy (8bit):5.559757536592556
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:Ja9KcOZxiCXeheU4UYCCsThqsUYCC6jvTe1enwThqEH5FA5ecZlefe2ej1kfCClA:JpTiCGXYBIgYBb+bSllpQ
                                                                                                                                                                    MD5:D45A144C87BEC18EFA89C4BE8A9E4669
                                                                                                                                                                    SHA1:56107D6DE6C43416BC9C2CE854767F03DD50EFC6
                                                                                                                                                                    SHA-256:768B518B487D688065FCAEE8742B0767C7033C9F3FF4FCC5D91DD03110C7E277
                                                                                                                                                                    SHA-512:4B1277E1E5FC16C7E9D8AEE2C1395575B6027A992306CFF3382C2016A0BAFB74AACA04513C75D82AB7567608FFD66310F2E86FFF8A3916FEB4998608CB51963C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{A212FB01-63C8-4065-96B1-E0A632039A36}..NinjaRMMAgent6.wayneenterprisesbatcave-6.0.1901-windows-installer.msi.@.....@m....@.....@......ProductIcon..&.{BE5BC90A-C0C2-470D-896F-DE49F6B76428}.....@.....@.....@.....@.......@.....@.....@.......@......NinjaRMMAgent......Rollback..Rolling back action: [1]....RollbackCleanup..Removing backup files File: [1]....ProcessComponents..Updating component registration..&.{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}&.{A212FB01-63C8-4065-96B1-E0A632039A36}.@........bz.LateInstallFinish1....bz.LateInstallFinish2....WriteRegistryValues>.Writing system registry values Key: [1], Name: [2], Value: [3]$..@....@.SOFTWARE\EXEMSI.COM\MSI Wrapper\Installed\NinjaRMMAgent 6.0.1901...@....(.&...LogonUser..user'.&...USERNAME..user'.&...Date..16/12/2024'.&...Time..16:04:11'.&...WRAPPED_ARGUMENTS....RegisterProduct..Registering product [1]......C:\Windows\Installer\751f58.msi......C:\Windows\Installer\751f58.msi.@

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.Exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):65024
                                                                                                                                                                    Entropy (8bit):6.621457286897963
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:2yqQJk52A88CnvhiWTfYyNhZ0x1cjJZDjRdDSsbc+pA51f:xBJu2A88ElzYyNhZk1EJZf++puf
                                                                                                                                                                    MD5:5782F6987810A689E14542251B7D7059
                                                                                                                                                                    SHA1:7A15FDA248BE1954D2E35383C2857E8F37ABDF2E
                                                                                                                                                                    SHA-256:4962ECE5176ACE02DEA2B8D0A61321C0595B9D0970BD56CB04192C422BBF77CC
                                                                                                                                                                    SHA-512:6ABDF56129FE1001345DB9ECABA78CF65F95C8F008BD3BD458ADEB0BE0A308EE8C9CB51464A45BEFFCD5588DD300436BA19E7D829C321AEB99942CAAFA7E53D0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                    • Filename: unitedserviceorganizationsstaff-5.8.9154-windows-installer.msi, Detection: malicious, Browse
                                                                                                                                                                    • Filename: globalassetdashboards-5.6.8294-windows-installer.msi, Detection: malicious, Browse
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................Y.....Y.........T....Y....Y....Rich...........................PE..L......>............................\I.......................................P......F............ ..........................x...<....@.............................. ............................... )..@............................................text............................... ..`.data...$)..........................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):41591136
                                                                                                                                                                    Entropy (8bit):6.790779835119126
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:393216:ZC0IUB52ST/DEo+/WY4a4A5kNEO+J7DyofpxE+GI5wNsFTUAuL5IBuJsv6tWKFdP:TI6NDEHd4a4ACNl+/EaEIB4r/t4m26
                                                                                                                                                                    MD5:6735934BDE28A28958B9DB0A80B77B97
                                                                                                                                                                    SHA1:6D18BB99AD43D769688C1B94536075FA10E437EF
                                                                                                                                                                    SHA-256:254EC57451CD7ECC509CCDC7513A4C22DDEC8E0FE612179318354038C02927DD
                                                                                                                                                                    SHA-512:4C7E49F32BA38066B2812E226007E9A07756176E8BDA7F93CCEE834B234076146E71A140C7DB54B285E58D910FD2932799683363799B16FBE434D79C442663E5
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, Author: Joe Security
                                                                                                                                                                    • Rule: APT_Trojan_Win_REDFLARE_6, Description: unknown, Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, Author: unknown
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........e....t...t...t..ow...t..k....t..oq.%.t..qp...t..qw...t..X....t..qq.z.t..op...t..or...t...t...t.lqw...t..ou...t...u...t.lqp...t.lqq...t.lqt...t.lq....t.lqv...t.Rich..t.................PE..L...l..g..................6...C.....u.........7...@..........................P|.......z...@...........................[.H....[.......l...............y.`.... l..#..<.A.T.....................A.......A.@.............7.H............................text...R.6.......6................. ..`.rdata....$...7...%...6.............@..@.data... .....\.......[.............@...CPADinfo(.....f.......d.............@....qtmetadj.....g.......d.............@..P.qtmimed......g.......d.............@..P.rsrc.........l.......i.............@..@.reloc...#... l..$....i.............@..B........................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):31801696
                                                                                                                                                                    Entropy (8bit):6.791266930075442
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:393216:p+VFkZK/CeiAAASjcWXLgXtUbseTUAuL5IBuJsv6tWKFdu9C9LruJsv6tWKFdu9P:GpCehAASjZMXt4vEIB4rnvL
                                                                                                                                                                    MD5:89E9F6649AAF15310F5995ADFF7008AF
                                                                                                                                                                    SHA1:0F2A445D7C9DBA5F65393D7093BAC681FDA11168
                                                                                                                                                                    SHA-256:2C2456A1B0D1469E74B974715DD5197D80F5E9CED9DE36BF58ACEFABF463494B
                                                                                                                                                                    SHA-512:32DEFFAE6397125459AB7EF5CF0096BBD39BE6817DDBAD2B2A7A495DE93ED1F90A55F69735730B923FA290DAA1D372B4519E992303B26D7D3F831C0FF9343BAD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe, Author: Joe Security
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........H[.n&..n&..n&...%..n&...#.Mn&......n&..."..n&...%..n&...#..n&..2...n&..."..n&... ..n&..n&..n&...%..n&...'..n&..n'.fl&..."..j&...#..j&...&..n&......n&...$..n&.Rich.n&.........................PE..L...`..g.................t... !.....X............@.......................................@.........................`@..P....J.......p..|...............`........l...H..T....................J.......I..@............................................text....r.......t.................. ..`.rdata...............x..............@..@.data... ............l..............@...CPADinfo(....`......................@....qtmetadj....p......................@..P.qtmimed............. ..............@..P.rsrc...|....p......................@..@.reloc...l.......n...*..............@..B................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\Uninstall NinjaRMMAgent.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Mon Dec 16 20:04:22 2024, mtime=Mon Dec 16 20:04:22 2024, atime=Mon Dec 16 20:04:22 2024, length=0, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1251
                                                                                                                                                                    Entropy (8bit):4.659507225083825
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:82PxdOEg167TwGCGqnACSEaLaydh+TwtYqdh+Tw7VUU1lru7qLyfm:82PxdOx165qACSEaLaydLvdtWOlg9
                                                                                                                                                                    MD5:3AA572E8995B77C71B1F4669F49ACD61
                                                                                                                                                                    SHA1:65A29D5EB8BF3C38593E6CBEEE4D3B12F90C5128
                                                                                                                                                                    SHA-256:1DC4A521105941CD9D0393C65E5075978A4CF63E54EF0480DC53C50C9093A90F
                                                                                                                                                                    SHA-512:C88580355497A40AE157A1D5C6007C4FCFC64A9CC93DC4C948E1CA3107A7A88E64252EA0DDAB39540E2584540BCD591C483D31EB2D1D9BE5ED8B7955C6C1821C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.... ...te...O..te...O..te...O...............................P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........T.+.Y......................V.....c...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.......1......Y....WAYNEE~1.190..r......Y...Y......%.........................w.a.y.n.e.e.n.t.e.r.p.r.i.s.e.s.b.a.t.c.a.v.e.-.6...0...1.9.0.1.....h.2......Y.. .UNINST~2.EXE..L......Y...Y......f.........................u.n.i.n.s.t.a.l.l...e.x.e.......t...............-.......s...........we.......C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe....U.n.i.n.s.t.a.l.l.E.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.w.a.y.n.e.e.n.t.e.r.p.r.i.s.e.s.b.a.t.c.a.v.e.-.6...0...1.9.0.1.\.u.n.i.n.s.t.a.l.l...e.x.e.7.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.w.a.y.n.e.e.n.t.e.r.p.r.i.s.e.s.b.a.t.c.a.v.e.-.6...0...1.9.0.1.........*................@Z|...K.J.........`.......X.......701188..........R/U....G.....

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl-ca-bundle.crt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):223687
                                                                                                                                                                    Entropy (8bit):6.002981710271201
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:6Nc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:6Ncf7M576f4tLe0mIM0
                                                                                                                                                                    MD5:FD7AC2FF5B13ACF3B48478A6DA989A50
                                                                                                                                                                    SHA1:D7952C26FFD211B9D717E26144CCA281223C1DFA
                                                                                                                                                                    SHA-256:726889705B00F736200ED7999F7A50021B8735D53228D679C4E6665AA3B44987
                                                                                                                                                                    SHA-512:741566DD9B9A9D1FA47CEB26FBB587602C45FC40AF2D0012527D0B2B9EAE799E6B3AB3A55E71A5A0CD8BC876E579CB6E3469801AF7B0D0FAC1917D44ED27B111
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Jun 24 03:12:10 2020 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.28..## SHA256: 5796295533cad5a648a20a115b0894dc9b318c41501796e7158e824c323f11c3.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2641336
                                                                                                                                                                    Entropy (8bit):6.873884860120576
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:yivIOlsmpe1fQtQIC7l68L1Ps4NAWPpnRk6KwD:yivIQs1YeR68hP7AInRb
                                                                                                                                                                    MD5:EB0530477CF163F8CC4AF5EE98E87809
                                                                                                                                                                    SHA1:5611F031E18BC92D2A1172E112E6C5C33C69C5D4
                                                                                                                                                                    SHA-256:6C09556CF8176DFBB8DEF9D93F9F4F2FDCA0D739E56B1598DA7FE15A3B793817
                                                                                                                                                                    SHA-512:F9859C0B86D12D7311692587859073E88578800843EA5E29C2F9A87DCD60D3D008B52AF8B85BA09C581485A527AB9594DA81A557A62DD65B0303EA6E834889B3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yq.1=.kb=.kb=.kb){hc3.kb){nc..kb){oc/.kb[..b1.kboenc..kboeoc..kboehc$.kb=.kb(.kb){jc0.kb=.jb..kb.eoc..kb.e.b<.kb.eic<.kbRich=.kb........................PE..L.....Vf.....................n.......j............@..........................p(......h(...@.................................lx&...... '.H.............(..M...0'.|:...e&.T...........................`e&.@...............h............................text............................... ..`.rdata..D...........................@..@.data.........&..J...r&.............@....rsrc...H.... '.......&.............@..@.reloc..|:...0'..<....&.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\ninjarmm-curl-ca-bundle.crt (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):223687
                                                                                                                                                                    Entropy (8bit):6.002980959549091
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:XNc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:XNcf7M576f4tLe0mIM0
                                                                                                                                                                    MD5:C726AE88FD600AA26DF1D30F42B51FEC
                                                                                                                                                                    SHA1:0176D2FBCC41808B1B03B773145B2549953A8334
                                                                                                                                                                    SHA-256:ADF770DFD574A0D6026BFAA270CB6879B063957177A991D453FF1D302C02081F
                                                                                                                                                                    SHA-512:CC129AE1A4377A43A74B0854B6ECCB2B315CDFCE018142D1DD5524FB64C8945CDE067CB18F366351FA7D6AF3F9F36CF21BC1F626F987F9E4627878472EA59CDE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Jan 1 04:12:10 2020 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.27..## SHA256: f3bdcd74612952da8476a9d4147f50b29ad0710b7dd95b4c8690500209986d70.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\qt_temp.eKWHHj

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):223687
                                                                                                                                                                    Entropy (8bit):6.002980959549091
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:XNc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:XNcf7M576f4tLe0mIM0
                                                                                                                                                                    MD5:C726AE88FD600AA26DF1D30F42B51FEC
                                                                                                                                                                    SHA1:0176D2FBCC41808B1B03B773145B2549953A8334
                                                                                                                                                                    SHA-256:ADF770DFD574A0D6026BFAA270CB6879B063957177A991D453FF1D302C02081F
                                                                                                                                                                    SHA-512:CC129AE1A4377A43A74B0854B6ECCB2B315CDFCE018142D1DD5524FB64C8945CDE067CB18F366351FA7D6AF3F9F36CF21BC1F626F987F9E4627878472EA59CDE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Jan 1 04:12:10 2020 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.27..## SHA256: f3bdcd74612952da8476a9d4147f50b29ad0710b7dd95b4c8690500209986d70.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\tcl8925.tmp (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8412616
                                                                                                                                                                    Entropy (8bit):7.671881593166912
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:196608:CmF9bfiCc1w5QoFgupFShmbuR7NYI1/Rry/05tf:xiw5Q7hX1/ck
                                                                                                                                                                    MD5:F8F6F1B4C6EAF6DCE71EB07B40ABE4D6
                                                                                                                                                                    SHA1:993B632E9E0612DA895FE0A337BD0444DEA9DFB2
                                                                                                                                                                    SHA-256:9F9F1BF2C289830BBD841B8E0F55D4042486DE09DF95B500AC3A53261DE54BF4
                                                                                                                                                                    SHA-512:7EBFCB25255ACD76BA0D7B297D45A70CBEE09B78152ECAE89393120A961B44B8E4D0AEE4D49A99CD7354842F0C9783A249F6C073F15DBA0EC7830916E0891E21
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]......................,..............0....@.......................... -...........@... .......................(.n.....(.0<...0)..................M....+..9........................... ).......................(..............................text...............................`.P`.data....G...0...H..................@.`..rdata...+.......,...b..............@.`@.eh_fram......#.......#.............@.0@.bss..........(.......................`..edata..n.....(......~(.............@.0@.idata..0<....(..>....(.............@.0..CRT..........).......(.............@.0..tls.... .... ).......(.............@.0..rsrc........0).......(.............@.0..reloc...9....+..:...n+.............@.0B........................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8412616
                                                                                                                                                                    Entropy (8bit):7.671881593166912
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:196608:CmF9bfiCc1w5QoFgupFShmbuR7NYI1/Rry/05tf:xiw5Q7hX1/ck
                                                                                                                                                                    MD5:F8F6F1B4C6EAF6DCE71EB07B40ABE4D6
                                                                                                                                                                    SHA1:993B632E9E0612DA895FE0A337BD0444DEA9DFB2
                                                                                                                                                                    SHA-256:9F9F1BF2C289830BBD841B8E0F55D4042486DE09DF95B500AC3A53261DE54BF4
                                                                                                                                                                    SHA-512:7EBFCB25255ACD76BA0D7B297D45A70CBEE09B78152ECAE89393120A961B44B8E4D0AEE4D49A99CD7354842F0C9783A249F6C073F15DBA0EC7830916E0891E21
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]......................,..............0....@.......................... -...........@... .......................(.n.....(.0<...0)..................M....+..9........................... ).......................(..............................text...............................`.P`.data....G...0...H..................@.`..rdata...+.......,...b..............@.`@.eh_fram......#.......#.............@.0@.bss..........(.......................`..edata..n.....(......~(.............@.0@.idata..0<....(..>....(.............@.0..CRT..........).......(.............@.0..tls.... .... ).......(.............@.0..rsrc........0).......(.............@.0..reloc...9....+..:...n+.............@.0B........................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.dat (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3638
                                                                                                                                                                    Entropy (8bit):7.93914241014023
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:iaY8fAijxOYrNPkgdXhNXhHuQWrkid8irCYvit4u1XHq+:THA6xOWNFjNRKZ5mf4MXK+
                                                                                                                                                                    MD5:FE87A7C81FD6B4F7301416031E33ACAE
                                                                                                                                                                    SHA1:23C890198AD064BFF70C142036630935FA9FD1CE
                                                                                                                                                                    SHA-256:52065CDEC045C9B27B9B3BF0F1488B92EA6CC9DB69ABED7F2F3870AC135627B7
                                                                                                                                                                    SHA-512:A9B25C3F87F0A40D40FCD3E6AE3213226D127DF658F1C30ACD5B812601A9634B9E6753154363C32781CB4190292B9D14398DE8ABF2F06D328CCE2EE5BAB4E87B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..[[o...s..NP ....4.e...&nk.sA.....,....%.u...3...J.s...Fm............<.T...O..@]..'R[z%..UA...D..w".."PnI......I...-.Q....B..<.L.7.......x...a..|O.\.Ln.&_../.G[z+5.=../}....~.\.>8%...G.H.....+..Z1..(. v.r8..\...g..#G..I....C...E8..L./@.c./..4..\.Y...M..Y.C.!.......yMC.o.w.....................|.2.5..O.JL....&X..M..1.1.Q^K=......s.JG.O.t .J...}..Q...#.k.........>..>.7.i...#..,y..7.k..0.."Wv5..=^J\...........#.@..M......D....(.A......r.&.`.....s.y]...<.n.EY6..$.........8E9.(g=..E)..e.=.......U...T./.p....>.$..(\..-p..|Py.|.7..:: .:.C..2.p.....K].k..%..W.>..}O.f...~.0W.?..:.K.h.R...Y.6..MhcT,..@......eg.?...O.&..hB......9.%..OS..K.C6...E.bs4..:5R...C.S..1.....Qq....-........t.|.I.P..M..C2...l..es.Hw.....y.MF....{..,....#u...$l.8G..:...U.F..|......!.s.v.....ch.....{.`.c..,.z.....k.O`X...G..e<(.c.BC..'.7...T....t0.E..z....t..r.......\pn..g..\..H2.^|.Ee..dgM.f|....v.$.A......q..../.m..c?w[L...~.`.2.-&k....i....du8...x...f..$hlw/.M~...

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.dat.new

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3638
                                                                                                                                                                    Entropy (8bit):7.93914241014023
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:iaY8fAijxOYrNPkgdXhNXhHuQWrkid8irCYvit4u1XHq+:THA6xOWNFjNRKZ5mf4MXK+
                                                                                                                                                                    MD5:FE87A7C81FD6B4F7301416031E33ACAE
                                                                                                                                                                    SHA1:23C890198AD064BFF70C142036630935FA9FD1CE
                                                                                                                                                                    SHA-256:52065CDEC045C9B27B9B3BF0F1488B92EA6CC9DB69ABED7F2F3870AC135627B7
                                                                                                                                                                    SHA-512:A9B25C3F87F0A40D40FCD3E6AE3213226D127DF658F1C30ACD5B812601A9634B9E6753154363C32781CB4190292B9D14398DE8ABF2F06D328CCE2EE5BAB4E87B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..[[o...s..NP ....4.e...&nk.sA.....,....%.u...3...J.s...Fm............<.T...O..@]..'R[z%..UA...D..w".."PnI......I...-.Q....B..<.L.7.......x...a..|O.\.Ln.&_../.G[z+5.=../}....~.\.>8%...G.H.....+..Z1..(. v.r8..\...g..#G..I....C...E8..L./@.c./..4..\.Y...M..Y.C.!.......yMC.o.w.....................|.2.5..O.JL....&X..M..1.1.Q^K=......s.JG.O.t .J...}..Q...#.k.........>..>.7.i...#..,y..7.k..0.."Wv5..=^J\...........#.@..M......D....(.A......r.&.`.....s.y]...<.n.EY6..$.........8E9.(g=..E)..e.=.......U...T./.p....>.$..(\..-p..|Py.|.7..:: .:.C..2.p.....K].k..%..W.>..}O.f...~.0W.?..:.K.h.R...Y.6..MhcT,..@......eg.?...O.&..hB......9.%..OS..K.C6...E.bs4..:5R...C.S..1.....Qq....-........t.|.I.P..M..C2...l..es.Hw.....y.MF....{..,....#u...$l.8G..:...U.F..|......!.s.v.....ch.....{.`.c..,.z.....k.O`X...G..e<(.c.BC..'.7...T....t0.E..z....t..r.......\pn..g..\..H2.^|.Ee..dgM.f|....v.$.A......q..../.m..c?w[L...~.`.2.-&k....i....du8...x...f..$hlw/.M~...

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8412616
                                                                                                                                                                    Entropy (8bit):7.671881593166912
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:196608:CmF9bfiCc1w5QoFgupFShmbuR7NYI1/Rry/05tf:xiw5Q7hX1/ck
                                                                                                                                                                    MD5:F8F6F1B4C6EAF6DCE71EB07B40ABE4D6
                                                                                                                                                                    SHA1:993B632E9E0612DA895FE0A337BD0444DEA9DFB2
                                                                                                                                                                    SHA-256:9F9F1BF2C289830BBD841B8E0F55D4042486DE09DF95B500AC3A53261DE54BF4
                                                                                                                                                                    SHA-512:7EBFCB25255ACD76BA0D7B297D45A70CBEE09B78152ECAE89393120A961B44B8E4D0AEE4D49A99CD7354842F0C9783A249F6C073F15DBA0EC7830916E0891E21
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]......................,..............0....@.......................... -...........@... .......................(.n.....(.0<...0)..................M....+..9........................... ).......................(..............................text...............................`.P`.data....G...0...H..................@.`..rdata...+.......,...b..............@.`@.eh_fram......#.......#.............@.0@.bss..........(.......................`..edata..n.....(......~(.............@.0@.idata..0<....(..>....(.............@.0..CRT..........).......(.............@.0..tls.... .... ).......(.............@.0..rsrc........0).......(.............@.0..reloc...9....+..:...n+.............@.0B........................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstbr.000

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8392654
                                                                                                                                                                    Entropy (8bit):7.670988470862948
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:196608:bmF9bfiCphWF0J0gupFShmbuR7fY91/Rry/05tfg:e7WF0lhc1/ckW
                                                                                                                                                                    MD5:8A2BD8B31C526C2A4C371A31A4431B91
                                                                                                                                                                    SHA1:FBF3B16E5DFEA6BEA58F2AB2825224AB75A8CA7E
                                                                                                                                                                    SHA-256:7AEF98C9BEDE2F8FC50A5BBAA2399D07D6F4476E74F9CF0D5BBCFE6B8BA8B4C6
                                                                                                                                                                    SHA-512:01C7EFD74D2342C60A12CFBE502C5BA912848F411D952793179CF4C3AED5F7CA88A9295979D45A14281C4AAB6CC600724F31F69573B061D9A765D432662E373C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]......................,..............0....@.......................... -......,....@... .......................(.n.....(.0<...0).............p)...*....+..9........................... ).......................(..............................text...............................`.P`.data....G...0...H..................@.`..rdata...+.......,...b..............@.`@.eh_fram......#.......#.............@.0@.bss..........(.......................`..edata..n.....(......~(.............@.0@.idata..0<....(..>....(.............@.0..CRT..........).......(.............@.0..tls.... .... ).......(.............@.0..rsrc........0).......(.............@.0..reloc...9....+..:...n+.............@.0B........................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):195512
                                                                                                                                                                    Entropy (8bit):6.66230192923419
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:8/4uZasR9jCsVKULaUVWp1zHjn+py4fKRvdn+DV7CM5x+5BMiV:izRR9jCs0ULaU29qfKRl+AMSnMiV
                                                                                                                                                                    MD5:220A3851CB9D5D1EDCDF6CA81DC9D465
                                                                                                                                                                    SHA1:C5830264C59E5E1C44CE05C75AAFAC5D6C2D7065
                                                                                                                                                                    SHA-256:841F31163C23B612E81D1CD7B3E2A4447FF7C2E2C48DF1F1607A3A60BA895CE9
                                                                                                                                                                    SHA-512:2FC7883428B6ACDD7597D3F11D2235B17B309572E5B1B7D2D325B790802D869AEB2D6C6D9C6070503ACF7E15F365921CD5772F921D1FEBDE2596C6FD5276071B
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T.`.T.`.T.`.]...S.`.]...M.`.]...G.`.T.a..`.].....`.]...U.`.]...U.`.RichT.`.................PE..L.....[J.................z...0.......5....................................................@...... ..........................Xw...........................M..............8...............................@...x........................................text....y.......z.................. ..`.data................~..............@....rsrc...............................@..@.reloc..............................@..B~.[J`.....[Jm.....[Jw.....[Jm...o.[J......[J......[J......[J....6.[J....-.[J......[Jm...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.msvcrt.dll.OLEAUT32.dll.ole32.dll.RPCRT4.dll.credui.dll.wevtapi.dll.........................................................................................................................................................................

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\download\curl-ca-bundle.crt (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):223687
                                                                                                                                                                    Entropy (8bit):6.002981710271201
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:6Nc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:6Ncf7M576f4tLe0mIM0
                                                                                                                                                                    MD5:FD7AC2FF5B13ACF3B48478A6DA989A50
                                                                                                                                                                    SHA1:D7952C26FFD211B9D717E26144CCA281223C1DFA
                                                                                                                                                                    SHA-256:726889705B00F736200ED7999F7A50021B8735D53228D679C4E6665AA3B44987
                                                                                                                                                                    SHA-512:741566DD9B9A9D1FA47CEB26FBB587602C45FC40AF2D0012527D0B2B9EAE799E6B3AB3A55E71A5A0CD8BC876E579CB6E3469801AF7B0D0FAC1917D44ED27B111
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Jun 24 03:12:10 2020 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.28..## SHA256: 5796295533cad5a648a20a115b0894dc9b318c41501796e7158e824c323f11c3.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\download\ninjarmm-curl-ca-bundle.crt (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):223687
                                                                                                                                                                    Entropy (8bit):6.002980959549091
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:XNc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:XNcf7M576f4tLe0mIM0
                                                                                                                                                                    MD5:C726AE88FD600AA26DF1D30F42B51FEC
                                                                                                                                                                    SHA1:0176D2FBCC41808B1B03B773145B2549953A8334
                                                                                                                                                                    SHA-256:ADF770DFD574A0D6026BFAA270CB6879B063957177A991D453FF1D302C02081F
                                                                                                                                                                    SHA-512:CC129AE1A4377A43A74B0854B6ECCB2B315CDFCE018142D1DD5524FB64C8945CDE067CB18F366351FA7D6AF3F9F36CF21BC1F626F987F9E4627878472EA59CDE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Jan 1 04:12:10 2020 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.27..## SHA256: f3bdcd74612952da8476a9d4147f50b29ad0710b7dd95b4c8690500209986d70.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\download\qt_temp.TnaEEk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):223687
                                                                                                                                                                    Entropy (8bit):6.002980959549091
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:XNc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:XNcf7M576f4tLe0mIM0
                                                                                                                                                                    MD5:C726AE88FD600AA26DF1D30F42B51FEC
                                                                                                                                                                    SHA1:0176D2FBCC41808B1B03B773145B2549953A8334
                                                                                                                                                                    SHA-256:ADF770DFD574A0D6026BFAA270CB6879B063957177A991D453FF1D302C02081F
                                                                                                                                                                    SHA-512:CC129AE1A4377A43A74B0854B6ECCB2B315CDFCE018142D1DD5524FB64C8945CDE067CB18F366351FA7D6AF3F9F36CF21BC1F626F987F9E4627878472EA59CDE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Jan 1 04:12:10 2020 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.27..## SHA256: f3bdcd74612952da8476a9d4147f50b29ad0710b7dd95b4c8690500209986d70.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\download\qt_temp.tAsokj

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):223687
                                                                                                                                                                    Entropy (8bit):6.002981710271201
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:6Nc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:6Ncf7M576f4tLe0mIM0
                                                                                                                                                                    MD5:FD7AC2FF5B13ACF3B48478A6DA989A50
                                                                                                                                                                    SHA1:D7952C26FFD211B9D717E26144CCA281223C1DFA
                                                                                                                                                                    SHA-256:726889705B00F736200ED7999F7A50021B8735D53228D679C4E6665AA3B44987
                                                                                                                                                                    SHA-512:741566DD9B9A9D1FA47CEB26FBB587602C45FC40AF2D0012527D0B2B9EAE799E6B3AB3A55E71A5A0CD8BC876E579CB6E3469801AF7B0D0FAC1917D44ED27B111
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Jun 24 03:12:10 2020 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.28..## SHA256: 5796295533cad5a648a20a115b0894dc9b318c41501796e7158e824c323f11c3.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\jsonoutput\_ws_agent_signal1734365064309-SECURE_AGENT_SETTINGS_READ_FAILURE.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):332
                                                                                                                                                                    Entropy (8bit):4.726977106565393
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:3FFkv1rRj11T8VD7MHSTfTJMA37ZKxLkUb7vWa7RZSez0TNgmxc:1mv1R11T88g/tKxbrHR7IN9c
                                                                                                                                                                    MD5:640AACF2A08429981A9B98C9A3CC6630
                                                                                                                                                                    SHA1:7A06E897BD3D566866A9EB6DDCF67C799A84D082
                                                                                                                                                                    SHA-256:BADADBCF5D1A7A1731580DBBC1EB49F403BB9E0FE21760FBAB54F68C2260ED61
                                                                                                                                                                    SHA-512:46312DC7692F1EADB9817500BF7C873AD21EF026B59A6C548955A4231F64CCC5AB35FF445CEFB78BEC79219ABBE27A6FE258A07607A6323C296C4BF80BA1C48B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "agentVersion": "",.. "patcherVersion": "",.. "machineId": "",.. "nodeId": "0",.. "divisionUid": "",.. "clientUid": "",.. "locationId": "",.. "signalTime": "2024-12-16T21:04:24Z",.. "code": "SECURE_AGENT_SETTINGS_READ_FAILURE",.. "count": "1",.. "message": "Failed to read for key AgentKey"..}..

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\jsonoutput\_ws_agent_signal1734365067247-AGENT_DATA_FAILURE_TO_CONNECT.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):499
                                                                                                                                                                    Entropy (8bit):5.179885227001702
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:1mv1s/11sx88g/yxyKobTIcwAIN3fgYXgld+SXLd:1C1011+2qxyFgJdTSR
                                                                                                                                                                    MD5:65981DC771B6479266B8AE2BC775625F
                                                                                                                                                                    SHA1:0DA2D1FE1B7F77661E0D538DBC04032EA3624C04
                                                                                                                                                                    SHA-256:DC70EC9BD17DB6AD59DAD9D701C5BCBA537EA01A98FA81B8190CBA7B2FD15C89
                                                                                                                                                                    SHA-512:1A11B5D7AE9A1E6B18C46A89FF6E826F96C05B10E65D664E443353CEF34DF189EFDE121A99BA955BF4715A069641E493B73D125681935CFA8A4F5A03AC176B3A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "agentVersion": "6.0.1901",.. "patcherVersion": "6.0.1901",.. "machineId": "",.. "nodeId": "0",.. "divisionUid": "",.. "clientUid": "b9f9065e-a247-47d1-859f-b52742e2b517",.. "locationId": "3",.. "signalTime": "2024-12-16T21:04:27Z",.. "code": "AGENT_DATA_FAILURE_TO_CONNECT",.. "count": "1",.. "message": "Failed to connect to https:\/\/resources.ninjarmm.com\/AgentInstallers\/cabarc_20230209.zip, errors: SSL peer certificate or SSH remote key was not OK"..}..

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\jsonoutput\_ws_agent_signal1734365072263-COMPONENT_DOWNLOAD_FAIL.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):524
                                                                                                                                                                    Entropy (8bit):5.17425853785269
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:1mv1s/11sx88g/yxyKob/CIueLlCXLf91kv:1C1011+2qxyFbdflALfbm
                                                                                                                                                                    MD5:D8B28CE3F6D1076FB17F3381967C065F
                                                                                                                                                                    SHA1:9C34177CF9E15D7704BE9FFD98B3C20FCAD01EFE
                                                                                                                                                                    SHA-256:149186A7BF927CCC3183DFB0286E0A9E245B1A80815B2C7AA6F1B51ED365F274
                                                                                                                                                                    SHA-512:47022C0F1E3210E18171E253AA685AA47D2F900531115DFED90039221F9DE1C43DD5893CC19A6BE8736B57BC9C081703CEFC3749206E4E34A211E7234490987D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "agentVersion": "6.0.1901",.. "patcherVersion": "6.0.1901",.. "machineId": "",.. "nodeId": "0",.. "divisionUid": "",.. "clientUid": "b9f9065e-a247-47d1-859f-b52742e2b517",.. "locationId": "3",.. "signalTime": "2024-12-16T21:04:32Z",.. "code": "COMPONENT_DOWNLOAD_FAIL",.. "count": "1",.. "message": "Component not found: cabarc NOT_FOUND Failed to find: C:\\Program Files (x86)\\wayneenterprisesbatcave-6.0.1901\\cabarc\\cabarc.exe, Error: The system cannot find the file specified"..}..

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\jsonoutput\_ws_agent_signal1734365072263-COMPONENT_FAILED_TO_DOWNLOAD_cabarc_20230209.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):421
                                                                                                                                                                    Entropy (8bit):5.076675797075533
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:3FFkv1sy+Rj11syY8VD7MHSTfTJMA37c2AxSA/MKxcHo8kUbFaGBpoojlVz0TNg8:1mv1s/11sx88g/yxyKobdpocltIN/n
                                                                                                                                                                    MD5:6AE61060640534FFE535552C02DAFDFE
                                                                                                                                                                    SHA1:1EA8D7924BB7F43AEA714AF8B9ABA58DE68C8E66
                                                                                                                                                                    SHA-256:9F3D9D2E63B3ED925E8FBF981D554AB3E3AFCE89762C9895AE43C6EDAE0BFE01
                                                                                                                                                                    SHA-512:54C70E52615E829E12A650446033C29EE6E07CE80F2117FF52E5D194D476F24F29593138C242C991D1994C51B559F2D2EAD86B64D4EB725BB8BB23B10637682B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "agentVersion": "6.0.1901",.. "patcherVersion": "6.0.1901",.. "machineId": "",.. "nodeId": "0",.. "divisionUid": "",.. "clientUid": "b9f9065e-a247-47d1-859f-b52742e2b517",.. "locationId": "3",.. "signalTime": "2024-12-16T21:04:32Z",.. "code": "COMPONENT_FAILED_TO_DOWNLOAD_cabarc_20230209",.. "count": "1",.. "message": "Failed to download component <cabarc>, version <20230209>"..}..

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\jsonoutput\_ws_agent_signal1734365076169-EMPTYSHA_ON_AGENT_UPGRADE.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):458
                                                                                                                                                                    Entropy (8bit):5.203107775815242
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:1mv1s/11sx88g/yxyKobbYoBISIrWCzmXOn:1C1011+2qxyF3YoBINrWCaXO
                                                                                                                                                                    MD5:E6A41E1CEFDD9E671AC8ED8BEEA5C052
                                                                                                                                                                    SHA1:2BE5B0821E640D9606C6A3E20B5E27D5AE7BEE20
                                                                                                                                                                    SHA-256:B2D4CB77E8B6E3C433925CA2CB2BE2F9F75B79E448FC512DF21EBC3AAC91186C
                                                                                                                                                                    SHA-512:FC8ED02C73ABD4EAE3DDFA894ECE2793F31530FE44ACCBFC80823BCFA8965B0CA444BA71B125C3972EE26A19BE41EDC5CEC3C4CF5DA7547188E1F788E8E81E9F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "agentVersion": "6.0.1901",.. "patcherVersion": "6.0.1901",.. "machineId": "",.. "nodeId": "0",.. "divisionUid": "",.. "clientUid": "b9f9065e-a247-47d1-859f-b52742e2b517",.. "locationId": "3",.. "signalTime": "2024-12-16T21:04:36Z",.. "code": "EMPTYSHA_ON_AGENT_UPGRADE",.. "count": "1",.. "message": "Download SKIPPED -> Please update component with sha value: C:\\ProgramData\\NinjaRMMAgent\\download\\patcher.cab"..}..

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\jsonoutput\_ws_agent_signal1734365114466-PATCHER_COMMUNICATIONS_ERROR.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):408
                                                                                                                                                                    Entropy (8bit):4.995309877308415
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:1mv1s/11sx88g/yxyKobo4rHEdI9RG9/8V:1C1011+2qxyFU4QWzGl8V
                                                                                                                                                                    MD5:0B207E7BF3CF26D9F297F139D78314C1
                                                                                                                                                                    SHA1:1DD5905E97CE6B96859F3573210D2D1C65A667D6
                                                                                                                                                                    SHA-256:7190EC1A463A0FA80C16AD15F211167B6E77518EF3B5E04A3EE6420CFB84F716
                                                                                                                                                                    SHA-512:3B7742ED4F77B7F0257B8E45409D211E45F5A6240078D59FF82EBE9F8245C65D2CF271982D7AC17D3A97871ACB07106C62D1316BB29970622D6B34E95B4B7E6E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "agentVersion": "6.0.1901",.. "patcherVersion": "6.0.1901",.. "machineId": "",.. "nodeId": "0",.. "divisionUid": "",.. "clientUid": "b9f9065e-a247-47d1-859f-b52742e2b517",.. "locationId": "3",.. "signalTime": "2024-12-16T21:05:14Z",.. "code": "PATCHER_COMMUNICATIONS_ERROR",.. "count": "1",.. "message": "Unable to establish connection with agent after 10 attempts."..}..

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\logs\NinjaRMMPatcher_20241216T16.04.23.0.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):26793
                                                                                                                                                                    Entropy (8bit):5.229779310980185
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:LEITlH6R1QFrn/t/n/CoFVW8oUAR9oUARAUYJ2GETp3oUAofoUAoQ+c:LEIMR1Irk6VkRiRlYJk6oQo3c
                                                                                                                                                                    MD5:CD3BE45452BF8CE79347A0C0F52BBE1B
                                                                                                                                                                    SHA1:787577CC4AF386671A7FD9B86103663A2A9FF232
                                                                                                                                                                    SHA-256:203FEAA2DF6454C3BD767CDC22BB91EED9EBF3565F3F5CAB36570DAE95637499
                                                                                                                                                                    SHA-512:5894AC820CA2597B3A4A7F187262CE7560D6E785D51113587EA32BDEA757FF1E681F82A3F0D9FA143D209A73D5DE12B4823E31416AA610EBF064355E644A63BB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:16:04:23.763 I :3340 [ WindowsTools.cpp:793] This process *is* running under WOW64..16:04:23.763 T :3340 [ NinjaRMMAgentPatcher.cpp:1391] Application data path : C:\ProgramData\NinjaRMMAgent..16:04:23.763 T :3340 [ NinjaRMMAgentPatcher.cpp:1423] Application data path : C:\ProgramData\NinjaRMMAgent..16:04:23.794 I :2280 [ NinjaRMMAgentPatcher.cpp:934] Started as SVC.....16:04:23.794 I :3228 [ NinjaRMMAgentPatcher.cpp:876] Will initialize QT library now...16:04:23.794 I :3228 [ qtstaticwrapper.cpp:1061] ===================================================..16:04:23.794 I :3228 [ qtstaticwrapper.cpp:1062] Starting initQtContextPatcher git-hash: [ "16fb63d11" ]..16:04:23.794 I :3228 [ qtstaticwrapper.cpp:1063] Log message handler initQtContextPatcher installed "C:\\ProgramData\\NinjaRMMAgent/logs"..16:04:23.794 I :3228 [ qtstaticwrapper.cpp:1064] params: "C:\\ProgramData\\NinjaRMMAgent"..1

                                                                                                                                                                    C:\ProgramData\NinjaRMMAgent\logs\NinjaRMMSignal_20241216T16.05.37.0.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10113
                                                                                                                                                                    Entropy (8bit):5.261154260270518
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:fnnZr8tosEbqkWFyxox4xxox4xwBgJyHox4xnox4xvBH:fytwlxoxoxoxowZHoxonoxovp
                                                                                                                                                                    MD5:D4A092F2A2133348B3F38CE73D0C983A
                                                                                                                                                                    SHA1:D3A0AFBAE50B94BDFB7AFEE11905D19B1B107484
                                                                                                                                                                    SHA-256:67FA359794FA3D1EDB08B9163CEFCAFDC31852C6637C25CBDD4EBF090C4D4F23
                                                                                                                                                                    SHA-512:48981875F0CE23C0A61418736B88DB7DF423AC6AFC7B563F0807C9731A1884CF155C12AFAE3FA81DF65405FBFEF2FFDAE3A7D1694D87BDAB5AA82EF29EB85114
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:16:05:37.713 I :7452 [ WindowsTools.cpp:793] This process *is* running under WOW64..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:112] Running with param : ..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:115] C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:115] /submitsignals..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:117] argc: 2..16:05:37.838 I :7452 [ NinjaRMMAgentMain.cpp:199] Agent service recovery options set: "sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//"..16:05:37.838 I :7452 [ ServerSettings.cpp:93] Installation token not found...16:05:37.838 I :7452 [ ServerSettings.cpp:157] Installation token not present..16:05:37.853 E :7452 [ ServerSettings.cpp:203] No InstallToken was present...16:05:37.853 I :7452 [ ServerSettings.cpp:206] ServerS

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR5C11.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44252
                                                                                                                                                                    Entropy (8bit):5.165403807127734
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:FkyXtmrxg+/7sL3p6ikKz2CsO35wOiyJRfg/JQeSSk2Hf:tXtqs7ppwFsRo/JQeSSkGf
                                                                                                                                                                    MD5:5070B5707881AB93E6A429134F27DDCC
                                                                                                                                                                    SHA1:AFF210DD38EC8DD89B70F35335E7F2676ECA9578
                                                                                                                                                                    SHA-256:8873C1926F4D0AA4A1660970300404C8000C563E12AE1A4388841718BA589AAC
                                                                                                                                                                    SHA-512:C430408B2F8782299D26AE07308EFC54A60A923F3739B5BC0C986E6C62F0FB99CA2B89ACD75B318C9A7B7213AECC7E38CF841A033646121A3793B635D2891148
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......].^..p.....&#.....2...Z......`........P.....b......................................@... .........................g.......L...................................................................................@................................text...`1.......2..................`.P`.data........P.......6..............@.`..rdata..p....`.......8..............@.0@.eh_fram8....p.......@..............@.0@.bss..................................0..edata..g............L..............@.0@.idata..L............N..............@.0..CRT.................V..............@.0..tls.... ............X..............@.0..reloc...............Z..............@.0B................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR5C8F.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):413276
                                                                                                                                                                    Entropy (8bit):6.543624302377151
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:qy3L0mgDcJ78LbJkOyVWWRT4KyQN5earARhMwZ1iooZfDZJHR9PWll7bt4:zg1BOI6uQNtqioo9D3TKft4
                                                                                                                                                                    MD5:A210F1AC135E5331C314CE5F394FB5A5
                                                                                                                                                                    SHA1:355AFC1C61E1F65834472B16A4CA718E61537DC2
                                                                                                                                                                    SHA-256:65B32EA2982078FB9A18E88FEEC238CB76ED2AE6C2BB4DDB0F6A9C4F57B1D62B
                                                                                                                                                                    SHA-512:E4E70EF75E2F7897837F6772B9A0DCAAF4515D8BE4210B28509F12CDDE9D85BD7BED604AD5A9EE587356971F75E6F79874DBDB974CEC4996262295E255501CF4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................Q.........................................................................................-.......Rich....................PE..L...-..J...........!.................................................................|...............................9..[...............X.................... ..x_...................................................................................text............................... ..`.rdata...Z.......\..................@..@.data........@.......&..............@....rsrc...X...........................@..@.reloc...a... ...b..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR5CFD.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):36633
                                                                                                                                                                    Entropy (8bit):5.172153856265245
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:i760QouLg/TgeoyZQ82FXRivC4yPTyNeOnEOqjLtKjIUZuVnrufvS0QOwOP2H:pxR1u9CpKVZuFBNOeH
                                                                                                                                                                    MD5:08AD4CD2A940379F1DCDBDB9884A1375
                                                                                                                                                                    SHA1:C302B7589BA4F05C6429E7F89AD0CB84DD9DFBAC
                                                                                                                                                                    SHA-256:78827E2B1EF0AAD4F8B1B42D0964064819AA22BFCD537EBAACB30D817EDC06D8
                                                                                                                                                                    SHA-512:F37BD071994C31B361090A149999E8B2D4A7839F19EA63E1D4563AADA1371BE37F2BFCC474E24DE95FF77CA4124A39580C9F711E2FBE54265713AB76F631835A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../UM.R.........#.....2...N...............P....hf.......................................... ........................./.......x...............................<....................................................................................text....0.......2..................`.P`.data........P.......6..............@.`..rdata.......`.......8..............@.`@.eh_fram.....p.......B..............@.0..bss....T.............................@..edata../............D..............@.0@.idata..x............F..............@.0..CRT.................J..............@.0..tls.... ............L..............@.0..reloc..<............N..............@.0B................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR5D2D.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):124037
                                                                                                                                                                    Entropy (8bit):5.9947168046986485
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:JISmH83Fqr7AZOZZjgKb1j2omuU4WnA8knNh/dP6lN:iZ83Mr7AZOZ19SnCh/MlN
                                                                                                                                                                    MD5:1A6CE03DDB5AA8885B9E7717262F39E4
                                                                                                                                                                    SHA1:209FFA14AD5E6416E0F0E91B1D605BD06B237182
                                                                                                                                                                    SHA-256:699F59CF2E6C8996A943F8FA1917609672661F3BC69B944B58D9D4BA0F5980B4
                                                                                                                                                                    SHA-512:2310302D6D6FF49F17DFD118F991154C0557AABC0E897DB0A6E1BFF92C01600F339480992D5F233AE4C45576DB0898F80179996367EF9C2D2CB504D9CCD58C3C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x..]...........#................`..............q................................,J........ .................................8...............................|.......................................................x............................text...H...........................`.P`.data...............................@.`..rdata....... ......................@.`@.eh_fram.2...@...4...,..............@.0@.bss..................................0..edata...............`..............@.0@.idata..8............p..............@.0..CRT.................t..............@.0..tls.... ............v..............@.0..reloc..|............x..............@.0B................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR5D8C.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):409600
                                                                                                                                                                    Entropy (8bit):6.4807474467356245
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:qZW3ZkG4zErXGmWkaHf77ym+fs7EWdRx35FFFyFFFFFFc7N+8:qCZFmESn/v9dz35FFFyFFFFFFc48
                                                                                                                                                                    MD5:027491B39A7B16B116E780F55ABC288E
                                                                                                                                                                    SHA1:62C0AB7C3E374D5FC9920983EE62BAA4421076B4
                                                                                                                                                                    SHA-256:EEF69D005BF1C0B715C8D6205400D4755C261DD38DDFBBFE918E6EE91F21F1F0
                                                                                                                                                                    SHA-512:FE0BA835D9AF2A2C297A545BB7E30D315B580273BB1F558F16D9CBA59755200A4735F75B1672E5E5FBED449EB7A5ABB6D905696674C181B742BF637028953194
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.......................~.......g...................?...................Rich....................PE..L...j'.?...........!.........................................................P......................................,..N....)..<...............................<F...................................................................................text............................... ..`.rdata..N...........................@..@.data...8....@.......@..............@....reloc...G.......P..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR5DBC.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):73728
                                                                                                                                                                    Entropy (8bit):5.514830994343325
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:bC4uF9R4GHnSiWo3xRFTo5THDMOBPw6s//vABzvBcdWlNK2nPpjCesWjcdgMLsZt:bCHQ5HDMK2ADBcd5esWjcdA1jQ5J
                                                                                                                                                                    MD5:C04970B55BCF614F24CA75B1DE641AE2
                                                                                                                                                                    SHA1:52B182CAEF513ED1C36F28EB45CEDB257FA8CE40
                                                                                                                                                                    SHA-256:5DDEE4AAB3CF33E505F52199D64809125B26DE04FB9970CA589CD8619C859D80
                                                                                                                                                                    SHA-512:A5F2660E336BF74A1936FB2E1C724220D862632907F5FD690B365009AC3E1BF35FA6689071F3DA4049E495F340FF83F8438B79079EF1F248B9DCAEDBDD5D3E40
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......HN.7./od./od./od..d./od..d./od..dV/od.X.d./od.X.d./od./nd\/od.X.d./od..ed./od..d./od..d./od..d./odRich./od........PE..L...k1.U...........!.........................................................p............@.............................].......<............................0......P...8...........................8...@............................................text............................... ..`.rdata..MR.......T..................@..@.data....,..........................@....reloc..D1...0...2..................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR60BA.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):14848
                                                                                                                                                                    Entropy (8bit):5.308233229877457
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:vLBvanDsGzcSu8M6fB+8yTzSJvwZ6Slp2sWOq9+moFelNtflD9Ndk:DBvCDsGzcSDMc+D6FxWR8wF6NP9k
                                                                                                                                                                    MD5:D74AADD701BFACC474C431ACAB7B9265
                                                                                                                                                                    SHA1:8A2B424D1F949430DDC1FADDEE3E9CCB79C95DE2
                                                                                                                                                                    SHA-256:F1029F5CCA3DABFEFFE2C9DB6AD84A9FF0F64F5B2FB85CB6AB348740F756E07D
                                                                                                                                                                    SHA-512:0EF85E311FB4843997FD5F87F0A2EEC9715E26EAE76BFB7BB701D8C043720AEAF7F4825D25187BF35E0A9F00DEF15ED071120128805445F1330C07C3E0EA5CED
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]...........#.........6...............0.....f.......................................... ......................`.......p..`...............................h....................................................p...............................text...............................`.P`.data...0....0......."..............@.0..rdata.......@.......$..............@.p@.bss....4....P........................p..edata.......`.......*..............@.0@.idata..`....p.......,..............@.0..CRT....,............2..............@.0..tls.... ............4..............@.0..reloc..h............6..............@.0B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR6261.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):76346
                                                                                                                                                                    Entropy (8bit):5.7696675612871084
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:f5eCnPrwdD7+HgVqoQKJ03cu9F/HTTuDNV3ILkjVSWTn1ytIddmV1TQW/2Y:f5eCMFqHgV1J03cu99HGRCS1yt73Qk
                                                                                                                                                                    MD5:924B90C3D9E645DFAD53F61EA4E91942
                                                                                                                                                                    SHA1:65D397199FF191E5078095036E49F08376F9AE4E
                                                                                                                                                                    SHA-256:41788435F245133EC5511111E2C5D52F7515E359876180067E0B5BA85C729322
                                                                                                                                                                    SHA-512:76833708828C8F3FAD941ABEEA158317AFF98CF0691B5D5DFA4BCA15279CDAD1CC23A771258E4DE41CF12A58F7033A3EE08B0B5EB834D22BE568EA98B183CCD9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......T....G......#................`..............f.........................@......J......... ................................. ............................0............................... ..........................t............................text...\...........................`.P`.data...............................@.`..rdata..............................@.0@.eh_fram............................@.0@.bss..................................0..edata..............................@.0@.idata.. ...........................@.0..CRT................................@.0..tls.... .... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BR6272.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):104775
                                                                                                                                                                    Entropy (8bit):5.920270611129003
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Bk2/NvkWxqoSZdelQBWFunEmdvo0p7ikHHDC8G1nMbmhgwRU3WMxdFtySA7JiexP:BvNsVoBtQv/p7LHDC8G1I3ndFtbANiC
                                                                                                                                                                    MD5:4953DAC33D0682334AD266EF1E9A118E
                                                                                                                                                                    SHA1:D069B2BDFF45A71A62238ACBD4AC4BB7C26AE691
                                                                                                                                                                    SHA-256:C2A44D761D1FE3B2D57C4DFF6E425667143EEC10A1C6FEE575AAD06CA5EA9ED2
                                                                                                                                                                    SHA-512:23B29A663D1EED045ABEF1D04B0AC3BA9C239DAF95BAD955433E16CFA37E44A66F5946DC8ADFBEE1FAE1E9AD8F7A33C860EAC41E228019127D995B57E8C23288
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8..].@.........#.........<......`..............g.................................6........ ......................`..s....p.......................................................................................p...............................text...(...........................`.P`.data...............................@.`..rdata..............................@.0@.eh_fram(/... ...0..................@.0@.bss.........P........................0..edata..s....`.......&..............@.0@.idata.......p.......(..............@.0..CRT.................,..............@.0..tls.... ...........................@.0..reloc...............0..............@.0B................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files.cab

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 50562336 bytes, 1 file, at 0x2c +A "9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe", ID 37645, number 1, 1543 datablocks, 0 compression
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):50562336
                                                                                                                                                                    Entropy (8bit):7.981471461981805
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:786432:L4CqSyu7eI4K2jDQiLS8OW70qt7V6UemjopgfTohDDe5m8lYbIjIz2:Ln9I9bOs0aemjoGsfQ
                                                                                                                                                                    MD5:7A7158E332AABA1B7999DC41C277908F
                                                                                                                                                                    SHA1:4D5E76384C09C6D7B1D0E5E846317F1A48DB8E41
                                                                                                                                                                    SHA-256:C8C107A8C6ED3FF140F37EB08CE18104D691D44591CE35EC5F278F60A1B32F2E
                                                                                                                                                                    SHA-512:96F6B8C090C06AB816913BACAA4E91F90BED874E976A63F01C9EFF934D666D7DE5B5563D89250A16A69D79A8D9E6A58FB92916603969C5E54B527CF0072B2FC6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MSCF.... .......,...........................PT.........Yg. .9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe.Y..8....MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]......................,..............0....@.......................... -......,....@... .......................(.n.....(.0<...0).............p)...*....+..9........................... ).......................(..............................text...............................`.P`.data....G...0...H..................@.`..rdata...+.......,...b..............@.`@.eh_fram......#.......#.............@.0@.bss..........(.......................`..edata..n.....(......~(.............@.0@.idata..0<....(..>....(.............@.0..CRT..........).......(.............@.0..tls.... .... ).......(.............@.0..rsrc........0).......(.............@.0..reloc...9....+..:...n+.............@.0B........................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\98e57900ed61450c822e14ae7358386b$dpx$.tmp\bcd0a7e679ee9d4687e219fbd06d47de.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\expand.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):50549840
                                                                                                                                                                    Entropy (8bit):7.981576671045445
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:786432:VyC2SaG2N5CVebuZvr27jlhnpTr/9H9VuswKiDmSLisEF/SDGeghQs:V9Bn9wj7nL9VusM5mT
                                                                                                                                                                    MD5:052FAC3E3810002C4B43648FD86C328B
                                                                                                                                                                    SHA1:50F11D8DEF948E495D151A6E0ED2E455809C40C2
                                                                                                                                                                    SHA-256:7624245C57918E1A5102401BA5289DDC03E3B0DAE7041775FEEC7DA6969DE0CD
                                                                                                                                                                    SHA-512:2FFEF969E6C0E8FA6DF5BF55895CF6080C7B4CEC6ACFE1721FFFF205C33AEB7F98099A773F4BAECB1AE03D027C495AB2712C4E1EF359E0831259D542625DB9ED
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]......................,..............0....@.......................... -......,....@... .......................(.n.....(.0<...0).............p)...*....+..9........................... ).......................(..............................text...............................`.P`.data....G...0...H..................@.`..rdata...+.......,...b..............@.`@.eh_fram......#.......#.............@.0@.bss..........(.......................`..edata..n.....(......~(.............@.0@.idata..0<....(..>....(.............@.0..CRT..........).......(.............@.0..tls.... .... ).......(.............@.0..rsrc........0).......(.............@.0..reloc...9....+..:...n+.............@.0B........................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\expand.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):50549840
                                                                                                                                                                    Entropy (8bit):7.981576671045445
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:786432:VyC2SaG2N5CVebuZvr27jlhnpTr/9H9VuswKiDmSLisEF/SDGeghQs:V9Bn9wj7nL9VusM5mT
                                                                                                                                                                    MD5:052FAC3E3810002C4B43648FD86C328B
                                                                                                                                                                    SHA1:50F11D8DEF948E495D151A6E0ED2E455809C40C2
                                                                                                                                                                    SHA-256:7624245C57918E1A5102401BA5289DDC03E3B0DAE7041775FEEC7DA6969DE0CD
                                                                                                                                                                    SHA-512:2FFEF969E6C0E8FA6DF5BF55895CF6080C7B4CEC6ACFE1721FFFF205C33AEB7F98099A773F4BAECB1AE03D027C495AB2712C4E1EF359E0831259D542625DB9ED
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]......................,..............0....@.......................... -......,....@... .......................(.n.....(.0<...0).............p)...*....+..9........................... ).......................(..............................text...............................`.P`.data....G...0...H..................@.`..rdata...+.......,...b..............@.`@.eh_fram......#.......#.............@.0@.bss..........(.......................`..edata..n.....(......~(.............@.0@.idata..0<....(..>....(.............@.0..CRT..........).......(.............@.0..tls.... .... ).......(.............@.0..rsrc........0).......(.............@.0..reloc...9....+..:...n+.............@.0B........................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\msiwrapper.ini

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1816
                                                                                                                                                                    Entropy (8bit):3.650625833779434
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:BflQDKRziP8UbJFEkSHBrkSHBVykSHBVKRPmtv:Cgas3HN3HTy3HTga
                                                                                                                                                                    MD5:65976EF0CA8C565EC7F32F8F53F89B0F
                                                                                                                                                                    SHA1:E0ED5EB2ABE67B0653A224801D1367B6DEC4422E
                                                                                                                                                                    SHA-256:EF17449869FB7376D8B57AA55156D624569ECDE62977705C19BBED945E6AC4F0
                                                                                                                                                                    SHA-512:DA4A31376C189D52331B803C25A952CFE4652EBBF0AE1E1D7A2143577A8B32F6A2FC76680B9BBC2DA788123AE2AE5CAE8B397D46E7DBCDB68BDCBF5E2A34690C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:W.r.a.p.p.e.d.A.p.p.l.i.c.a.t.i.o.n.I.d.=.N.i.n.j.a.R.M.M.A.g.e.n.t. .6...0...1.9.0.1...W.r.a.p.p.e.d.R.e.g.i.s.t.r.a.t.i.o.n.=.V.i.s.i.b.l.e...I.n.s.t.a.l.l.S.u.c.c.e.s.s.C.o.d.e.s.=.0...E.l.e.v.a.t.i.o.n.M.o.d.e.=.a.l.w.a.y.s...B.a.s.e.N.a.m.e.=.9.b.2.f.5.e.d.9.-.e.a.1.2.-.4.6.9.a.-.a.7.0.d.-.8.f.c.1.7.e.8.d.6.2.5.2.-.w.a.y.n.e.e.n.t.e.r.p.r.i.s.e.s.b.a.t.c.a.v.e.-.6...0...1.9.0.1.-.w.i.n.d.o.w.s.-.i.n.s.t.a.l.l.e.r...e.x.e...C.a.b.H.a.s.h.=.c.8.c.1.0.7.a.8.c.6.e.d.3.f.f.1.4.0.f.3.7.e.b.0.8.c.e.1.8.1.0.4.d.6.9.1.d.4.4.5.9.1.c.e.3.5.e.c.5.f.2.7.8.f.6.0.a.1.b.3.2.f.2.e...S.e.t.u.p.P.a.r.a.m.e.t.e.r.s.=.-.-.m.o.d.e. .u.n.a.t.t.e.n.d.e.d. ...W.o.r.k.i.n.g.D.i.r.=...C.u.r.r.e.n.t.D.i.r.=.*.S.O.U.R.C.E.D.I.R.*...U.I.L.e.v.e.l.=.5...F.o.c.u.s.=.y.e.s...S.e.s.s.i.o.n.D.i.r.=.C.:.\.U.s.e.r.s.\.M.a.o.g.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.6.8.d.3.1.a.f.7.-.1.d.0.4.-.4.b.e.1.-.b.b.c.e.-.e.e.7.f.4.f.6.9.d.c.3.7.\...F.i.l.e.s.D.i.r.=.C.:.\.U.s.e.r.s.\.M.a.o.g.a.\.A.p.p.D.a.t.a.\.L.o.c.

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\bitrock_installer.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1221
                                                                                                                                                                    Entropy (8bit):5.100741541806634
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:4QGQjR1Rq2ye2y8PSEaLZ13SEaLZYSEaLxsSEaLXSEaL6SEaLRSEaLKSEaLWSEav:4Q5tbq2ye2yqSEaL33SEaLmSEaLGSEaR
                                                                                                                                                                    MD5:51C1E2044BF7CD4A81DFEB53201624EA
                                                                                                                                                                    SHA1:27F9F44A574BF61EC68D95E2143EE34106E3DD87
                                                                                                                                                                    SHA-256:7D28F6DC31FBDD284F5986A0B1A5BAFC3240B00B9082EB9578C4768D15A8B2FB
                                                                                                                                                                    SHA-512:66EEB2BF774A4A567B689EC56477C980B24E5CC72945F4398C614F4565D57A941EF2D857DAD8372E0719BBF2BD47B438AB2C1B41A664DBE6DFBD2713445EA2A9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Log started 12/16/2024 at 16:04:18..Preferred installation mode : unattended..Trying to init installer in mode unattended..Mode unattended successfully initialized..Preparing to Install..Preparing to Install..Creating directory C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901..Unpacking files..Directory already exists: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901..Unpacking files..Unpacking C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\CabArc.Exe..Unpacking C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl-ca-bundle.crt..Unpacking C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\wevtutil.exe..Unpacking C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe..Unpacking C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe..Unpacking C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\curl.exe..Unpacking C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\uninstall-ninja.exe..Creating Short

                                                                                                                                                                    C:\Windows\Installer\751f56.msi

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: NinjaRMMAgent 6.0.1901.0, Subject: NinjaRMMAgent, Author: NinjaRMM LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {BE5BC90A-C0C2-470D-896F-DE49F6B76428}, Create Time/Date: Sat Jul 23 13:01:26 2022, Last Saved Time/Date: Sat Jul 23 13:01:26 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: MSI Wrapper (10.0.51.0), Security: 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):50941952
                                                                                                                                                                    Entropy (8bit):7.977470072044354
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:786432:94CqSyu7eI4K2jDQiLS8OW70qt7V6UemjopgfTohDDe5m8lYbIjIz:9n9I9bOs0aemjoGsf
                                                                                                                                                                    MD5:94775BDD3EA65962B24D52F96722F53B
                                                                                                                                                                    SHA1:212DC94EC338BA797F3E04325F5F9DC713C04906
                                                                                                                                                                    SHA-256:D991471121F9A1F3AA829A26E0DFC3E4BB7E0EC723650CC6BA32A6BD5E13F302
                                                                                                                                                                    SHA-512:DB51CC087A804538A9C87EDB54C2006D4FC3B03E7CA565E2180EB3D5B84CD7C10FA3B86BBF861E61DC400D50F45040BF6EB63EBC81BDD9484920FFD0BCF8B52D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>.......................................................L...M...N...O...P...Q...R...S...T...U...V...W...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\751f58.msi

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: NinjaRMMAgent 6.0.1901.0, Subject: NinjaRMMAgent, Author: NinjaRMM LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {BE5BC90A-C0C2-470D-896F-DE49F6B76428}, Create Time/Date: Sat Jul 23 13:01:26 2022, Last Saved Time/Date: Sat Jul 23 13:01:26 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: MSI Wrapper (10.0.51.0), Security: 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):50941952
                                                                                                                                                                    Entropy (8bit):7.977470072044354
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:786432:94CqSyu7eI4K2jDQiLS8OW70qt7V6UemjopgfTohDDe5m8lYbIjIz:9n9I9bOs0aemjoGsf
                                                                                                                                                                    MD5:94775BDD3EA65962B24D52F96722F53B
                                                                                                                                                                    SHA1:212DC94EC338BA797F3E04325F5F9DC713C04906
                                                                                                                                                                    SHA-256:D991471121F9A1F3AA829A26E0DFC3E4BB7E0EC723650CC6BA32A6BD5E13F302
                                                                                                                                                                    SHA-512:DB51CC087A804538A9C87EDB54C2006D4FC3B03E7CA565E2180EB3D5B84CD7C10FA3B86BBF861E61DC400D50F45040BF6EB63EBC81BDD9484920FFD0BCF8B52D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>.......................................................L...M...N...O...P...Q...R...S...T...U...V...W...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\MSI2F73.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):493393
                                                                                                                                                                    Entropy (8bit):6.577841596083506
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:ctJRQ+gjpjegGdo8ZtJRQ+gjpjegGdo8oBt:ctBcpVGPZtBcpVGPSt
                                                                                                                                                                    MD5:91847BC2205CD648F0A4ACC05ED18F17
                                                                                                                                                                    SHA1:A5A82855C2E0820B40FAEAD4F6BB5CF027E28BEE
                                                                                                                                                                    SHA-256:8FD260EB85CC14EAA8A35BAF39985222AB3E159455E307F47580D22B8C5F4042
                                                                                                                                                                    SHA-512:5AB8889BF74C72CD6A25B49976C6EBBAB2D3549929ADE10E0C4688E4A97DB325501CCA9E8328497918DAC211F81C9F5FB9A4C04593B89409C6E5B12CC1A539D2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{A212FB01-63C8-4065-96B1-E0A632039A36}..NinjaRMMAgent6.wayneenterprisesbatcave-6.0.1901-windows-installer.msi.@.....@m....@.....@......ProductIcon..&.{BE5BC90A-C0C2-470D-896F-DE49F6B76428}.....@.....@.....@.....@.......@.....@.....@.......@......NinjaRMMAgent......Rollback..Rolling back action: [1]....RollbackCleanup..Removing backup files File: [1].....@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}N.02:\SOFTWARE\EXEMSI.COM\MSI Wrapper\Installed\NinjaRMMAgent 6.0.1901\LogonUser.@.......@.....@.....@........bz.LateInstallFinish1....J...bz.LateInstallFinish1.@.......@..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......b...........!.....h..........K

                                                                                                                                                                    C:\Windows\Installer\MSI2F74.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):212992
                                                                                                                                                                    Entropy (8bit):6.5134888693588575
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
                                                                                                                                                                    MD5:D82B3FB861129C5D71F0CD2874F97216
                                                                                                                                                                    SHA1:F3FE341D79224126E950D2691D574D147102B18D
                                                                                                                                                                    SHA-256:107B32C5B789BE9893F24D5BFE22633D25B7A3CAE80082EF37B30E056869CC5C
                                                                                                                                                                    SHA-512:244B7675E70AB12AA5776F26E30577268573B725D0F145BFC6B848D2BD8F014C9C6EAB0FC0E4F0A574ED9CA1D230B2094DD88A2146EF0A6DB70DBD815F9A5F5B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......b...........!.....h..........K...............................................{*....@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\MSI47EF.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):212992
                                                                                                                                                                    Entropy (8bit):6.5134888693588575
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
                                                                                                                                                                    MD5:D82B3FB861129C5D71F0CD2874F97216
                                                                                                                                                                    SHA1:F3FE341D79224126E950D2691D574D147102B18D
                                                                                                                                                                    SHA-256:107B32C5B789BE9893F24D5BFE22633D25B7A3CAE80082EF37B30E056869CC5C
                                                                                                                                                                    SHA-512:244B7675E70AB12AA5776F26E30577268573B725D0F145BFC6B848D2BD8F014C9C6EAB0FC0E4F0A574ED9CA1D230B2094DD88A2146EF0A6DB70DBD815F9A5F5B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......b...........!.....h..........K...............................................{*....@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\MSI970A.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):212992
                                                                                                                                                                    Entropy (8bit):6.5134888693588575
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
                                                                                                                                                                    MD5:D82B3FB861129C5D71F0CD2874F97216
                                                                                                                                                                    SHA1:F3FE341D79224126E950D2691D574D147102B18D
                                                                                                                                                                    SHA-256:107B32C5B789BE9893F24D5BFE22633D25B7A3CAE80082EF37B30E056869CC5C
                                                                                                                                                                    SHA-512:244B7675E70AB12AA5776F26E30577268573B725D0F145BFC6B848D2BD8F014C9C6EAB0FC0E4F0A574ED9CA1D230B2094DD88A2146EF0A6DB70DBD815F9A5F5B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......b...........!.....h..........K...............................................{*....@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\MSI9C1B.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):212992
                                                                                                                                                                    Entropy (8bit):6.5134888693588575
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
                                                                                                                                                                    MD5:D82B3FB861129C5D71F0CD2874F97216
                                                                                                                                                                    SHA1:F3FE341D79224126E950D2691D574D147102B18D
                                                                                                                                                                    SHA-256:107B32C5B789BE9893F24D5BFE22633D25B7A3CAE80082EF37B30E056869CC5C
                                                                                                                                                                    SHA-512:244B7675E70AB12AA5776F26E30577268573B725D0F145BFC6B848D2BD8F014C9C6EAB0FC0E4F0A574ED9CA1D230B2094DD88A2146EF0A6DB70DBD815F9A5F5B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......b...........!.....h..........K...............................................{*....@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\SourceHash{A212FB01-63C8-4065-96B1-E0A632039A36}

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.1912192741805747
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:JSbX72FjzVXAlfLIlHmRpxh+7777777777777777777777777ZDHF7OVRbbJXLvs:JDUIYEAvbRLDJHF
                                                                                                                                                                    MD5:8569BED372108C41A88FC61CC1C8CB02
                                                                                                                                                                    SHA1:33C2A4278075D45B504CC1BA1446D85B749AC49D
                                                                                                                                                                    SHA-256:EC8952C22800467D7046723713D374FD8A047136C024FE8E4199B3A32D838278
                                                                                                                                                                    SHA-512:ACA994EAB3BDDA867552574712FC207FF3A73AF29DB229F23B6C0CDAD8488762ABC9ECE30A35100420D67B30BD43079F50C636501C80C38C17EC7EE3A15409BC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.524858196192902
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:w8PhBuRc06WX4EjT5ulJuddS+ubZwrk2ddSBJkrLE:fhB10jTElJ0TaZP8qJi
                                                                                                                                                                    MD5:A1CF390234625A875257E60573DAAAC3
                                                                                                                                                                    SHA1:2FA242DC2086876A2932CA629324A15F40869F6E
                                                                                                                                                                    SHA-256:DDD466F2D9A369D87062A29113E434FB1902E33E801D2409C3AF5C6FCB0A7BC6
                                                                                                                                                                    SHA-512:35BA91FD940ABAA3230E5C1B51229069503C2314C0AA4A60DDEA19114AD340DC13ECEAA002D2EEA30FD2BF1E3B746BC9ECBE0B4112B2EAE5BAB5866A807E5027
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\{A212FB01-63C8-4065-96B1-E0A632039A36}\ProductIcon

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 64x64, 32 bits/pixel
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):65348
                                                                                                                                                                    Entropy (8bit):6.379414300731785
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:tSZV05DO+kvvd3HIN3bQ2b3gQlZQiXj6m9vNgk5LuNrGhNIc+uNW:sI5OVvvdY7b31lZQEem9Sk5LSrGh+c0
                                                                                                                                                                    MD5:A5ABE9F389AED709B61A5242533C5F1D
                                                                                                                                                                    SHA1:EE231CFC9C351CE52F9A37C22FF00DE96F32EBE3
                                                                                                                                                                    SHA-256:F156F3F4CA629B9E1126CA64A4D2FAA8A6C8460E600FC698682D84AEE5F9BA4E
                                                                                                                                                                    SHA-512:E29FC5E15AD3185FAF6534530079E1D9BA28E65BFBEE25EB5041FF8E608277F2FA9E3A6A09DE3D85611C414FE9D203614138D7568D142A7BDD01E658D6456F5B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:............ ..X..v...@@.... .(B..&Y..00.... ..%..N......... ......... .... ............... .....T...........h........PNG........IHDR.............\r.f.. .IDATx..y.-WY'.{W....}..2A.!@B..&.....".C.ii....(.b#..2K.`...6..O.....Z.#.E@.S"C7D...N.po.{....U..?j.Uo..Z....I.w.swU..U...U@..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E..-Z.h.E...U."...O8.....w....v......y.....f.s.t.@..p....c........n..bv.....o..v~....1J...n.....S2...s.....R7..Y.$..:..$...7.K...O\....b6...n./......Egv....Rs.E8.Z:..N.t.@@..I.!........k...l..W.....C......j13Z.p.......<.............4.!..lc.={..v:.Y:..E..j.....Y^2X]O?q....g^..]..bk..........rF.>.u..2{...D....=.D.`.k..Yf1N-R..R...P.&..2..R......_}.9?.5.-....V..A.x..{..{Q.=;.t~.....O..o...1...WO-l.X..>x.}Z..g.3X...p.g^....c..A+...._..S.}tVl..Qb/ .. .k...D....z..i.1..1..B@..TS......X../8...u...*....<.D......./.6-.V.,.>.....?#..s..9.....aq.2tZ.KQ...8.H...>/...e9...........O~x+..)\.....

                                                                                                                                                                    C:\Windows\Logs\DPX\setupact.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\expand.exe
                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):13860945
                                                                                                                                                                    Entropy (8bit):5.1140735085912885
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:AgfxNj1/VLRTFP8GYoism8ynpJkWZfVj6QTTB7:4
                                                                                                                                                                    MD5:C4BFE4455DE33CE2B270EEF19458541C
                                                                                                                                                                    SHA1:499C678FF953B42A997134478F8980BA9D3F2F0C
                                                                                                                                                                    SHA-256:6132D3E70793238F8771A11AD141E4F6F4840D765DC1FD14A18E8CAC665BFFC8
                                                                                                                                                                    SHA-512:6C270A9EAC2E2CB19C599A085375C0373FC0F5D62F4351E21FE54EB986411F75FD5390B0DE64F753FC6D7C441451B3D22FD8C024E5A2C6F6B3CC3901D3D15D07
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.2024-12-09 19:23:54, Info DPX Started DPX phase: Resume and Download Job..2024-12-09 19:23:54, Info DPX Started DPX phase: Apply Deltas Provided In File..2024-12-09 19:23:54, Info DPX Ended DPX phase: Apply Deltas Provided In File..2024-12-09 19:23:54, Info DPX Started DPX phase: Apply Deltas Provided In File..2024-12-09 19:23:54, Info DPX Ended DPX phase: Apply Deltas Provided In File..2024-12-09 19:23:54, Info DPX CJob::Resume completed with status: 0x0..2024-12-09 19:23:54, Info DPX Ended DPX phase: Resume and Download Job..2024-12-09 19:23:56, Info DPX Started DPX phase: Resume and Download Job..2024-12-09 19:23:56, Info DPX Started DPX phase: Apply Deltas Provided In File..2024-12-09 19:23:56, Info DPX Ended DPX phase: Apply Deltas Provided In File..2024-12-09 19:23:56, Info

                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):455581
                                                                                                                                                                    Entropy (8bit):5.381756767894112
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:CpI1rhwukl2UFY+ikDR9KjVWHq+BqLBOhajc9ijF2JtsxcBS1J3BM0Aa+iVbwebJ:DKboSBG
                                                                                                                                                                    MD5:5265FE2D623E63A4798F68BC76243658
                                                                                                                                                                    SHA1:750BD39032D45E2B957F16726B1B72B7F35F1B2F
                                                                                                                                                                    SHA-256:8026C53BF46CEF483B5EEB3E5619F5D5CC6B4451445B8AA58B4350CF735E7AD3
                                                                                                                                                                    SHA-512:5430ED1A585676B72D611258D61C87D615D8BE6A3CF8529A99B6D516608175CBC57CC9C6A19B7A68AA76AE0F1862B8B9618E574DA9C43131F2B7B4D80A05A435
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..05/07/2022 07:40:26.485 [3724]: Command line: D:\wd\compilerTemp\BMT.ijbjbjy2.cay\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..05/07/2022 07:40:26.516 [3724]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..05/07/2022 07:40:26.547 [3724]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..05/07/2022 07:40:26.547 [3724]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..05/07/2022 07:40:26.547 [

                                                                                                                                                                    C:\Windows\SysWOW64\_ws_agent_signal1734365137853-SECURE_AGENT_SETTINGS_READ_FAILURE.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):332
                                                                                                                                                                    Entropy (8bit):4.752171467940694
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:3FFkv1rRj11T8VD7MHSTfTJMA37ZKxLkUbP/a7RZSez0TNgmxc:1mv1R11T88g/tKxbAR7IN9c
                                                                                                                                                                    MD5:D0A724D274DFE90E3D61F6ECE9F81BBC
                                                                                                                                                                    SHA1:180473DBF956EDAAF75EDCA5F8103CB5D074A6F3
                                                                                                                                                                    SHA-256:90C4E4A94346572DCE7DCBF8CD66D5D6D58DB65AD2976042C3F43727186D965C
                                                                                                                                                                    SHA-512:DAD34E6739C6C0F82C40502A3C08924691BDD34B0394576E5B25AAC2C0D9E2DD4066E119BC4693EC7BE3C911BCC0A4082B53894B84071FBD51EAFC46220E0428
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "agentVersion": "",.. "patcherVersion": "",.. "machineId": "",.. "nodeId": "0",.. "divisionUid": "",.. "clientUid": "",.. "locationId": "",.. "signalTime": "2024-12-16T21:05:37Z",.. "code": "SECURE_AGENT_SETTINGS_READ_FAILURE",.. "count": "1",.. "message": "Failed to read for key AgentKey"..}..

                                                                                                                                                                    C:\Windows\SystemTemp\~DF010D0E514601D174.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\SystemTemp\~DF15A98251FB139E47.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):69632
                                                                                                                                                                    Entropy (8bit):0.1271116695094645
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:x+X8DVMJfAebfddipV7JWddipVguVJWwG6Ulrkg9SXQB+9wTwI8P:EuMrfddSBJWddS+ubZwrk8wl
                                                                                                                                                                    MD5:CA8879DE23E4456393ECF281976B0A32
                                                                                                                                                                    SHA1:3B8BA18391783A145F24B9CD2D0B273420A90421
                                                                                                                                                                    SHA-256:BCF1478A92014BECA731F6DE85883D4714C701CDDEB774EAF9309AF3A8161F44
                                                                                                                                                                    SHA-512:FC8119A0591F8DB9276D956F678BF9F1F4E95AC92EBE6CA8C241A54539A33E17DC08C487260DC05078DAEB9FE31FF5305787A0820B0A4F4E7A8846D090BAC11F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\SystemTemp\~DF68FA05FFD6175809.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.08776083599299256
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKO7Xf2G2RbXL5WQlXLhFTXLIAVky6le:2F0i8n0itFzDHF7OVRbbJXLvTXOe
                                                                                                                                                                    MD5:3A16AC958C6B00928025443D37CC0267
                                                                                                                                                                    SHA1:D2EABBE6ADBBD8EF60A41DED2DE82CA00C9D805A
                                                                                                                                                                    SHA-256:8B54803DE3B64106A46EA370DAD612C4C1C3C762A373D09DA7486CB775B0F2DD
                                                                                                                                                                    SHA-512:CF9255E75D5787F87C32A49B0BFD41791B843BFCF5BDF24355B90DCAD4AD4267E81EC053D31E7536E1249B4C764A0B3AD84597D0607A3DC592E1C7C48B994176
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\SystemTemp\~DF90C0125B1508BFB3.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.524858196192902
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:w8PhBuRc06WX4EjT5ulJuddS+ubZwrk2ddSBJkrLE:fhB10jTElJ0TaZP8qJi
                                                                                                                                                                    MD5:A1CF390234625A875257E60573DAAAC3
                                                                                                                                                                    SHA1:2FA242DC2086876A2932CA629324A15F40869F6E
                                                                                                                                                                    SHA-256:DDD466F2D9A369D87062A29113E434FB1902E33E801D2409C3AF5C6FCB0A7BC6
                                                                                                                                                                    SHA-512:35BA91FD940ABAA3230E5C1B51229069503C2314C0AA4A60DDEA19114AD340DC13ECEAA002D2EEA30FD2BF1E3B746BC9ECBE0B4112B2EAE5BAB5866A807E5027
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\fb11-a6b1-cb4a-0857

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:d:d
                                                                                                                                                                    MD5:9DD4E461268C8034F5C8564E155C67A6
                                                                                                                                                                    SHA1:11F6AD8EC52A2984ABAAFD7C3B516503785C2072
                                                                                                                                                                    SHA-256:2D711642B726B04401627CA9FBAC32F5C8530FB1903CC4DB02258717921A4881
                                                                                                                                                                    SHA-512:A4ABD4448C49562D828115D13A1FCCEA927F52B4D5459297F8B43E42DA89238BC13626E43DCB38DDB082488927EC904FB42057443983E88585179D50551AFE62
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:x

                                                                                                                                                                    C:\Windows\Temp\~DF20C9A2319034F0D5.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF243965F287662D3B.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):1.222762526474746
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Pa5utI+xFX4fT5HlJuddS+ubZwrk2ddSBJkrLE:y5g8TplJ0TaZP8qJi
                                                                                                                                                                    MD5:A80D87F6C51EC34438E66255DCD41827
                                                                                                                                                                    SHA1:BA16EAF2FA82AE6DFF7885F92CAC16CD560D3EBF
                                                                                                                                                                    SHA-256:0C0837FD71EF42CBA31BB5B98227A31B276590C92440A0DB377B77B5A2CD83A6
                                                                                                                                                                    SHA-512:559771E3C6992DC76C02B8BC33EFD66F8B03790D5BC1E3295809BEB47E8662A3E6B6536774CF248517E9295397CB994D2FD179CAAA73F807E571E3A68704850E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF6EA6EC5F3071162B.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.524858196192902
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:w8PhBuRc06WX4EjT5ulJuddS+ubZwrk2ddSBJkrLE:fhB10jTElJ0TaZP8qJi
                                                                                                                                                                    MD5:A1CF390234625A875257E60573DAAAC3
                                                                                                                                                                    SHA1:2FA242DC2086876A2932CA629324A15F40869F6E
                                                                                                                                                                    SHA-256:DDD466F2D9A369D87062A29113E434FB1902E33E801D2409C3AF5C6FCB0A7BC6
                                                                                                                                                                    SHA-512:35BA91FD940ABAA3230E5C1B51229069503C2314C0AA4A60DDEA19114AD340DC13ECEAA002D2EEA30FD2BF1E3B746BC9ECBE0B4112B2EAE5BAB5866A807E5027
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF8B297BB1A561C62E.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF94D7EF8F0C0345B4.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):1.222762526474746
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Pa5utI+xFX4fT5HlJuddS+ubZwrk2ddSBJkrLE:y5g8TplJ0TaZP8qJi
                                                                                                                                                                    MD5:A80D87F6C51EC34438E66255DCD41827
                                                                                                                                                                    SHA1:BA16EAF2FA82AE6DFF7885F92CAC16CD560D3EBF
                                                                                                                                                                    SHA-256:0C0837FD71EF42CBA31BB5B98227A31B276590C92440A0DB377B77B5A2CD83A6
                                                                                                                                                                    SHA-512:559771E3C6992DC76C02B8BC33EFD66F8B03790D5BC1E3295809BEB47E8662A3E6B6536774CF248517E9295397CB994D2FD179CAAA73F807E571E3A68704850E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DFAE3C2F0FF7F62A9D.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DFD8991F6687F569E4.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DFE6AB0CD767BFE075.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):1.222762526474746
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Pa5utI+xFX4fT5HlJuddS+ubZwrk2ddSBJkrLE:y5g8TplJ0TaZP8qJi
                                                                                                                                                                    MD5:A80D87F6C51EC34438E66255DCD41827
                                                                                                                                                                    SHA1:BA16EAF2FA82AE6DFF7885F92CAC16CD560D3EBF
                                                                                                                                                                    SHA-256:0C0837FD71EF42CBA31BB5B98227A31B276590C92440A0DB377B77B5A2CD83A6
                                                                                                                                                                    SHA-512:559771E3C6992DC76C02B8BC33EFD66F8B03790D5BC1E3295809BEB47E8662A3E6B6536774CF248517E9295397CB994D2FD179CAAA73F807E571E3A68704850E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    \Device\ConDrv

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10113
                                                                                                                                                                    Entropy (8bit):5.261154260270518
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:fnnZr8tosEbqkWFyxox4xxox4xwBgJyHox4xnox4xvBH:fytwlxoxoxoxowZHoxonoxovp
                                                                                                                                                                    MD5:D4A092F2A2133348B3F38CE73D0C983A
                                                                                                                                                                    SHA1:D3A0AFBAE50B94BDFB7AFEE11905D19B1B107484
                                                                                                                                                                    SHA-256:67FA359794FA3D1EDB08B9163CEFCAFDC31852C6637C25CBDD4EBF090C4D4F23
                                                                                                                                                                    SHA-512:48981875F0CE23C0A61418736B88DB7DF423AC6AFC7B563F0807C9731A1884CF155C12AFAE3FA81DF65405FBFEF2FFDAE3A7D1694D87BDAB5AA82EF29EB85114
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:16:05:37.713 I :7452 [ WindowsTools.cpp:793] This process *is* running under WOW64..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:112] Running with param : ..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:115] C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:115] /submitsignals..16:05:37.713 I :7452 [ NinjaRMMAgentMain.cpp:117] argc: 2..16:05:37.838 I :7452 [ NinjaRMMAgentMain.cpp:199] Agent service recovery options set: "sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//"..16:05:37.838 I :7452 [ ServerSettings.cpp:93] Installation token not found...16:05:37.838 I :7452 [ ServerSettings.cpp:157] Installation token not present..16:05:37.853 E :7452 [ ServerSettings.cpp:203] No InstallToken was present...16:05:37.853 I :7452 [ ServerSettings.cpp:206] ServerS

                                                                                                                                                                    Static File Info

                                                                                                                                                                    General

                                                                                                                                                                    File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: NinjaRMMAgent 6.0.1901.0, Subject: NinjaRMMAgent, Author: NinjaRMM LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {BE5BC90A-C0C2-470D-896F-DE49F6B76428}, Create Time/Date: Sat Jul 23 13:01:26 2022, Last Saved Time/Date: Sat Jul 23 13:01:26 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: MSI Wrapper (10.0.51.0), Security: 2
                                                                                                                                                                    Entropy (8bit):7.977470072044354
                                                                                                                                                                    TrID:
                                                                                                                                                                    • Generic OLE2 / Multistream Compound File (8008/1) 100.00%
                                                                                                                                                                    File name:wayneenterprisesbatcave-6.0.1901-windows-installer.msi
                                                                                                                                                                    File size:50'941'952 bytes
                                                                                                                                                                    MD5:94775bdd3ea65962b24d52f96722f53b
                                                                                                                                                                    SHA1:212dc94ec338ba797f3e04325f5f9dc713c04906
                                                                                                                                                                    SHA256:d991471121f9a1f3aa829a26e0dfc3e4bb7e0ec723650cc6ba32a6bd5e13f302
                                                                                                                                                                    SHA512:db51cc087a804538a9c87edb54c2006d4fc3b03e7ca565e2180eb3d5b84cd7c10fa3b86bbf861e61dc400d50f45040bf6eb63ebc81bdd9484920ffd0bcf8b52d
                                                                                                                                                                    SSDEEP:786432:94CqSyu7eI4K2jDQiLS8OW70qt7V6UemjopgfTohDDe5m8lYbIjIz:9n9I9bOs0aemjoGsf
                                                                                                                                                                    TLSH:BFB72308FA8764F5DE235935859BE23F8B246E048015FEA6FF093F5AFD336722419216
                                                                                                                                                                    File Content Preview:........................>.......................................................L...M...N...O...P...Q...R...S...T...U...V...W..................................................................................................................................

                                                                                                                                                                    File Icon

                                                                                                                                                                    Icon Hash:bdb5fdd8b3b39b1f

                                                                                                                                                                    Network Behavior

                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                    TCP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Dec 16, 2024 22:04:26.641016960 CET49788443192.168.2.2418.66.161.92
                                                                                                                                                                    Dec 16, 2024 22:04:26.641103983 CET4434978818.66.161.92192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:26.641194105 CET49788443192.168.2.2418.66.161.92
                                                                                                                                                                    Dec 16, 2024 22:04:26.642985106 CET49788443192.168.2.2418.66.161.92
                                                                                                                                                                    Dec 16, 2024 22:04:26.643018961 CET4434978818.66.161.92192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:28.381037951 CET4434978818.66.161.92192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:28.381131887 CET49788443192.168.2.2418.66.161.92
                                                                                                                                                                    Dec 16, 2024 22:04:28.381619930 CET49788443192.168.2.2418.66.161.92
                                                                                                                                                                    Dec 16, 2024 22:04:28.381643057 CET4434978818.66.161.92192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:28.381800890 CET4434978818.66.161.92192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:28.382112026 CET49788443192.168.2.2418.66.161.92
                                                                                                                                                                    Dec 16, 2024 22:04:28.575727940 CET49788443192.168.2.2418.66.161.92
                                                                                                                                                                    Dec 16, 2024 22:04:33.920365095 CET49800443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:33.920408964 CET4434980052.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:33.920531988 CET49800443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:33.921566010 CET49800443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:33.921581030 CET4434980052.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:35.879358053 CET4434980052.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:35.879435062 CET49800443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:35.880193949 CET49800443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:35.880208015 CET4434980052.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:35.880582094 CET4434980052.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:35.880640984 CET49800443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:36.007131100 CET49800443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:36.009167910 CET49803443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:36.009207964 CET4434980352.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:36.009414911 CET49803443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:36.009711027 CET49803443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:36.009723902 CET4434980352.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:37.357878923 CET4434980352.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:37.357964993 CET49803443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:37.358551025 CET49803443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:37.358558893 CET4434980352.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:37.358741045 CET4434980352.42.136.152192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:37.358791113 CET49803443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:04:37.503849983 CET49803443192.168.2.2452.42.136.152
                                                                                                                                                                    Dec 16, 2024 22:05:39.220220089 CET49816443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:39.220315933 CET4434981652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:39.221014023 CET49816443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:39.223692894 CET49816443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:39.223773956 CET4434981652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:39.263009071 CET49817443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:39.263050079 CET4434981752.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:39.263206005 CET49817443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:39.264230967 CET49817443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:39.264251947 CET4434981752.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.211916924 CET4434981652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.212047100 CET49816443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.212826967 CET4434981752.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.212853909 CET49816443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.212886095 CET4434981652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.212902069 CET49817443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.213365078 CET4434981652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.213428974 CET49816443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.215158939 CET49817443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.215176105 CET4434981752.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.215408087 CET4434981752.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.215452909 CET49817443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.604454041 CET49816443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.607636929 CET49820443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.607683897 CET4434982052.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.607788086 CET49820443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.608237982 CET49820443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.608251095 CET4434982052.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.705987930 CET49817443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.805538893 CET49823443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.805589914 CET4434982352.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:41.805713892 CET49823443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.805938959 CET49823443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:41.805943966 CET4434982352.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:43.005932093 CET4434982052.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:43.006000042 CET49820443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:43.140002012 CET49820443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:43.140012026 CET4434982052.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:43.140125036 CET4434982052.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:43.140168905 CET49820443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:43.156991959 CET4434982352.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:43.157083035 CET49823443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:43.158461094 CET49823443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:43.158476114 CET4434982352.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:43.158663988 CET4434982352.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:43.158705950 CET49823443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:44.167583942 CET49820443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:05:44.290829897 CET49823443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:04.588818073 CET49842443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:04.588885069 CET4434984252.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:04.588970900 CET49842443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:04.589304924 CET49842443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:04.589323044 CET4434984252.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:05.944323063 CET4434984252.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:05.944407940 CET49842443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:05.945003033 CET49842443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:05.945013046 CET4434984252.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:05.945192099 CET4434984252.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:05.945240974 CET49842443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:06.216730118 CET49842443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:06.226783037 CET49846443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:06.226864100 CET4434984652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:06.226999998 CET49846443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:06.227344036 CET49846443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:06.227366924 CET4434984652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:07.586093903 CET4434984652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:07.586194038 CET49846443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:07.586702108 CET49846443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:07.586738110 CET4434984652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:07.586913109 CET4434984652.32.94.97192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:06:07.586971998 CET49846443192.168.2.2452.32.94.97
                                                                                                                                                                    Dec 16, 2024 22:06:07.967384100 CET49846443192.168.2.2452.32.94.97

                                                                                                                                                                    UDP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Dec 16, 2024 22:03:55.863251925 CET5507353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:03:58.554107904 CET5507353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:04:25.697299004 CET5464353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:04:26.022958994 CET53546431.1.1.1192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:33.614479065 CET5464353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET53546431.1.1.1192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:04:36.567751884 CET5464353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:05:27.861174107 CET5464353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:05:27.998408079 CET53546431.1.1.1192.168.2.24
                                                                                                                                                                    Dec 16, 2024 22:05:28.922295094 CET5464353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:05:38.929974079 CET5464353192.168.2.241.1.1.1
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET53546431.1.1.1192.168.2.24

                                                                                                                                                                    DNS Queries

                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                    Dec 16, 2024 22:03:55.863251925 CET192.168.2.241.1.1.10x13c1Standard query (0)srtb.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:03:58.554107904 CET192.168.2.241.1.1.10xffb2Standard query (0)tse1.mm.bing.netA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:25.697299004 CET192.168.2.241.1.1.10xcd49Standard query (0)resources.ninjarmm.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.614479065 CET192.168.2.241.1.1.10x123Standard query (0)agent-app.ninjarmm.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:36.567751884 CET192.168.2.241.1.1.10x4edeStandard query (0)res.public.onecdn.static.microsoftA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:27.861174107 CET192.168.2.241.1.1.10x17c2Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:28.922295094 CET192.168.2.241.1.1.10x234fStandard query (0)assets.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:38.929974079 CET192.168.2.241.1.1.10xa738Standard query (0)agent-app.ninjarmm.comA (IP address)IN (0x0001)false

                                                                                                                                                                    DNS Answers

                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                    Dec 16, 2024 22:03:56.000566006 CET1.1.1.1192.168.2.240x13c1No error (0)srtb.msn.comwww.msn.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:03:56.000566006 CET1.1.1.1192.168.2.240x13c1No error (0)www.msn.comwww-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:03:58.692713976 CET1.1.1.1192.168.2.240xffb2No error (0)tse1.mm.bing.netmm-mm.bing.net.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:03:58.692713976 CET1.1.1.1192.168.2.240xffb2No error (0)ax-0001.ax-msedge.net150.171.27.10A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:03:58.692713976 CET1.1.1.1192.168.2.240xffb2No error (0)ax-0001.ax-msedge.net150.171.28.10A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:26.022958994 CET1.1.1.1192.168.2.240xcd49No error (0)resources.ninjarmm.comd2veja0xsw5o33.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:26.022958994 CET1.1.1.1192.168.2.240xcd49No error (0)d2veja0xsw5o33.cloudfront.net18.66.161.92A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:26.022958994 CET1.1.1.1192.168.2.240xcd49No error (0)d2veja0xsw5o33.cloudfront.net18.66.161.93A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:26.022958994 CET1.1.1.1192.168.2.240xcd49No error (0)d2veja0xsw5o33.cloudfront.net18.66.161.13A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:26.022958994 CET1.1.1.1192.168.2.240xcd49No error (0)d2veja0xsw5o33.cloudfront.net18.66.161.6A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-app.ninjarmm.comagent-prod-us-west-244308638.us-west-2.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.42.136.152A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.39.197.120A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com34.209.123.242A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com35.165.20.99A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com44.240.221.121A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.40.237.100A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com35.81.194.143A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:33.919354916 CET1.1.1.1192.168.2.240x123No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com44.237.46.108A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:36.709532976 CET1.1.1.1192.168.2.240x4edeNo error (0)res.public.onecdn.static.microsoftres-ocdi-public.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:36.709532976 CET1.1.1.1192.168.2.240x4edeNo error (0)res-2.public.onecdn.static.microsoftcdn-office.azureedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:36.709532976 CET1.1.1.1192.168.2.240x4edeNo error (0)scdn1cc4b.wpc.9aea3.sigmacdn.netsni1gl.wpc.sigmacdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:04:36.709532976 CET1.1.1.1192.168.2.240x4edeNo error (0)sni1gl.wpc.sigmacdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:27.998408079 CET1.1.1.1192.168.2.240x17c2No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:27.998408079 CET1.1.1.1192.168.2.240x17c2No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:29.060830116 CET1.1.1.1192.168.2.240x234fNo error (0)assets.msn.comassets.msn.com.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-app.ninjarmm.comagent-prod-us-west-244308638.us-west-2.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.32.94.97A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.39.197.120A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com35.81.194.143A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com34.209.123.242A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.42.136.152A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.35.142.129A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com52.38.198.76A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 16, 2024 22:05:39.216228962 CET1.1.1.1192.168.2.240xa738No error (0)agent-prod-us-west-244308638.us-west-2.elb.amazonaws.com54.184.180.116A (IP address)IN (0x0001)false

                                                                                                                                                                    Statistics

                                                                                                                                                                    CPU Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    Memory Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                    Behavior

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    System Behavior

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:1
                                                                                                                                                                    Start time:16:03:59
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\wayneenterprisesbatcave-6.0.1901-windows-installer.msi"
                                                                                                                                                                    Imagebase:0x7ff75cf30000
                                                                                                                                                                    File size:176'128 bytes
                                                                                                                                                                    MD5 hash:C0D3BDDE74C1EC82F75681D4D5ED44C8
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:2
                                                                                                                                                                    Start time:16:04:00
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                    Imagebase:0x7ff75cf30000
                                                                                                                                                                    File size:176'128 bytes
                                                                                                                                                                    MD5 hash:C0D3BDDE74C1EC82F75681D4D5ED44C8
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:5
                                                                                                                                                                    Start time:16:04:05
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 91B7917CC6A189DCDC73BA314F139EC3
                                                                                                                                                                    Imagebase:0x7b0000
                                                                                                                                                                    File size:145'408 bytes
                                                                                                                                                                    MD5 hash:FE653E9A818C22D7E744320F65A91C09
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:9
                                                                                                                                                                    Start time:16:04:11
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 37613F16A2C4BDDC0F5FCD566987FE99 E Global\MSI0000
                                                                                                                                                                    Imagebase:0x7b0000
                                                                                                                                                                    File size:145'408 bytes
                                                                                                                                                                    MD5 hash:FE653E9A818C22D7E744320F65A91C09
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:10
                                                                                                                                                                    Start time:16:04:11
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
                                                                                                                                                                    Imagebase:0x150000
                                                                                                                                                                    File size:30'208 bytes
                                                                                                                                                                    MD5 hash:DF132308B964322137C3AA6CD2705D24
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:11
                                                                                                                                                                    Start time:16:04:11
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6038b0000
                                                                                                                                                                    File size:1'040'384 bytes
                                                                                                                                                                    MD5 hash:9698384842DA735D80D278A427A229AB
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:12
                                                                                                                                                                    Start time:16:04:13
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\expand.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
                                                                                                                                                                    Imagebase:0x830000
                                                                                                                                                                    File size:39'424 bytes
                                                                                                                                                                    MD5 hash:63860F134FE4705269CE653A673DBD88
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:14
                                                                                                                                                                    Start time:16:04:13
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6038b0000
                                                                                                                                                                    File size:1'040'384 bytes
                                                                                                                                                                    MD5 hash:9698384842DA735D80D278A427A229AB
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:15
                                                                                                                                                                    Start time:16:04:15
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files\9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.0.1901-windows-installer.exe" --mode unattended
                                                                                                                                                                    Imagebase:0xa50000
                                                                                                                                                                    File size:50'549'840 bytes
                                                                                                                                                                    MD5 hash:052FAC3E3810002C4B43648FD86C328B
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 0000000F.00000003.11591328643.00000000068D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:16
                                                                                                                                                                    Start time:16:04:23
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe"
                                                                                                                                                                    Imagebase:0xd60000
                                                                                                                                                                    File size:31'801'696 bytes
                                                                                                                                                                    MD5 hash:89E9F6649AAF15310F5995ADFF7008AF
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000010.00000000.11582454483.0000000002637000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000010.00000002.12618710420.0000000002637000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgentPatcher.exe, Author: Joe Security
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 0%, ReversingLabs
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:19
                                                                                                                                                                    Start time:16:04:31
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\." /SETINTEGRITYLEVEL (CI)(OI)LOW
                                                                                                                                                                    Imagebase:0x150000
                                                                                                                                                                    File size:30'208 bytes
                                                                                                                                                                    MD5 hash:DF132308B964322137C3AA6CD2705D24
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:20
                                                                                                                                                                    Start time:16:04:31
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6038b0000
                                                                                                                                                                    File size:1'040'384 bytes
                                                                                                                                                                    MD5 hash:9698384842DA735D80D278A427A229AB
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:21
                                                                                                                                                                    Start time:16:04:33
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-68d31af7-1d04-4be1-bbce-ee7f4f69dc37\files"
                                                                                                                                                                    Imagebase:0xee0000
                                                                                                                                                                    File size:245'760 bytes
                                                                                                                                                                    MD5 hash:7B2C2B671D3F48A01B334A0070DEC0BD
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:22
                                                                                                                                                                    Start time:16:04:33
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6038b0000
                                                                                                                                                                    File size:1'040'384 bytes
                                                                                                                                                                    MD5 hash:9698384842DA735D80D278A427A229AB
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:40
                                                                                                                                                                    Start time:16:05:37
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe" /submitsignals
                                                                                                                                                                    Imagebase:0x220000
                                                                                                                                                                    File size:41'591'136 bytes
                                                                                                                                                                    MD5 hash:6735934BDE28A28958B9DB0A80B77B97
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000028.00000000.12320713676.00000000021D6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000028.00000002.12619323050.00000000021D6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, Author: Joe Security
                                                                                                                                                                    • Rule: APT_Trojan_Win_REDFLARE_6, Description: unknown, Source: C:\Program Files (x86)\wayneenterprisesbatcave-6.0.1901\NinjaRMMAgent.exe, Author: unknown
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 0%, ReversingLabs
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:41
                                                                                                                                                                    Start time:16:05:37
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6038b0000
                                                                                                                                                                    File size:1'040'384 bytes
                                                                                                                                                                    MD5 hash:9698384842DA735D80D278A427A229AB
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:42
                                                                                                                                                                    Start time:16:05:37
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Windows\system32\cmd.exe" /c sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//
                                                                                                                                                                    Imagebase:0xee0000
                                                                                                                                                                    File size:245'760 bytes
                                                                                                                                                                    MD5 hash:7B2C2B671D3F48A01B334A0070DEC0BD
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:43
                                                                                                                                                                    Start time:16:05:37
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:sc.exe failure NinjaRMMAgent reset=86400 actions=restart/60000/restart/60000//
                                                                                                                                                                    Imagebase:0x730000
                                                                                                                                                                    File size:65'024 bytes
                                                                                                                                                                    MD5 hash:35AFDDBBF42372FF50809E87BBB88F0E
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:45
                                                                                                                                                                    Start time:16:05:41
                                                                                                                                                                    Start date:16/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc
                                                                                                                                                                    Imagebase:0x7ff715c70000
                                                                                                                                                                    File size:79'920 bytes
                                                                                                                                                                    MD5 hash:8EC922C7A58A8701AB481B7BE9644536
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    Disassembly

                                                                                                                                                                    Reset < >

                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                      Function 03604F86 Relevance: 5.6, Instructions: 5566COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 0000000F.00000003.11532474915.00000000035D7000.00000004.00000020.00020000.00000000.sdmp, Offset: 035D7000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_15_3_35d0000_9b2f5ed9-ea12-469a-a70d-8fc17e8d6252-wayneenterprisesbatcave-6.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a2ee2c8187fb8cb97e4901127ebe1d1866d21c9b6fb77c0c2ea77c4d6ad4c515
                                                                                                                                                                      • Instruction ID: 3df3de6deb8eb22d427a0132d43db58ba6cc2f608e46e1d51b17355982819e1c
                                                                                                                                                                      • Opcode Fuzzy Hash: a2ee2c8187fb8cb97e4901127ebe1d1866d21c9b6fb77c0c2ea77c4d6ad4c515
                                                                                                                                                                      • Instruction Fuzzy Hash: 09B356A245E3D19FD3478B749C666813FB0AE13224B0F44DBC4C1CF5B3E2A9695AC762