Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe
- Size 356KB
- Sample260715-dtv8msdw41
- SHA256 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047
- MD5 f849ca7cb3587ca262de78fa8bcb2374
- SHA1 117b8140b366d1c2c0bcda9a2b1aa1c2d89b9a8d
- SHA512 a58416ae5958bd56bcb7ce547b2899b87e9912eac07756a008b46cff6106cc2662a8012d9054c0b6ff4527c7ce87d8f5033c673769d942f94854498778c5b8d9
- SSDEEP 1536:G/6zG6zZCXiCX8nYlkwZAKZAmIXQaaYhNKHb+KHb5aa0F0aaiSraSrY+S:Ga+S
- TLSH T14774FF43EB614D0EC15E157CA89AC2745310EDD935237B736AD5BDA7BE382F30EA2980
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup\ = "rundll32.exe shell32.dll,Control_RunDLL main.cpl @0,1" InfDefaultInstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Wrapper = "runonce" InfDefaultInstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" InfDefaultInstall.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup runonce.exe - Drops file in Windows directory 51 IoCs
description ioc Process File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Link.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D7C.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Normal.ani InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DA1.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Horizontal.ani InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB5.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB7.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DC8.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DCA.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB3.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB4.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Diagonal1.ani InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DC8.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Alternate.ani InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DCB.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Help.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Handwriting.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Unavailable.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB3.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB4.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB5.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB6.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DA1.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB7.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Person.cur InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D8D.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Working.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D9F.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D9F.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Precision.ani InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DA2.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Diagonal2.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Pin.cur InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D8E.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Busy.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DA0.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Text.ani InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB2.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DC9.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D8D.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D8E.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DA0.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DA2.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DCA.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DCB.tmp InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3D7C.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB2.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Vertical.ani InfDefaultInstall.exe File created C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DB6.tmp InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\Move.ani InfDefaultInstall.exe File opened for modification C:\Windows\Cursors\Kawakaze£¨Wedding£©\SET3DC9.tmp InfDefaultInstall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe - Modifies Control Panel 8 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\UserPreferencesMask = 9e1e078012000000 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors\ rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors\Scheme Source = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\UserPreferencesMask = 9e1e078012000000 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Cursors\Scheme Source = "0" rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2472 wrote to memory of 4644 2472 16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe 89 PID 4644 wrote to memory of 2444 4644 InfDefaultInstall.exe 90 PID 2444 wrote to memory of 4600 2444 runonce.exe 95 PID 4600 wrote to memory of 2760 4600 runonce.exe 96 PID 5820 wrote to memory of 1256 5820 runonce.exe 97 PID 2444 wrote to memory of 6124 2444 runonce.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe"C:\Users\Admin\AppData\Local\Temp\16ab39acbb56766c1ef633b79bc8f86bf05d545c9c6a9317185b4a099ef56047.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\System32\InfDefaultInstall.exe"C:\Windows\System32\InfDefaultInstall.exe" C:\ProgramData\SimpleCursorMaker\Cursor\install.inf2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\System32\runonce.exe"C:\Windows\System32\runonce.exe"4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\System32\rundll32.exerundll32.exe shell32.dll,Control_RunDLL main.cpl @0,15⤵
- Modifies Control Panel
PID:2760
-
-
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:6124
-
-
-
-
C:\Windows\system32\runonce.exerunonce1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\system32\rundll32.exerundll32.exe shell32.dll,Control_RunDLL main.cpl @0,12⤵
- Modifies Control Panel
PID:1256
-
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵PID:4140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Alternate.ani
- Size 17KB
- SHA256 4a96cad48791bd1aa92082ad728ab25f56e3a0b4a50d0d606a0f99fb74978363
- MD5 43044b265d7534438ff960e22e8c8283
- SHA1 a6f44f23fa497d76ab32f3bf81877ca8af713bae
- SHA512 b9d9d3a924bdeaf1f3277149352b33cb123598745de39647fd3904df7d83058d01a47e6a0fa26d51e4b3b7a0445682b68213cacc522f7c597ebf66afb5a2474f
- SSDEEP 192:doWJ8cof0lWNICT8m88lIaTjxoWJ8cof0lWNoJ2B8m88JohiwyN:iPf0u88CWSPf0JG88+O
- TLSH T18D82E44AA3A1608AEF9C6633CCB25A355720BB5C437147F3671B5E81CF2DBAE1C12B54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Busy.ani
- Size 17KB
- SHA256 25e83961e3a8c7c3c00653759abdf689048e466e3798c04c15081cb75f2f22d3
- MD5 ba1f43533a0b83452b1c472b3e9a5746
- SHA1 10eab20f21ef3b96b2110d9b50a74fa2c8cf6710
- SHA512 c7dd008ebb9118e9aa71621923420f34ed16d9e465667877501b9bc9e80298abda725481a714ff96bb0406336c749691e6a33847e2608fb3c6462b58050591a5
- SSDEEP 384:8zbhMrzbA9rzzQ88lWzzQ88l5zuM88JzOc88EzV88lQz0Q88ls:aeH6HE88WE887n88Rz88yV88I788W
- TLSH T1E88211C16F0B4A6EC251A2F4084235E7E718834841D3CF97BEE41EFAEA592ADBD73151
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Diagonal1.ani
- Size 17KB
- SHA256 1f7b1a7a9f7922c4e4757e2894800134bc43d80ea407ade52ecff9aea9e3d9bf
- MD5 e6b9c58825bba8aec415e217d6144f31
- SHA1 af2255dd47b00a9ceac0f5a22dea973dcfa57592
- SHA512 da3faf7b31f6e2ac6bf41e4585cfc1afbc1734c75e7b58f492e219d69272a1a052b94d4d534470a9f76fcd4ce545ab6684b3a47f202cf52865b480bb4a466f6b
- SSDEEP 96:tu8DyRHK4jTH8VD2jru8DiRHK4/u8DeQ2Kowu8DyRHK4jTH8VD2jru8DiRHK4/uh:GHOMYHT2D5HOMYHT2Dd
- TLSH T189824602FF085196C9032ABDDC6E07A453149D116942A3CB5CA738BAFD761F78EA77D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Diagonal2.ani
- Size 17KB
- SHA256 1ae17bbd4dc1f4e37bb9bc84f38d7705665d471d6cf8b44998c4f98ab11baa82
- MD5 1f9c743be4298c498a5ff98a590a108f
- SHA1 d3b42a48ff894c914d82348d91e66efc5d42f17d
- SHA512 b44e66fd6de5837969c50c9bc571df82506f4043de8551c02fb684632946924e13e01f842301680d5ca8d15db807528dab87ed269856f504c5270ef38532f7d6
- SSDEEP 96:A8DeRHK4/H8VDOja8DeRHK4O8DyQ2Ko78DeRHK4/H8VDOja8DeRHK4O8DyQ2Ko5:SHOc0H32DtHOc0H32D5
- TLSH T125824747AB08519AD9032AFCCC5A07A443049C106956A3CF1DAB38FAED771FB4EA72D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Handwriting.ani
- Size 17KB
- SHA256 a45e3533e0c7b446daada4265e79eb52d3616fe78a3a6f8f8230fbd89c912297
- MD5 3814962e2dae9b241245155ba820f1ce
- SHA1 dac7826e0c8a9d7beac3d49466f98910113f8bb5
- SHA512 c7f0fbf89b35f9d2885400d2adaf15e4c6f472505ae6d71cd4c237c12a4c7421d39f828a58c439b3be24c304066822d0e7f732c128cd280b8331ae8512e89716
- SSDEEP 192:3kGdglgm887kGdglgm88T9MLm8839Msm887kN7Oum887kyVp2m88elum88elum8h:vQ88rQ88L88S88eQ88z88Y88Y88W
- TLSH T1748220529B00156AD442AB76E4878379B3F1602E68338FC73D653BB2ED101EB1C7F61A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Help.ani
- Size 17KB
- SHA256 e9bce0065008101057933ef667fc7bbd5b65e21c4490e0fd89938d6fd4fc15f0
- MD5 8cee52e160010a1537015847c8c807ad
- SHA1 2710f6b57f159f3ed153d175cf59ae42a1c3a4b4
- SHA512 8eb4bb4e3020e48ee472d421e60f02f7ed02b786457d570fa6e2f664e13f68eb4caf3d227f890e8b97418eb92eaf58b058b384a12f25d2bc6721b205f48f3992
- SSDEEP 192:UNqEkNn8kEcX8EWTTgSEYQ4qEkNTDbyE5hn8EwCVES:UN7kNnIcXVWTkTYQ47kN/v5xVwCiS
- TLSH T10382EF862F895C18DE8CE733D5A15608B7E578EC1E69CF272E2F7815BE900930DB3199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Horizontal.ani
- Size 17KB
- SHA256 cebfcd5b97c82b4ed65aaef62ea8ee40f997ce5416ba8d6cf5766f4ea65449f1
- MD5 a5f7a82186ce24a4995a248250c105b1
- SHA1 d9a640414b815fd034615375ce599ffab872ceac
- SHA512 1308acce512052e77753df7471fccdaa4917f69b4546d7a7426d07bb1b7fe9d5dcf1e66d8be93a2f7fbde6e58ece547274873ba7558455bce2d23bdd279dc589
- SSDEEP 96:z8DNFD54miYtb6H8VDFD9mX1O6m/8DNFD5bMjAy48D+a1Vy8DNFD54miYtb6H8V5:sJ5ZtbzhaJ5Fa1RJ5ZtbzhaJ5Fa1B
- TLSH T11B82E047F7048017C7252BB9802E0354B7168D38C9826F5B7D293DEAFD763E62D242C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Link.ani
- Size 17KB
- SHA256 b2608468e9e45c32fad1c2ac97da1bdc176d7fff80ffb44c43dc4775e97edf67
- MD5 e385947b49ff26242475c898b467e5b1
- SHA1 9acf99bf8ca8e6d6de08532d2bbe92414b74402a
- SHA512 d4d2e1f912e7acfd03c0d4560ecbe4a1a7e264dc49411f21dc8d8d145c6a2535c2f4b64d65070ac7218ebc68345b8ba309709cf5d2d448818efea948e490df3c
- SSDEEP 96:CT7/bFioFhDOT7/bFioFhDOT7/bFioFhDOT/38AEpVzblJNzSQPmknkowTo8AgXa:EbFtwbFtwbFtk6jN2Qes2d1j1jE
- TLSH T1D682CD0A4B0093ADE44665B8EC9B5F4723018054C1B7F757BE88F9FAFE584E08E5B25E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Move.ani
- Size 17KB
- SHA256 d7fbdb25a5591d1ac9813aa81f358c80b8df3f21c4a9e79f679d0c1308b5864e
- MD5 a3bbebc98bd3dbd9c384bbc9563e0138
- SHA1 fb96a85d7cc0f44a8d05b28d8b3171a12503636f
- SHA512 2ccaa9c00bd6ae169661456d774186e945952e08ed490495a2e20ab7779a42cf6da720c00524e9afa379183ac74c96dbd2a3317a6fc2076c700b1db63bd1eb6d
- SSDEEP 96:A8DMRFKO9StboH8VDig6e8DMRRKpsk8DUQ2Kyf8DMRFKO9StboH8VDig6e8DMRRi:QFVStbRsnORl2BXFVStbRsnORl2Bd
- TLSH T1E282384FBF18825ADC032AB98C56036413049C555920E74F2A6B38FAFCB72DB1E677D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Normal.ani
- Size 17KB
- SHA256 0dcacc1a411a8a2217c398e464781e1456f705d29db6b8143a5fbbb69d66bf4b
- MD5 b3c1e07577d92162117c7b0fc2306612
- SHA1 bb1ac253cb681d11ab26953f0c341fdd36bd035d
- SHA512 f5c16715a6a9dc9d85cd83bd4457f428e852de6adee83ffe9f58661843d9891a2de3f5c20cf7cd075800edf99ea9a75db718ccec499eed4c5f60734ab02804e0
- SSDEEP 384:34qj274qj274qj2+g2BW2+g274qj274qj2O:janana0F0nanaO
- TLSH T18882CF4A5B473FDAD0F1C6390092CB3903628A16283BA7D35EAD146DFE594D3CC271AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Person.cur
- Size 3KB
- SHA256 4534ec10ae3767c71acb15f22b388d73b0b594e685dbcba1d2952c8a4cfa6774
- MD5 03ec718c0f704300b943c72f04bc4375
- SHA1 07eb9057f3549054740d83117ea31826201f397c
- SHA512 93d53a7a7a5972895a7cf300dd5073e33be551473b760795069874dcfea257fb771af67209e0f0392a04d328acbd01bf6dc898170a49ded57c0ec4d06c6f0cfa
- TLSH T1AF6191423F57A861CAC02C3D886F96A303211B181C03DB536F54672EDFB75E25EC929C
- MD5 SHA1 SHA512 TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Pin.cur
- Size 2KB
- SHA256 1fd61c31306de47f35a964a475c416474d1b2e0e9b361e2333ea9a1655c7da2b
- MD5 bbe8fc688992a85ab687a3b9618a1a20
- SHA1 8f0004c6c8b8729971fe50759643723184889fe7
- SHA512 c49c009b3f2e09ef7705b43c2b7d6e3de2fcae2614bd21945e78e435c5de1e706357c50747eb7aaed230646b668b914bb99d5d7d2f5755fdb17a96a5165e9a38
- TLSH T1BF516C527F67A84CD6C40C3C08ABA6836311A7500C07DB273F14A72DEBB31E25EC50AC
- MD5 SHA1 SHA512 TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Precision.ani
- Size 17KB
- SHA256 2a0f02ab3c8eb9ff09d1c113f7a3abd310057151a887ebf5176656cbd2c4e8bd
- MD5 7b9eb92795aa1da5c97cda52d9566817
- SHA1 567df39b1b07a5906face80d4f31c3e58798e2d4
- SHA512 770be78d39ca5a7816de97b3808b739d52aab65def8a64e63bfe09bd1317214c699f1fac098625a8bd73a80872cea0043c40e8dfc32d6c0cc0da84a8d5b745f0
- SSDEEP 384:Fr88Tr88T3883Uv880f883kv88T088T088g:Fr88Tr88T3883Uv880f883kv88T088TT
- TLSH T1FB82AD41EF008D9EE3494B36457626DC13B9757D13302FBB9F4B6A6A7F200FA2D62095
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Text.ani
- Size 17KB
- SHA256 cb60aee72e4c6a33eb7ead69bf890c13ab15682833c6701598d60d8302f53492
- MD5 9d82b26556afb8b2c5f382a2d1bcb4b2
- SHA1 29d35a671717659a8431282a2ba77bee298c3cc2
- SHA512 b001a340d363fd3a0b4dee134f08c9c683d162c25aacc791aae8bcb6d1ce3202703bdf3d18cb65a263fcc905a0168b06ea87fa159d5026401db4e30ce0791501
- SSDEEP 384:jT/7r+T/7r+T/9VT/9VT/9CT/9CT/9VT/9k:jTOTOTjTjTMTMTjT6
- TLSH T1A9828002AF407769F1E2CE762DE34B1B87553CD494FB431B06661AA5BF140E33E760AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Unavailable.ani
- Size 17KB
- SHA256 a587d97f6fb55f311650a00761de75190d84d5969a2c2667d230bba6ea4cc03f
- MD5 eb14c3e8611b0b879a0f0ceb109378cd
- SHA1 f660346958923610cd0478f80ad2d39610754e8e
- SHA512 bef5c852c5677309b28c9541cc1498ec5c7aea1aeaebc40e7f1a41b82a537ec0da47f7c657c2b29bb43c0e8de0c6971e2b3b9df8f65ccb22ba3f6eac3cc45b50
- SSDEEP 192:4hxkmAhxkmA+jkmP+jkmif5AmXf5Am2fOTmYfOTmQ:4vAvAUPUYRvRcFeFQ
- TLSH T1EB822F9ADF00E01AD51897F4C1361AA91777ECCB90379BA77E3A9591EF00BE54E30C98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Vertical.ani
- Size 17KB
- SHA256 70a8412ef38b1fdb6d2c2f4bb36e3f040bbf92335cb9273e9c05c6f610339ffb
- MD5 5f1968778b599b2d4a190e2dfe08dc2c
- SHA1 6b845e377a10d4f3ef6059e0c41902a79f856e55
- SHA512 fa82a80407966b4973ff0e5ce6998b77ad3cab7947926dc33b4d4e921954f57bafd0b871fae60a40b51608dedf1eac42d536ad3d6349a6888ec95265772b021c
- SSDEEP 96:A8DMRHK4RrH8VD4jRO8DMRHK4Q8DUQ2KoF8DMRHK4RrH8VD4jRO8DMRHK4Q8DUQM:QH34qNeHL2DFH34qNeHL2DL
- TLSH T140825C46BB184256D8033ABECC5B036453008C156951A7CB6DA338FBFC762FB5E673A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~3\SIMPLE~1\Cursor\Working.ani
- Size 17KB
- SHA256 c03d46ec3040f0ea4ce2339d63618bd25a8cd7c13a4aa80c284bc92e2c078f8f
- MD5 85dbc050f87275c5fe67539cc11c4dcf
- SHA1 001a02b71cde9550119a5e92746883489c8f1479
- SHA512 6d4e1c054bd4c4f600916a0963959d57f1ad039cb6af5ed8c272a74e8a64d8d0d12de9c14ea35bfe12c219374e15bd58cbbcdcdf2dd5bb2c04d41f94842baf91
- SSDEEP 96:3TwLNwPHRcTwH+iPHRcTws+VlPHRcTwsxJPHRYTw3mvGSRTw3GJ57/Tw3mhHPqIF:0wPqiPxvP+JP3uG5muQ5ZrT
- TLSH T14D820F19BB03AA91C9A1C93520A213304316D73F053387D3AE3A5A64EFABDD71DF21D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\SimpleCursorMaker\Cursor\install.inf
- Size 2KB
- SHA256 ce1588e0c0e936df6a1ef774a79cc9721b667411c798417c6898c5e8c96ed0bc
- MD5 05e137dbf8f607cc33f62966af58e9fd
- SHA1 9590e171de6d216c8cbcb51ba9c8f3014b8fa647
- SHA512 7ab2004f7c83eea10af34546bcae66f0010987dd831826dcc33be7c0360abcbcf6ab5ceb7ec29898a3d76d31888301ca2b16723ad3ea5172ae948cf59fa3e5ff
- TLSH T10B513A081E51DD27FC66865DBBF62F8E2116B493DCEC144C204EA8471FAFA908E68263
- MD5 SHA1 SHA512 TLSH