2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

Analysis

max time kernel
140s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1196	Process not Found
688	XMouseButtonControl.exe
2468	XMouseButtonControl.exe
2848	XMouseButtonControl.exe

Loads dropped DLL 18 IoCs

pid	Process
2292	XMouseButtonControlSetup.2.20.5.exe
2292	XMouseButtonControlSetup.2.20.5.exe
2292	XMouseButtonControlSetup.2.20.5.exe
2292	XMouseButtonControlSetup.2.20.5.exe
2292	XMouseButtonControlSetup.2.20.5.exe
2292	XMouseButtonControlSetup.2.20.5.exe
2292	XMouseButtonControlSetup.2.20.5.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
2468	XMouseButtonControl.exe
2468	XMouseButtonControl.exe
1196	Process not Found
2848	XMouseButtonControl.exe
2848	XMouseButtonControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XMouseButtonControl = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe /notportable /delay"	XMouseButtonControlSetup.2.20.5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\License.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\ChangeLog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\X-Mouse Button Control User Guide.pdf	XMouseButtonControlSetup.2.20.5.exe
File opened for modification	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\changelog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe	XMouseButtonControlSetup.2.20.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouseButtonControlSetup.2.20.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000016d67-133.dat	nsis_installer_1
behavioral1/files/0x0008000000016d67-133.dat	nsis_installer_2

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Control Panel\Desktop	XMouseButtonControlSetup.2.20.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	XMouseButtonControlSetup.2.20.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Control Panel\Desktop\LowLevelHooksTimeout = "200"	XMouseButtonControl.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000fc882cf2c77ed73fda489d85f56214745d597450f0118e8067357d76fdf5a6ce000000000e8000000002000020000000d67e2a1757061622868ae0cab90445cf531fb9cd25979ceddd5103076656ef2b20000000a31cef20808da0b8ee365b9c0735766e381f51802d0ae220ac4d421e7fb3d4be40000000e85c60c1a1a1ae9c619671828e1bc70fbfc421fd2b9e0fb39231c31d0d57026cebd9a937fa1968c8645798354b403b83344bdf3ad41322ce6ac07064b7875a81	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70cb62e2b7efda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429959432"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0AAC3D51-5BAB-11EF-A029-6AE4CEDF004B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000704fd0ec29d9ea04e52fe7cda78cd9fd3b7ecf9856946b53a403de7453b070a7000000000e80000000020000200000009b103672b9d041e914f1e29800afa85a740ff61f22bc9f7c56b082e1657976e390000000046c71d7f3a4451d9e10b68d11555a2238cf4cf819ce806b45267d6bf5bb7bf5c981e74657cf72704cbf98d9438ca6d8f6ae2b2fabbee23bdc61048cedbbc33c01b532cacd40275e88d296af242252d150713124b8a4c840a265f0f27c4cdd5fb06cb10e92457bec9afe15ae6c8ac8da306ad1d4d3c6ecf877f31fc54d0b00239b8e7f2ccb872aae2da1e2d56f5d24cf4000000065adfd48701de03085289765f90c80a7890be79b074db2945a007d9152de2758fef209086e4de86b8523afb075d7cb780340f0aea33567708a37eca9c4b14173	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /install:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /profile:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /import:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
688	XMouseButtonControl.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1604	iexplore.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1604	iexplore.exe
1604	iexplore.exe
688	XMouseButtonControl.exe
1772	IEXPLORE.EXE
1772	IEXPLORE.EXE
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
688	XMouseButtonControl.exe
2468	XMouseButtonControl.exe
2848	XMouseButtonControl.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1772	1604	iexplore.exe	33
PID 1604 wrote to memory of 1772	1604	iexplore.exe	33
PID 1604 wrote to memory of 1772	1604	iexplore.exe	33
PID 1604 wrote to memory of 1772	1604	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
PID:2292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1772

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:688

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

Filesize
1.0MB

MD5
d62a4279ebba19c9bf0037d4f7cbf0bc

SHA1
5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

SHA256
c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

SHA512
6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
acb5771c8a52127cb3cba102dbccc154

SHA1
3177451c19df11527aea1ab025cd10a5627fc9c3

SHA256
d853c14eab5ae13609e653bfe516c3e30ed834ec130859a233ce297ed7fdbce8

SHA512
7bfe496c917f5b17507e7152fcd4eb5fca1861c2065ad7a4d862a65ca72fc49744f978853c6c5ae6212d49166e20b89dfca83efd22baf162abb5ba7d8e74ba04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
696ae1f61735ef47202ca3b3d290c277

SHA1
4daf5973b38aaefccb85a533a611a24b7a58ab97

SHA256
630fd2057f2844822ef5dcf340a7a7262831048225a733b414df8710840eb358

SHA512
aed6f160b0257cfda0c2ee53c1f2760b8fd6d0e1daa06d52cc18986447784e864f2d15d3b0b21e9f8c363e31594cc442dda8a52f75be616d8b5d92478bfc5cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cec9e223bd8d48264d0541be4bf443a6

SHA1
b0c133f272f4bb89a98cb8b6e0e4fa0644a62a18

SHA256
8a2f982f2ecb17745b013574238f1fc73d643b69e68a3995877f7a0f8c47a2e2

SHA512
30fca316e9683c4a10ee983ab2313f78d30bd8762dc1a3bb9c806401997421370cb38c0fc3e7d9f2e20ca3ee6d4e59e5028c4e2bc24bbc098bf50a6bf3e104fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b616bdf6747f776dafafe709108151b8

SHA1
02d5d95da92897ec32fb28559e1ec14ebbcce809

SHA256
867b1c30a24512d7ca726c2a68465f1a3cbc1106543672da3fa860b1ac321210

SHA512
d1399ce705c93a93b135c469a331e0e5d7cdd6989bcf523f6932909614c584a8b9c165c7c8c4f3bd49b84d2d7b3c5ae4506ba0b701f0b9761438a8d317649fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8703d4f90316fcc856c5aad8faab0a1

SHA1
db9efe88729b72fbf4839f16749a7a81a190b1b6

SHA256
8348641881003c6f8f8541deede451b135194792cb3f4090f9098011845c8247

SHA512
6a647afd4828885fb802f470f2530ed88c28803eac91ba3391215082ae01581e2193438d92e516b5e13ead3cb1f04457c3a27ab243e93513ff011b641d8fa020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab1d6ffec0e902f34facc97a246f0cc5

SHA1
9aa2b36dc18c4de5d20037962346ea05af5f2b9c

SHA256
c9d3a38378b72f30a4e7fd3b67dbded7a34e51a97bb8bcff9d50a9109bebae6e

SHA512
c7adbe0932b7a4ff2a82adab069aa799877032ce98f22f64a386ad41c7f8ad07fae22a4d6c750b6fb5de67d626476c0a849145d58d1170503334e0abf1cdcf9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce385633f8d43f4398df4dba276a8469

SHA1
eef263f4232503b4695c46d5f265946e80032b90

SHA256
57071d90a3a56068b8b2794a194f2e50743332e27a3f3b72635c4815af93e0ab

SHA512
06f004f0acce57ed50a657adec3d667a472c7b2b518e4d2901647841eaaca5229112d4919bb06a5e6bbb97210695ffab9a2768fb4724eac637ffb1e3ac0dd12d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd36c2d0a326bfc15350547e9723074f

SHA1
2e37ef547fed9f2ec222e9a4f443c65c05b9f070

SHA256
25426ca0beed1d19e51a8d6c24fefc33938b9982bd0a5b33efd9e247aaf92668

SHA512
5b9ae6cbed6fe53e55083ba733b4454a8d39ac1c961aaac00ff49592686ba61c908c1c3dc1976b112ebdf1eee9eee186ebdb43dc9220fae311e33fec59e6ba77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67fb5bbcbca6ed24baa9da2ee4f0e462

SHA1
c9da32f67ef3ac88842a3d395ea8b88e309291bf

SHA256
d061655c39dbc0d50f8b3fd07955c29f3840de6e912305675f5c0c5d8398cb77

SHA512
d89f0360ea70e08d9167b120e9c4867d8315da0e9203a4611ba02f4dfb81bd2ce10899fa9fef3cefc1a893f68ccdf9b4c032641c606b94f9d18999c4124349dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bfed6741848dfcd2ca21a221b1d56ea

SHA1
eb873553fed8824f0ada75b8315a6d23300ad290

SHA256
b43b992227e27fc28509b7e022e94cedea7a2e56ed1cb4b346b18dbc663be603

SHA512
382ddb8ca3cb21e99c242e73b0f3c72f5abc2cb689ed1cd390d0002ac49e47738bed3df5390665173ae3a00c9b43ea79595b5523b2c7a0faca82d36e19bd2985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
158c2db7240fa7e03a79be881d0414c5

SHA1
77518e3f01a94ceb7e613e5009e2ec5ccf7fe156

SHA256
1e4f370a6ccbaf0159433546d21e84b2031c10fd0fb02a16112642b936e53f50

SHA512
c24c50a5995a3b47048b5fabf5128b9be6bb6dd480b5fde07cae775773026caf056b7a6f2474cce5f1aa1e9024aac0faef7f3b98d14f05d035e27ba79e293e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be686b3ea405283de95afec422919cb9

SHA1
d4131e1f9579bb3cdaafa93e15f9e9ea1f6e8dfe

SHA256
f5a2f80aefe4f1ce960e4038921cec321bbe3600c035a4327871431ff7475243

SHA512
94352710917d953a2cb8d0a312a88fa25faaf9c601b90c05bdf6d7f4573cedfb3f9aa8cf8aeef7a98f19141ddc8ae6abc2038fb8d348b291d65648c4173344df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09053efe61992c23f5333143f0dd0d1b

SHA1
19db9e7758618743a7187f6aafaae5388752aa39

SHA256
f25ce4d6d05d4a04fcccabbc9e0f491b9a67cbc919f4f5afc06f60faa2948183

SHA512
25b7a6409e48e6312bc86ae3de4bd61f7f703de8accf67ef1809eba9adf097ca6720bc2f507e18de728d15f90ace097696c4e134e833a5e7ca15b0a937fda1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4701cb52e1b14a8b3bdd3bf4b82a5b3

SHA1
112ee47e9f774c1ea13534b5aae586f4753f8821

SHA256
b91f964d83f2433b915b1e7386305b98fc0453da02517c864278e3a9eefb12c3

SHA512
81b86522bc32ef1529acd78e1f47c21315229259054fe7c41aa7e3c353f6be3b4fc818d2abeabc77f3e2f8f2bf8a185a0fc28fa0750ef68750be24ad77052178

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fddb38b8216310cc6bd6b6e9c43d1a80

SHA1
5e07242e624d0f056c58f09a51cb7a5a3304fc32

SHA256
af2d939a18dfe3c2638a2dfff4bf26f7a04cc4db3495158169c73d7a02d78044

SHA512
2afa7ad49ff52a2c551ae06211210103dcb7a8cc86343f89642c62c1062e8030564f2b89ff21e48e30fb113ab04d1c0c95af92c98242f5e289334f67fe07a9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a21a42535c99d86bc05b8daac7b93483

SHA1
ea1d268075b867a43d792a300b32b2f0142a9311

SHA256
177948ea464194576ce368368f80da2cbdedeeb29bbd20c0eeddf1fa48c09df0

SHA512
4b0a9c6709ec4f67cf02235e7c163cda4fc0cf03817856d76dd81177963d87b00371c520a988cb87fb5a41b38f0182858aca6eef3794252f78d91576e2b4806a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54a07fed0ef796bc403ba2a12f73ad46

SHA1
fa612384e58188f2914ce88b61a9ff5293457549

SHA256
a1185d126b8efa1514b913e6fd15fe89429b3e3cddea195e55d2bd86e3a9e167

SHA512
77e09169b860d6be32d685ba3192b2c354f0db02f9303240dda11bfa70107424858ff1c73804cfb9bea4d8680ed8c51cfac0625056d1c82dfbb99a8d2c1445af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ba21a0023a334989fc213160c20e1ac

SHA1
cf928b8fae010c9e6b010624f01ac25dfc346d4f

SHA256
2ec5e816b4771c0ebee8d4d31ba8c518f7b9743634b13ff3fa94b1b35cb75f75

SHA512
cdde1f7796a87f6c8be6d422223e3d3f94d293bb615c551730819a9cce349c0e98d2846f7817132a33f797011257da3f14293925be45f39a59eb26f82346f255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbc736e254676463ced683a59387a171

SHA1
fe1ac3dd3fffc18b40e4fa5f6523b91bcb9e8646

SHA256
82eea74c4b367a2ef17a489b841b7890d38d81098ffbdea86e53d42b21e425f8

SHA512
0a1b1704bf0b903b04ad7ccfa5fa8af5f3f090359f120ec1bd2f49b0b93aa34b9f7e544c583a12a12e218c9091b4767421570e5e7c3fc61ddbd709769d39eee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6750f9bce05f88cf724a2c768017c31

SHA1
775920021d9519bb9d615a62cb6b134a8a35dad5

SHA256
cc2b2c510b83acdde6e261af66429e5fa542af7aa165084dee51009f59d3063c

SHA512
66fb60eaf7f49bfc037e23f4ba4d603f9cec9a80da508880fb28cf7e24c8085b16255820d790d7ed128b597861f5778e52bdb876699ee330945e5ca760fe201b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fdbbcd5dd5ea1505ad0d136997187a5

SHA1
b90adc6056041bf24ec386b4f167ee275806a317

SHA256
c9481da38ffe1842a6ccc34b1f3aa9d950eb1bac2bd5af55253d37ac679e2970

SHA512
290796f24e9cacc66fec32676096380745362492b307458d961a9394086ec79250987fbefbc88fb512cddc88c76277fe92ba126286cfb75f7150dbef92ffa3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7675f7a506e52e4470c4335082b8314a

SHA1
cea3a46576e6b76fd975bfe6855ca7f325f9c382

SHA256
04c3678ddd28af02abc4ba804f8db124f3ecef647ee8ff8e31607e220d4d27d9

SHA512
2d2fb08583171973d4d916d30ddac26272b6fdb7a6f3eafbbf5ad574d989e5c6fbbaf5a12f868a12b4799689de6853a7ed61d61357f55ab36ce01f942e44fcfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dcd1130410433dff2371e5d61399071b

SHA1
7fe9ce26660dcc1cdf3fb6736cd67950f6143185

SHA256
067d70675a7d369d52e9112a840567621747d6c408f2301ce42bbdca3d9689a5

SHA512
e3bd28b9924830ddcf3f494263249c18003293452cca745f1cc79b5e904ca388b17fee24e0fba0ba5506b09ea4d50b7162f0aa5592eae846c63851cb4d1f0364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\c2sxdb0\imagestore.dat

Filesize
3KB

MD5
fa8451a3663df704b6951859e4d524b3

SHA1
22d3d9ac3ea40029d0ea96f91ca2f67267cf10ff

SHA256
4cddb2836a322478d159bf7e62bc11e10e515489388de8ff1b095beafd4cdeab

SHA512
be812895cdd9dfcf27f7735c4e01f10822da932324ecb4d1f3b54efc75cf90ec5e04d23e88586e357669f234f86716bf30c994d0c397f1c801aa78abc6ba33d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\f[1].txt

Filesize
185KB

MD5
703024850166cd5551a13fcb8ccf24f0

SHA1
0cfbc0067572b81550ebd3a91d651f4c34f032b5

SHA256
3477aefc8862cd012a672ea0a0e6605da662f8ddb10dee7cb6902f26fdec9bf5

SHA512
cbc441dba8542d94895edcfbeb19b8e4ab1351d27106079f8b90542907dac3535aaab9300fcea5e7979c2ebbe1f68cc91a7b285e454cd7cfa5ca70d5c2310e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\xmbc[1].ico

Filesize
3KB

MD5
1279bf31d9659ad2017369ec1b90473c

SHA1
0f21c5a8266c36af7909118899e1fa07590f2df8

SHA256
74e3162830413f502277c221381f07b34d77a155f5cbeca379e1a4ffc29af116

SHA512
18ab594628c7873c56a85cc748585a3422f06d3f3ad70e5d33e86bed8bb9595d43513960731db89820d89b2ed950b48d6b891dbda768164f968ab06f5a86c277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2906.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2928.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\ioSpecial.ini

Filesize
726B

MD5
8fd19393d467a4735311b0d9ff24ba80

SHA1
e3fde8f95701f1e216e67217bf5fbad903d0b98a

SHA256
e0d6d92efc3f14fd975657385e00809425f53594fbfb3881464c46b9662f585b

SHA512
82b079d40f90bf000faccd9d15e1601d595c3a3482b35506718e7bb73b650dca22fb515289350bd2a1c69cd4efe95761d7f68d68f4d2642da49b8d22f76c4d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\ioSpecial.ini

Filesize
696B

MD5
7825a60d811e0f602bdffff63b4ff03c

SHA1
0f420ddd17c2412a1ec7c6a26e778298e9dc840b

SHA256
6f336f322cd4148bd2c91cebb8dfd4e5ac695344563a4752de7a1a734de92c2c

SHA512
65a45070a1f104eb4bd4b362088504beaf05cb09ab836ef84879a7788510a7608f9509821e427ac17179e4d75e8d393dd59cb170e2f1c48471b934abefa9d0ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\ioSpecial.ini

Filesize
709B

MD5
55593d139e6117b66ace5f9a99b61af2

SHA1
0734e43a1321c7837ce4a4bfd09d0fd64026b984

SHA256
72656343f62f200e1263b9cf20d8396e564169202de08b2dd0dbba2bf12469ac

SHA512
0e148c7809750b3dded30c63890218b1b1c1a9c2c19fa963faec9d21a14e8394d726d5698c4ddf9700ba294555daf362f4586cb385b4987f7710662dfb8b9334

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\ioSpecial.ini

Filesize
765B

MD5
40117acd7c8fcbcee1cf4ed20341af06

SHA1
de6c7e148ef443bec6cc39ffa859c3703152628f

SHA256
f0c02302602d6f9aa1da697f7aa7f3b164486c8976666a55854321ac3369edda

SHA512
79303c8fda32d29056135030a2b1875197b13cbd395a68028c273773bbdb6c26c5e7724ae22aa9445dfc8d977d5f6b63e2d03b28e8e596aee07fa3ee9c647577

Download Submit
C:\Users\Admin\AppData\Roaming\Highresolution Enterprises\XMouseButtonControl\Persist.xmbcps

Filesize
16B

MD5
4ae71336e44bf9bf79d2752e234818a5

SHA1
e129f27c5103bc5cc44bcdf0a15e160d445066ff

SHA256
374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb

SHA512
0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

Download Submit
C:\Users\Admin\AppData\Roaming\Highresolution Enterprises\XMouseButtonControl\XMBCSettings.xml

Filesize
16KB

MD5
f3c5f9b547b1a40621f0404e72b98610

SHA1
bdfafcd8d846064101a7c1070852740f61dbceb0

SHA256
c943e435c83012fe4b7e05e12fe2a5df22444e57a3c5a8191dd52e0ee46e857f

SHA512
dfc72b83b2b1f8d356b7138dcbb2fccd191330c865330f25492a161a57de3cf2e926fa72581b628842386b29f7185b1238cfcc521a7f5b77535f66c899867bf9

Download Submit
C:\Users\Admin\AppData\Roaming\Highresolution Enterprises\XMouseButtonControl\XMouseButtonControl.log

Filesize
2KB

MD5
fb6111e1f23487bb1d1b513dbf87e122

SHA1
a648149d79788911e0c8cd1dec2004bb8003cc5a

SHA256
08c0ae8e22c65eb7d33fa03f1e78d2a603358644aac115aec9d112729379984e

SHA512
5f4c74ea5c88f5ab759a9c2b35eeea7b14ced9d4fe4c93b9898996df0f546518ca2aba211a725ee722694b37121af678d54604b4d19f9d9e2ace4047b5ea175e

Download Submit
C:\Users\Admin\AppData\Roaming\Highresolution Enterprises\XMouseButtonControl\XMouseButtonControl.log

Filesize
6KB

MD5
e83b9c7938ba18eee41dfa58cd28c9a3

SHA1
a2179094ecca68a38be621cda8c18de079fdf0c1

SHA256
783eaace5a5da39f7c9fcf2ff2b9dd1c17b7cefa19d2d2660796b2d37f7116fa

SHA512
db193ed18df48358180052837a53e36d08153360c74cfb3993a8ecd09943515d1c91f274e1b50bdf91a300dd93b2af089f2c3da3de4f97ad01a8507f2043ff89

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

Filesize
364KB

MD5
80d5f32b3fc515402b9e1fe958dedf81

SHA1
a80ffd7907e0de2ee4e13c592b888fe00551b7e0

SHA256
0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

SHA512
1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

Filesize
1.7MB

MD5
bb632bc4c4414303c783a0153f6609f7

SHA1
eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

SHA256
7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

SHA512
15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe

Filesize
74KB

MD5
bfffc38fff05079b15a5317e279dc7a9

SHA1
0c18db954f11646d65d0300e58fefcd9ff7634de

SHA256
c4e59737ffd988ef4bc7a62e3316a470b1b09a9889f65908110fba3d7b1c6500

SHA512
d30220e024ac242285ea757006e7da3874e5f889951de226d48c372a6a8701b76d4a917134ecc1e72c6c3a8d43444762288e7134a25d837e9f43d972675c81d6

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\ShellExecAsUser.dll

Filesize
7KB

MD5
86a81b9ab7de83aa01024593a03d1872

SHA1
8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

SHA256
27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

SHA512
cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE6B9.tmp\nsDialogs.dll

Filesize
9KB

MD5
f832e4279c8ff9029b94027803e10e1b

SHA1
134ff09f9c70999da35e73f57b70522dc817e681

SHA256
4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

SHA512
bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

Download Submit
memory/2292-232-0x0000000002850000-0x0000000002852000-memory.dmp

Filesize
8KB

Download