Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    233s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    08/11/2023, 12:20

General

  • Target

    XMouseButtonControlSetup.2.20.5.exe

  • Size

    2.9MB

  • MD5

    2e9725bc1d71ad1b8006dfc5a2510f88

  • SHA1

    6e1f7d12881696944bf5e030a7d131b969de0c6c

  • SHA256

    2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

  • SHA512

    62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39

  • SSDEEP

    49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies registry class 33 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
    "C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Modifies registry class
    PID:2148
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9fcb546f8,0x7ff9fcb54708,0x7ff9fcb54718
      2⤵
        PID:2808
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        2⤵
          PID:3928
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4088
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
          2⤵
            PID:1412
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
            2⤵
              PID:1724
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
              2⤵
                PID:2024
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                2⤵
                  PID:2676
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
                  2⤵
                    PID:2820
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                    2⤵
                      PID:4632
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
                      2⤵
                        PID:5512
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                        2⤵
                          PID:5504
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
                          2⤵
                            PID:5744
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4912403623108405398,7729501192203245598,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5760
                        • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
                          "C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
                          1⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Modifies system certificate store
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:3728
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4136
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3024
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:1724

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

                                Filesize

                                364KB

                                MD5

                                80d5f32b3fc515402b9e1fe958dedf81

                                SHA1

                                a80ffd7907e0de2ee4e13c592b888fe00551b7e0

                                SHA256

                                0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

                                SHA512

                                1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

                              • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

                                Filesize

                                364KB

                                MD5

                                80d5f32b3fc515402b9e1fe958dedf81

                                SHA1

                                a80ffd7907e0de2ee4e13c592b888fe00551b7e0

                                SHA256

                                0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

                                SHA512

                                1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

                              • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

                                Filesize

                                1.7MB

                                MD5

                                bb632bc4c4414303c783a0153f6609f7

                                SHA1

                                eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

                                SHA256

                                7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

                                SHA512

                                15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

                              • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

                                Filesize

                                1.7MB

                                MD5

                                bb632bc4c4414303c783a0153f6609f7

                                SHA1

                                eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

                                SHA256

                                7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

                                SHA512

                                15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

                              • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

                                Filesize

                                1.0MB

                                MD5

                                d62a4279ebba19c9bf0037d4f7cbf0bc

                                SHA1

                                5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

                                SHA256

                                c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

                                SHA512

                                6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

                              • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

                                Filesize

                                1.0MB

                                MD5

                                d62a4279ebba19c9bf0037d4f7cbf0bc

                                SHA1

                                5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

                                SHA256

                                c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

                                SHA512

                                6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                6dded92ec95cf9f22410bdeac841a00d

                                SHA1

                                83c32c23d53c59d654868f0b2a5c6be0a46249c2

                                SHA256

                                1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

                                SHA512

                                e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                312B

                                MD5

                                f05351fa5be9c800c99dfa0d89ea6346

                                SHA1

                                be8f60d890163b3bed9bc3ca5d62d23acd09bf38

                                SHA256

                                ab92c7d6b619d540370140f1b3dd43745b49e16459be66895295950ef51215ab

                                SHA512

                                4e506e4f78ff1b73c101e787e13302d906d9741d997e5c730fd3d15c146ef4350ad0134ab1493d79d4f3bb2954a5d2048978cac3bb41c5041f66e2494735f655

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                111B

                                MD5

                                285252a2f6327d41eab203dc2f402c67

                                SHA1

                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                SHA256

                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                SHA512

                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                f6972592e6b72c0be3d4421e4c8305bb

                                SHA1

                                9920481bf77a03d977a9c48b2d636ec5fba94f4b

                                SHA256

                                62cd32f25a28f3c38b705f727ffb153aff8e7bb2c2330a506e56abf0593b99a3

                                SHA512

                                7600bffc98df622533cb2279ffb0a6a6d053b509003a499e455e618992363955f76db85441905fd48f9864d31195c9cb7bc6e31b30c61ca9128e7616dbb1d640

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                779385fbe52e3308cfcf4fac842245ac

                                SHA1

                                c3f8839b9457209680a6fc81156a126fc442085e

                                SHA256

                                3423a686bf94f3aea6189b5aa1385be6c704876b4855bd425ed4e51e8e8d8c18

                                SHA512

                                31a351b3e2b39f2c2dd707ff233ad475e25d696f14a6e8a21f923eadf15e82d61249c0bc698e8e521ea47fb53f5ed1d586fec989a13eee087dfb00ed8fa7fd27

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                b32d41daaa6fb6a516873734a33956a3

                                SHA1

                                4bfae191af96baa8c1383b9215e3a4060e671706

                                SHA256

                                c98f967db16032753cabd66ecaaa8060a49766cd65636a4defb55fc99634205f

                                SHA512

                                f3c1f5b048fe7a65c53977baecff2b09d673e2113ee69c726f40072ce3e4577f3136a8ec1d731e7cf8be8a045029143b0a34c1adbe83ca1cd4957f0b24746d14

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                7KB

                                MD5

                                a391bab94f045f8a58792145434bc824

                                SHA1

                                63f9b352f43c36892aee01baff1c07986f474532

                                SHA256

                                e8ca383c8339f9df0952f42202d09875f0999ad5e3193057d74b2b83e4db6e84

                                SHA512

                                2b38cbf3645577e7dde64b4991f5ca93d8b2e4ec1dc272f7016126fccf73f0d0804b6373d4bf76cddb744591357c46730c618d723da712dda54b2f77866321cc

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                Filesize

                                24KB

                                MD5

                                e05436aebb117e9919978ca32bbcefd9

                                SHA1

                                97b2af055317952ce42308ea69b82301320eb962

                                SHA256

                                cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

                                SHA512

                                11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                370B

                                MD5

                                7585ab34aa521a223bb75c94de9c4f0a

                                SHA1

                                707c872ff65214aa0617459a1a96f0ba2901037f

                                SHA256

                                a9f5a9d1d60dc1aeaf18929dbba6283bef6a55bdb2268764edc9564f8fcaa4c9

                                SHA512

                                da522df84b2033a0ee2188851584f1ca3dbb85b2466f0703290b8c1b64b8fe15c9a8c94b40bb27445b219a2ce8b8a5e82176c077e68c267b5e402659caa18aab

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587cad.TMP

                                Filesize

                                368B

                                MD5

                                425a5616d4835f94598a125eb761acdf

                                SHA1

                                5f086db3d44cf39e2899981e016b922bb05f11d5

                                SHA256

                                dcc7dd14532b15df8a04f95faa3d68167feb282cb1d8ee0e8715f1e7c90d4cf1

                                SHA512

                                74606bb24229bb468157725b805c0b55de2fbdf34e8d55c4663b24a0558c9759e6255b86b5cb4961016e5e2d6988e39ccd9b3a6d8f302448f0792e26e839e3ff

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                48258b94f9869c6d2810d2aef92d5ec2

                                SHA1

                                3a30b2f8a97f5e27c1bffd5d872f80c76aad79fd

                                SHA256

                                879a61008310dfabd8ecad50569b6f80091bb47da3a2fee90671457b8282a9bf

                                SHA512

                                f62ffafb8a61f53d603496d1ce4fdd284db2d6cf79aedeb7b92cf205c25371c96ad12f091e3c5264df1d969df327dd2dde76ced96f7153358418c11a192fff82

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                7264042d7f9eedbdd0383970dd3773ac

                                SHA1

                                f703e6cfddcc0b9f54b959670523c983f1b6f6a7

                                SHA256

                                afe7c3759a25fc28532e0e82eaf0aa4a6cf036912df85e6eebf2b373b974a021

                                SHA512

                                cf05dd43ec5073e0160ba328480c77a5fa0a30a51df31ff8de9b3382d98f3025b5ecf08450e44ff248037a73eee0935e1dcdf605b110b4b95898e37b1650dc15

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\InstallOptions.dll

                                Filesize

                                14KB

                                MD5

                                d753362649aecd60ff434adf171a4e7f

                                SHA1

                                3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                                SHA256

                                8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                                SHA512

                                41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\InstallOptions.dll

                                Filesize

                                14KB

                                MD5

                                d753362649aecd60ff434adf171a4e7f

                                SHA1

                                3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                                SHA256

                                8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                                SHA512

                                41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\InstallOptions.dll

                                Filesize

                                14KB

                                MD5

                                d753362649aecd60ff434adf171a4e7f

                                SHA1

                                3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                                SHA256

                                8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                                SHA512

                                41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\ShellExecAsUser.dll

                                Filesize

                                7KB

                                MD5

                                86a81b9ab7de83aa01024593a03d1872

                                SHA1

                                8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

                                SHA256

                                27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

                                SHA512

                                cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\ShellExecAsUser.dll

                                Filesize

                                7KB

                                MD5

                                86a81b9ab7de83aa01024593a03d1872

                                SHA1

                                8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

                                SHA256

                                27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

                                SHA512

                                cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\ShellExecAsUser.dll

                                Filesize

                                7KB

                                MD5

                                86a81b9ab7de83aa01024593a03d1872

                                SHA1

                                8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

                                SHA256

                                27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

                                SHA512

                                cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\System.dll

                                Filesize

                                10KB

                                MD5

                                56a321bd011112ec5d8a32b2f6fd3231

                                SHA1

                                df20e3a35a1636de64df5290ae5e4e7572447f78

                                SHA256

                                bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                                SHA512

                                5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\System.dll

                                Filesize

                                10KB

                                MD5

                                56a321bd011112ec5d8a32b2f6fd3231

                                SHA1

                                df20e3a35a1636de64df5290ae5e4e7572447f78

                                SHA256

                                bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                                SHA512

                                5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\System.dll

                                Filesize

                                10KB

                                MD5

                                56a321bd011112ec5d8a32b2f6fd3231

                                SHA1

                                df20e3a35a1636de64df5290ae5e4e7572447f78

                                SHA256

                                bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                                SHA512

                                5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\ioSpecial.ini

                                Filesize

                                696B

                                MD5

                                9d2b561aaa904a04f227713b694a4d45

                                SHA1

                                0f14bb5b5edbb41800f42fbfe79f40a70598c328

                                SHA256

                                9d3b1b14fc1072848b182005008215607dc2be5a9c450e2f8462cac9c5afc5c5

                                SHA512

                                6a31cd7b9b62789b026403d947210d84cebe1770251affd0541e8940aeb55d33d040bfe6c1f18a7c749a5b3537aef0824c60def1bc881934a887ce4f5fb79c1c

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\ioSpecial.ini

                                Filesize

                                710B

                                MD5

                                13edb19c041d2d6bcce9a7cc7785d77e

                                SHA1

                                4a3ddd50a77ad5e017ef6ecb5c14ac625b86d5a2

                                SHA256

                                1078c2032aabf0cf889651438a1f886a24ae2532b94bde343e6bbfa92a884c2f

                                SHA512

                                002039ea5c2e23b6908e917c9cd1f2de51fa289970fdc578e655c63bd23e296c320132418c3d5bb07ed04927cbdf8a9f1752039eadf975d64afbf1efc8f19aae

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\ioSpecial.ini

                                Filesize

                                765B

                                MD5

                                57033cb8e22d23e99b8f79e05fce8d30

                                SHA1

                                20dd715edfe63a6cae6549d5beb017b37a25fca6

                                SHA256

                                dacaf1e4da891e742687be4907372e6de04eb75fe17674c0b59b295a67d87ae1

                                SHA512

                                55e3b98a466d5b40be7e9e04d88837625ab7b341464df5e64a819265bbc80884a51079ab8e33a2ac9c4d4d3fb3a30a5c18765d52603214f59c123f87a00136d9

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\nsDialogs.dll

                                Filesize

                                9KB

                                MD5

                                f832e4279c8ff9029b94027803e10e1b

                                SHA1

                                134ff09f9c70999da35e73f57b70522dc817e681

                                SHA256

                                4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

                                SHA512

                                bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\nsDialogs.dll

                                Filesize

                                9KB

                                MD5

                                f832e4279c8ff9029b94027803e10e1b

                                SHA1

                                134ff09f9c70999da35e73f57b70522dc817e681

                                SHA256

                                4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

                                SHA512

                                bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

                              • C:\Users\Admin\AppData\Local\Temp\nslA28B.tmp\nsDialogs.dll

                                Filesize

                                9KB

                                MD5

                                f832e4279c8ff9029b94027803e10e1b

                                SHA1

                                134ff09f9c70999da35e73f57b70522dc817e681

                                SHA256

                                4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

                                SHA512

                                bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d