2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1072	Process not Found
1744	XMouseButtonControl.exe

Loads dropped DLL 9 IoCs

pid	Process
1316	XMouseButtonControlSetup.2.20.5.exe
1316	XMouseButtonControlSetup.2.20.5.exe
1316	XMouseButtonControlSetup.2.20.5.exe
1316	XMouseButtonControlSetup.2.20.5.exe
1316	XMouseButtonControlSetup.2.20.5.exe
1316	XMouseButtonControlSetup.2.20.5.exe
1316	XMouseButtonControlSetup.2.20.5.exe
1744	XMouseButtonControl.exe
1744	XMouseButtonControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XMouseButtonControl = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe /notportable /delay"	XMouseButtonControlSetup.2.20.5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\ChangeLog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\X-Mouse Button Control User Guide.pdf	XMouseButtonControlSetup.2.20.5.exe
File opened for modification	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\changelog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\License.txt	XMouseButtonControlSetup.2.20.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000018c0c-133.dat	nsis_installer_1
behavioral1/files/0x0008000000018c0c-133.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop	XMouseButtonControlSetup.2.20.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	XMouseButtonControlSetup.2.20.5.exe

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02e0b3ba9d0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62C2C0F1-3C9C-11EF-BA79-7699BFC84B14} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000fd5da94375ed71b4c8ebb2ae61ea9b565d79d977b4298d44c84b6a89b4c6c695000000000e80000000020000200000002ca79fd238fc972a6c209f4bb31308d46a2e2336df0278c466a777c2e9222c55200000003ecbf77f7685d12d897b65aee0011473a26491292878fc25352d328b4e6d1cf640000000e04dd01dac1608230cd4cfc3ac134c1c7bb49ee4709d982b93f59c8e0b92c94ece4ed15bbc46f61db0a23e796eeeddc0f4ac255927035c12594dfce21504f779	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = b104000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000fa006abca8f51398257ae7570d954efae3ad9e23f1c0bfffbe10b990b70f814c000000000e8000000002000020000000755fe2d148bd7a9b7c5dd8a87f68ece7071b9cb0855a9785db56301773f1e1b1900000001e042dee4d7dc130c83fb582387eb3c3ea5a81837086abbe72dcda607330156f433547f9128e33e93ab1ae9ddd50b2946d7e74af4a0150c369245417335650a2ecffa8485423073bde356d74f95a2e504ffb751a787baeb7f4dc7a246573e26b22c993223a3f6325487fce6900cbef2478261c9ddfdd1cab05a67f897b2531234b21b4580eda4c211113e2e477b4e0e04000000071eb3a77f748a3fe73b4e685c49477447e479caba2b67667ea1e2aa0d1893b1601180e34aef7cd7f83af262ee48b06c19d1a319584195cff11e6fe114309c05a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /import:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /profile:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /install:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs	XMouseButtonControlSetup.2.20.5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1600	chrome.exe
1600	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1036	rundll32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	1512	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1512	AUDIODG.EXE
Token: 33	1512	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1512	AUDIODG.EXE
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2872	iexplore.exe
1744	XMouseButtonControl.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
1744	XMouseButtonControl.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1744	XMouseButtonControl.exe
2872	iexplore.exe
2872	iexplore.exe
564	IEXPLORE.EXE
564	IEXPLORE.EXE
1744	XMouseButtonControl.exe
1744	XMouseButtonControl.exe
1744	XMouseButtonControl.exe
564	IEXPLORE.EXE
564	IEXPLORE.EXE
2872	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 564	2872	iexplore.exe	33
PID 2872 wrote to memory of 564	2872	iexplore.exe	33
PID 2872 wrote to memory of 564	2872	iexplore.exe	33
PID 2872 wrote to memory of 564	2872	iexplore.exe	33
PID 1600 wrote to memory of 1852	1600	chrome.exe	41
PID 1600 wrote to memory of 1852	1600	chrome.exe	41
PID 1600 wrote to memory of 1852	1600	chrome.exe	41
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1972	1600	chrome.exe	43
PID 1600 wrote to memory of 1892	1600	chrome.exe	44
PID 1600 wrote to memory of 1892	1600	chrome.exe	44
PID 1600 wrote to memory of 1892	1600	chrome.exe	44
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45
PID 1600 wrote to memory of 1536	1600	chrome.exe	45

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
PID:1316

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:564

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x594
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\BackupRepair.wps
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5a49758,0x7fef5a49768,0x7fef5a49778
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:2
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2184 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2412 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1444 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 --field-trial-handle=1192,i,10906639725110236552,13644910806719037523,131072 /prefetch:8
  2⤵
  PID:2592

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
8d1040b12a663ca4ec7277cfc1ce44f0

SHA1
b27fd6bbde79ebdaee158211a71493e21838756b

SHA256
3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

SHA512
610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
69df371735c6799ae71e244e883584ba

SHA1
c313360f747750539594afa8fe9a787f489fe57f

SHA256
907706d3bbdcc4b22f487c44e6fd616ce6142eee1d7cae694119083a841aab3d

SHA512
92c06ea1385449912bb3860bdfd004d369074db17fb8a2efd768e59aa57d7a13fdd3ba5df109bbef3407bd698b44303652e33dde8b88046e71ca6ceed3f551ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9

Filesize
472B

MD5
34a03e02160b8a663892701fee5efd3e

SHA1
a637b386296028c1ac666e8b9ebaff581635f871

SHA256
19fc6a1b5659518e23b9ec27e4fc8d8c15d01a76947fd85cf43d321d2683cd03

SHA512
4d9986006c0d54dd49bd2287a18eb8d2628a830a611e77504b874bb23131c868e21af523bb84074c527a982d9aae31d1206991f9654154eb74e56d40550d667a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9

Filesize
472B

MD5
627baa6991c18e5e61e3378dc24bbcc8

SHA1
6425634ba9467b899a9c03f015a162b173d50554

SHA256
bd3d8af77c65081b8f3bca5211c9340a8e8adb164156fd2bf4c0cf900595a7ca

SHA512
0b35651d56337ed47e0cf0f78034218e0467e41b17c8bd45e93b94196624ebbb962fd71ea2651b2359ac152040f13656435d4f220907ad65e27b86183948340b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
7fae3263373efbf09c86f8125e4bcbe4

SHA1
dafc80114b05d5d3cbc3b5ae8c5a05e5487fcf73

SHA256
cd3cd8e818f8aba28d19f098ee159fd4b38c058ac116b3e6c15f9ef54e6027bd

SHA512
28e8c4f0d4677ca39edad361681cc8ab0e324e9a909a9ca2f2e40c6cf9c23c080da55761845d11d3f091ad453e348542dd616ac080bb34182204b5facc7380ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
0c7ae41076e2fcc7e3724d398ffa1026

SHA1
8966e6d508a37ce41a03ec6f2c7250c653214572

SHA256
8751d1faf096b322eac4c74f4b9355f99483292f395f8183e6e44e3b65015ac1

SHA512
fd8f27a925af8a94e4f89972ea31351d0b37cb06f4135b3bc08cc510c93047f7897d508714cacee30792e6c792bcf5058028632e1c8328c91168945032183e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_5AF4A202BBC43FDC0CCC038EAC137D1A

Filesize
410B

MD5
1ae7fec4f1d0a1279d6b6c47d78ff206

SHA1
37991febe72b645ca679c3247a5c5278d85963b4

SHA256
5be1d715f9927360ae263bf54cbdf3e9b0960201d4a48e4dc8ddbd9c5a4759ac

SHA512
f639eee26608ad4efe72a10c3a758e0c5878997c2b94a504a74df50bf61155c8c301e2f0608e65833c15cca9fbdba7c24cb3c8ab29cfc14374c91795c519b068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c49f4d4a97fae1a6e21ac86d9389bdf5

SHA1
011dbe012bdacd25ff3c321348c8c347017fc6da

SHA256
9952a530d65ddf4e7fa700911b4b7166dc5113d06b2e315c7c93417227928ed4

SHA512
7cdd6ff15fe8feae9ab8ec3d2b48cc0b8ecc0e0b4d26fd04b3a40e75e7744b8d0abb1a840d57d8add00611e02e545dbd38ef3efc40addd0c76ecf3f5eeb38c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2ed63dc430b866199549f1c8b7c978e6

SHA1
1eb8edbebc8d4e216febe11087f914ebd9a40a7d

SHA256
c75f5764fc4bba16e522c6f8d4ccba775b6250917bf5817f9daba655e4d9124d

SHA512
e52d17873eaa10924284cc14d0361f5615915a548ec7a1426648cca5cd004f9cacced9332688842d2536ee0c30e4bf6e805609711f860107861d629779dc16f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5e42fa69d0d85677a2f5aed938a89be8

SHA1
b8343d02bd47e6ad3d71afb0691f55838c9de08f

SHA256
2dd25560288fba0e8bf528ec84edcc3f4af7641fc1e022cf16ac8e99d8b15774

SHA512
9422f90baeecad48702d448dd863deacc50990c6056e18e05293a5532aaa97d1705588df86b977fbc33fe55fc413e601093f5c8159dfe9a98c5043eee21fcb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5bf192535a5d1e66a6ec9ab30bda1a60

SHA1
fa9d60ff9cd834e92cb3c2f67f8101fec099c48c

SHA256
99accc10db46e7a084ab47d65ad0c0903025d7626047673d2a002a335466977f

SHA512
699fdb14644b1a0d1b60c23915779b20cab525ab90dc4e9d47022571e2e837068a6cfed7cc804dbef486616937d7bd94919ca29959f42cb898d81eca44fc0165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
63d5318fbad6be41b60eda9700ab541d

SHA1
32110bb49561447ac3abf057dfdc29666cd7da3e

SHA256
ffb1697c3cd2bea8c069b1b19d03c1da85cd00351350d78cd7438f273d620e66

SHA512
68fcb1aff19d0992f44d5e3ee224f965d6dbb1b195c18262f6850fd14625b5949ae5bd2ba002f1b450d995135fe9e9dd5a13baa599ea0dcb69558f5e08716116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f45852baa7904cbcece8c0e404ee18d8

SHA1
10fe96c7acfea5e69993d19d8aa56f6e3c92c4de

SHA256
56431b41c2cc5f07430a29a0d1ea8e98338d478255460b22a6cacb33eaddebf9

SHA512
b9001f332bbd997f165c04c4d709accb933e9b7f17686153c8a92f79b8b40eb680606ed9ae7f3f2d84bdaac352b02c0345ce16fc844612885b8b452fe6f04554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2814c30f9c037686eab487f735c06e03

SHA1
a51c7a117e70f8faf1551bfaf24aa0362e9e05dc

SHA256
77d7638b033aacef2e8ecdbb546f916a562a3a44eeea937901b0e5c0ba0d7dde

SHA512
6685d311efc16ea7966ef28ffe9b357dcb84d439df299ec27249d98a5b957813e54900c53595678254ce29a3a49b8cd443c08ffc62618305c328bdd2b60d3af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
10d910086948a4579434a4a21d184999

SHA1
70c826ec3a53ef63faf61440fd5f213bf32a345c

SHA256
4d9eba31bef24dee6017193a1fe572625ba54c5d8011e09d4fcb6fc694cce0e4

SHA512
fce571a7869b791df2a77c4e9730c6591107f7187251e311d70a2e0d694be1c03a7b7e81187ef8c9990091fb46c6302afd6bbb60536d7cdd4f9e88b697bc5d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f6a1cd9bcc670bb4acebbf89f23cbfe4

SHA1
a790b9ee53739f6966cd7f25c976aed73a9b841d

SHA256
b70ff8c2e874e095b819ed80ab7c33921f5308a2cd2fd45966eb4441c9c83d34

SHA512
8ddf87c5ee458ed6ca9d14d66da86c906cfdfa57e4f2c8b38dbb8e934040e56e57fd6fc02ad662d46cfc7da8a0bae986b984984fd79081dd9ec9fe3004943cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ade013b98baba7c850343b8c1db5c5f9

SHA1
6ab70aa564787c2b2eb67d7d8f2ffc11a56ec307

SHA256
29cd0d96d751f6bd8a645fa8a8d5124ad688a10d9d03ff71e88cddf2e8e4ab06

SHA512
f0de7d124479884608d152907626561e9944fb320d401fc944721af86076dfe67edd4de5e24d59f9b0f92c7dd20be59b2c35068bca4f8d45458a745a969c0b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
22c659a5221632e9cedbb2b68defea8f

SHA1
9e0b65087d7c65302d2169f3355dcbb1ddda0673

SHA256
b7d463f9dd97a4fa36622ea573e6d1a777371fd52db67447346646fbe3d08ca1

SHA512
04b824b927e3e4d745e16f0330f12590db6ba255a7e307a30dc0e5788ccfe9ab48e281743ae4ac48bad3c50aa48c7fd998841dc4a054bab3c13bbc2554cca55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c8f815f00f6e96aac0a023325a219b0f

SHA1
79fccecfcd7c4e4d0b32f84e4f690adb025e6aa1

SHA256
f7cfc4460594ad0b86e04c5dc126099ed0d67d6fd5af98714ccffe8f3522efc0

SHA512
030534c67972ab1223b195c9caf45bafe0f9df491d84aad5ecb2bd3bfbd09b64f850b2b28a3fec651c6a66025fa77f6db19531dbd1b02d460118756c272cbd54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7bbc7c75cfdf50d386c8b799687c832f

SHA1
5735a41878a89c0da9055dbfe3a0f4523bf96791

SHA256
674afef4e6e34b3001de588c62e2e4584022a9d6261435a4948a6d2912fd1763

SHA512
e5152798e91c72dd0af78bd15e8ba7a70ea771747328d5d428a7266820b8ebda7d67bbb32b98254903961377df0d545116c4b8af3ef4bbaa8cffc4b3799ef372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9

Filesize
406B

MD5
ef159082b1be50ca8498f905db8198ed

SHA1
a51df94a80d974908a58f2b41380cc1de92ac2e3

SHA256
caf5a16cd6e7f62100660ebe2743b4d6a533b3e4a6c728c30fea5f535f9e43e3

SHA512
2801ecbf5e7034b77b64c11e4541aafa784173dd943f402fd43c6957f14ec0fc63ff01780c7356980709a2f82118d56b25d5b62bbde6a4a4001979f491e33f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9

Filesize
402B

MD5
f51c0e8aae86698cdcaebb4f43eea26a

SHA1
19411783ce2cb73fb92ab62eadc5290601a79aaa

SHA256
cc8b31c5fdbb6c23e50516e542bcaa386a60e671ea4b43e253197fefb384aaf9

SHA512
b48c678d9dda4c446756270595b95e7fbdd7cb1e1d0e1d13cf8709270cdee348f983207db32ebcfe185acf84719041d49d389474af96f01088bda80725889c6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\puwo4pk\imagestore.dat

Filesize
3KB

MD5
114a3e243cf8a692b95ef80c9e5df259

SHA1
e3743b6a5d95381d654c74f302a62653eeda1485

SHA256
c88c713b0709eec77dea4b2f23e648c3161945eba9bd1584ceadda40c658e4f9

SHA512
fa6f95757faf71d5691a5b18b52dedcdad99d47470a375547bd7f85f88fd8fcdc9b051bcef8d87cdf5283ee60e08598dc3a2b040fcbb48ebef5b4b0e68ec90b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4UQ4J2DQ\f[1].txt

Filesize
188KB

MD5
1c1802a0faf156df89d9f414079be353

SHA1
4b7d6c392446cd187b5cc2d76d816ebb2716c3ba

SHA256
fe28c7bbe12921c3978ad81828e66f0897e89382f2a17fe3b30678da743022ce

SHA512
a4ee2202213405c6e3271daf29df3ba22a8fafcbbe44e46b1b51afba60a19a6fd7a6b817a4426cab7076fc5aa71930fa6e557aec34f68855c87d754842d1c1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\xmbc[1].ico

Filesize
3KB

MD5
1279bf31d9659ad2017369ec1b90473c

SHA1
0f21c5a8266c36af7909118899e1fa07590f2df8

SHA256
74e3162830413f502277c221381f07b34d77a155f5cbeca379e1a4ffc29af116

SHA512
18ab594628c7873c56a85cc748585a3422f06d3f3ad70e5d33e86bed8bb9595d43513960731db89820d89b2ed950b48d6b891dbda768164f968ab06f5a86c277

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1A5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1D7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD66.tmp\ioSpecial.ini

Filesize
696B

MD5
74f1613e4b5ea43dff8491d62babfd7b

SHA1
b398d3bacfabd4a285281797fb4b5fbb5f69f9ca

SHA256
6779efd0b53461fb6aec8d30fcdeff4c0590c6cfd6e8cecd17cba2f8c06c9757

SHA512
6141802d176637158a10038e31f0af79f05129420f366e999d396cccbeb23b3a0472cef45d99bcca43964eb160c8b3b34393806cd0ecb2c271ef6ed796c4c07b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD66.tmp\ioSpecial.ini

Filesize
709B

MD5
d4a83ea7b165ecdbd39ed55c716ff50d

SHA1
d5d7897149f869371be86f0d6ab35697302a24eb

SHA256
47c0a173c17ea833cb2f00ad58efb38b45fd222385ed05a9ade453dcc861a6de

SHA512
846b1c328f374b575b406281d7fdfeca5e44925422899ee0ba96eaff3185090cddf49e0459c27c86136ca218c399ea5659c039dd6b52abd509385d020406bdbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD66.tmp\ioSpecial.ini

Filesize
726B

MD5
1594272368f1876ddef099a2f42697ca

SHA1
6c0da955b0c66c293e6e253b62364e61b552ca2f

SHA256
395a36da4d53abf0e6049d85a424b9a785057cf52d2e94695b50e5f3c42e8e48

SHA512
1aa2a31934cafe9e9e409858c3e6a65757e3217bd934b66386f3a8c870647384af721f5643582b32c423bb9521f8fb1ea230d5b050c3c3c74ed58209dafb1cc4

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

Filesize
364KB

MD5
80d5f32b3fc515402b9e1fe958dedf81

SHA1
a80ffd7907e0de2ee4e13c592b888fe00551b7e0

SHA256
0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

SHA512
1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

Filesize
1.7MB

MD5
bb632bc4c4414303c783a0153f6609f7

SHA1
eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

SHA256
7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

SHA512
15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

Filesize
1.0MB

MD5
d62a4279ebba19c9bf0037d4f7cbf0bc

SHA1
5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

SHA256
c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

SHA512
6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe

Filesize
74KB

MD5
bfffc38fff05079b15a5317e279dc7a9

SHA1
0c18db954f11646d65d0300e58fefcd9ff7634de

SHA256
c4e59737ffd988ef4bc7a62e3316a470b1b09a9889f65908110fba3d7b1c6500

SHA512
d30220e024ac242285ea757006e7da3874e5f889951de226d48c372a6a8701b76d4a917134ecc1e72c6c3a8d43444762288e7134a25d837e9f43d972675c81d6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoDD66.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nsoDD66.tmp\ShellExecAsUser.dll

Filesize
7KB

MD5
86a81b9ab7de83aa01024593a03d1872

SHA1
8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

SHA256
27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

SHA512
cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

Download Submit
\Users\Admin\AppData\Local\Temp\nsoDD66.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nsoDD66.tmp\nsDialogs.dll

Filesize
9KB

MD5
f832e4279c8ff9029b94027803e10e1b

SHA1
134ff09f9c70999da35e73f57b70522dc817e681

SHA256
4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

SHA512
bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

Download Submit
memory/1316-232-0x0000000002A10000-0x0000000002A12000-memory.dmp

Filesize
8KB

Download