| File name: | with-editor.exe |
| Full analysis: | https://app.any.run/tasks/33fd9713-d0b2-4dc3-9caf-423ef71daa2c |
| Verdict: | Malicious activity |
| Analysis date: | May 31, 2025, 10:33:50 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections |
| MD5: | 60D463B942EB11EB141C0611BC3BC346 |
| SHA1: | B5C64B01AC4AC4C8D42EF830ACB80729A0AED180 |
| SHA256: | 4EF4CAE28CA3CFE2C1571C6BA074351A1AD410FDDB53BDDA1A299F2B6578BBB5 |
| SSDEEP: | 98304:VrGQnAU+5lecFGCJm7p9s5I1lqI6cMatsleim+HtkuCGH83gbrUl8mY15PsEP5cv:z0hrU8MaeBfQaL |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads the Windows owner or organization settings
- with-editor.tmp (PID: 1176)
Executable content was dropped or overwritten
- with-editor.exe (PID: 6940)
- with-editor.tmp (PID: 1176)
There is functionality for taking screenshot (YARA)
- ReMouse.exe (PID: 7316)
- ReMouseEditor.exe (PID: 7616)
Detected use of alternative data streams (AltDS)
- ReMouseEditor.exe (PID: 7616)
INFO
Checks supported languages
- with-editor.exe (PID: 6940)
- with-editor.tmp (PID: 1176)
- ReMouse.exe (PID: 7316)
- ReMouseEditor.exe (PID: 7616)
Reads the computer name
- with-editor.tmp (PID: 1176)
- ReMouse.exe (PID: 7316)
- ReMouseEditor.exe (PID: 7616)
Create files in a temporary directory
- with-editor.exe (PID: 6940)
- with-editor.tmp (PID: 1176)
- ReMouse.exe (PID: 7316)
- ReMouseEditor.exe (PID: 7616)
Creates files or folders in the user directory
- with-editor.tmp (PID: 1176)
The sample compiled with english language support
- with-editor.tmp (PID: 1176)
Creates a software uninstall entry
- with-editor.tmp (PID: 1176)
Reads mouse settings
- ReMouse.exe (PID: 7316)
- ReMouseEditor.exe (PID: 7616)
The process uses AutoIt
- ReMouse.exe (PID: 7316)
- ReMouseEditor.exe (PID: 7616)
Reads the software policy settings
- slui.exe (PID: 2332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (77.7) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (10) |
| .dll | | | Win32 Dynamic Link Library (generic) (4.6) |
| .exe | | | Win32 Executable (generic) (3.1) |
| .exe | | | Win16/32 Executable Delphi generic (1.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1992:06:19 22:22:17+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 41472 |
| InitializedDataSize: | 17920 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xaa98 |
| OSVersion: | 1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 5.6.0.0 |
| ProductVersionNumber: | 5.6.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | AutomaticSolution Software |
| FileDescription: | ReMouse |
| FileVersion: | ReMouse Standard V5. |
| LegalCopyright: | AutomaticSolution Software |
| ProductName: | ReMouse Standard |
| ProductVersion: | Standard V5.6 |
Total processes
130
Monitored processes
6
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1176 | "C:\Users\admin\AppData\Local\Temp\is-A7362.tmp\with-editor.tmp" /SL5="$C034E,5411417,57856,C:\Users\admin\AppData\Local\Temp\with-editor.exe" | C:\Users\admin\AppData\Local\Temp\is-A7362.tmp\with-editor.tmp | with-editor.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
| 2332 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4892 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6940 | "C:\Users\admin\AppData\Local\Temp\with-editor.exe" | C:\Users\admin\AppData\Local\Temp\with-editor.exe | explorer.exe | ||||||||||||
User: admin Company: AutomaticSolution Software Integrity Level: MEDIUM Description: ReMouse Exit code: 0 Version: ReMouse Standard V5. Modules
| |||||||||||||||
| 7316 | "C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\ReMouse.exe" | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\ReMouse.exe | — | with-editor.tmp | |||||||||||
User: admin Integrity Level: MEDIUM Description: ReMouse Standard Exit code: 0 Version: 5.6 Modules
| |||||||||||||||
| 7616 | "C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\ReMouseEditor.exe" -c 0 0 | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\ReMouseEditor.exe | — | ReMouse.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: ReMouse Editor Standard Version: 5.6 | |||||||||||||||
Total events
969
Read events
950
Write events
19
Delete events
0
Modification events
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 5.5.9 (a) | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\ | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | Inno Setup: Icon Group |
Value: ReMouse Standard | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | Inno Setup: User |
Value: admin | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | Inno Setup: Language |
Value: default | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | DisplayName |
Value: ReMouse Standard | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\conf\ext\app_ico.ico | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | UninstallString |
Value: "C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\unins000.exe" | |||
| (PID) Process: | (1176) with-editor.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReMouse Standard_is1 |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\unins000.exe" /SILENT | |||
Executable files
22
Suspicious files
14
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\conf\help.chm | binary | |
MD5:92EDBD5A48B9CDCEE8D6B9B0CC36030C | SHA256:AA43E6F744A00987FD779291D9318CF689C198972E46ABB779F4166D7C571BC9 | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\ReMouse-TaskMgr.exe | executable | |
MD5:71C9F982CABABE028BA53330EE2D0879 | SHA256:971834A15706B6DFC6FC477401D6F817E48BD48A0CD7E871B0634278E816A31D | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\conf\is-L8BE4.tmp | binary | |
MD5:92EDBD5A48B9CDCEE8D6B9B0CC36030C | SHA256:AA43E6F744A00987FD779291D9318CF689C198972E46ABB779F4166D7C571BC9 | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\is-IFJ69.tmp | executable | |
MD5:52A8E46AEBCF8587D89ABB21CBE62DC7 | SHA256:72AFE1063114BF0321513427808982AEA1ACBBCD3FAD78944EC1E68F7EACCBA1 | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\conf\is-TDPT2.tmp | text | |
MD5:3ED951C332C0C1176DCB20A99868B3A2 | SHA256:94C4BE28C7247CF7FE24E54D236403FEF381853DECBD6929565A7E52C00E3EF4 | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\conf\is-DKEOI.tmp | text | |
MD5:A245E07BCC44CC10882E3C9D53292ECA | SHA256:90DD9C55D4C67621B9F6CB67084F067A95BAA73066C70E0F31E8F5E4346E8DC7 | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\ReMouse.exe | executable | |
MD5:697D7FFC29417B81F4F2BBF8EACF2C7E | SHA256:D9D65769B6534CAD0FBC5E56412A76381929500B4B10E69B30A752D2F5E3B2BC | |||
| 6940 | with-editor.exe | C:\Users\admin\AppData\Local\Temp\is-A7362.tmp\with-editor.tmp | executable | |
MD5:832DAB307E54AA08F4B6CDD9B9720361 | SHA256:CC783A04CCBCA4EDD06564F8EC88FE5A15F1E3BB26CEC7DE5E090313520D98F3 | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Roaming\AutomaticSolution Software\ReMouse Standard\is-SCFMP.tmp | executable | |
MD5:71C9F982CABABE028BA53330EE2D0879 | SHA256:971834A15706B6DFC6FC477401D6F817E48BD48A0CD7E871B0634278E816A31D | |||
| 1176 | with-editor.tmp | C:\Users\admin\AppData\Local\Temp\is-NPRHG.tmp\_isetup\_setup64.tmp | executable | |
MD5:E4211D6D009757C078A9FAC7FF4F03D4 | SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.20.245.139:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7368 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7368 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
7872 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
7348 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.20.245.139:80 | crl.microsoft.com | Akamai International B.V. | SE | whitelisted |
5496 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7872 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |