Overview
overview
7Static
static
3XMouseButt....5.exe
windows7-x64
7XMouseButt....5.exe
windows10-2004-x64
7$PLUGINSDI...md.dll
windows7-x64
3$PLUGINSDI...md.dll
windows10-2004-x64
$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3BugTrapU-x64.dll
windows7-x64
1BugTrapU-x64.dll
windows10-2004-x64
1XMouseButt...ol.exe
windows7-x64
1XMouseButt...ol.exe
windows10-2004-x64
1XMouseButtonHook.dll
windows7-x64
1XMouseButtonHook.dll
windows10-2004-x64
1uninstaller.exe
windows7-x64
7uninstaller.exe
windows10-2004-x64
7$PLUGINSDI...md.dll
windows7-x64
3$PLUGINSDI...md.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
14/09/2024, 22:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
XMouseButtonControlSetup.2.20.5.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
XMouseButtonControlSetup.2.20.5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
BugTrapU-x64.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
BugTrapU-x64.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
XMouseButtonControl.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
XMouseButtonControl.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
XMouseButtonHook.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
XMouseButtonHook.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
uninstaller.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
uninstaller.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target XMouseButtonControlSetup.2.20.5.exe
- Size 2.9MB
- Sample240914-2lz4ma1dkd
- SHA256 2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
- MD5 2e9725bc1d71ad1b8006dfc5a2510f88
- SHA1 6e1f7d12881696944bf5e030a7d131b969de0c6c
- SHA512 62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
- SSDEEP 49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3132 XMouseButtonControl.exe - Loads dropped DLL 10 IoCs
pid Process 3056 XMouseButtonControlSetup.2.20.5.exe 3056 XMouseButtonControlSetup.2.20.5.exe 3056 XMouseButtonControlSetup.2.20.5.exe 3056 XMouseButtonControlSetup.2.20.5.exe 3056 XMouseButtonControlSetup.2.20.5.exe 3056 XMouseButtonControlSetup.2.20.5.exe 3056 XMouseButtonControlSetup.2.20.5.exe 3056 XMouseButtonControlSetup.2.20.5.exe 3132 XMouseButtonControl.exe 3132 XMouseButtonControl.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XMouseButtonControl = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe /notportable /delay" XMouseButtonControlSetup.2.20.5.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe XMouseButtonControlSetup.2.20.5.exe File created C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll XMouseButtonControlSetup.2.20.5.exe File created C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll XMouseButtonControlSetup.2.20.5.exe File created C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\License.txt XMouseButtonControlSetup.2.20.5.exe File created C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\ChangeLog.txt XMouseButtonControlSetup.2.20.5.exe File created C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\X-Mouse Button Control User Guide.pdf XMouseButtonControlSetup.2.20.5.exe File opened for modification C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\changelog.txt XMouseButtonControlSetup.2.20.5.exe File created C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe XMouseButtonControlSetup.2.20.5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMouseButtonControlSetup.2.20.5.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop XMouseButtonControlSetup.2.20.5.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000" XMouseButtonControlSetup.2.20.5.exe - Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\ = "X-Mouse Button Control Language Pack" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\ = "open" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /profile:\"%1\"" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\ = "X-Mouse Button Control Application or Window Profile" XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp\ = "X-Mouse Button Control Settings" XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\ = "X-Mouse Button Control Settings" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /install:\"%1\"" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /import:\"%1\"" XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\ = "open" XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp\ = "X-Mouse Button Control Language Pack" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs\ = "X-Mouse Button Control Application or Window Profile" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command XMouseButtonControlSetup.2.20.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\ = "open" XMouseButtonControlSetup.2.20.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command XMouseButtonControlSetup.2.20.5.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E XMouseButtonControl.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c XMouseButtonControl.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c XMouseButtonControl.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2860 msedge.exe 2860 msedge.exe 2448 msedge.exe 2448 msedge.exe 1384 identity_helper.exe 1384 identity_helper.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 3132 XMouseButtonControl.exe - Suspicious use of SendNotifyMessage 25 IoCs
pid Process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 3132 XMouseButtonControl.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3132 XMouseButtonControl.exe 3132 XMouseButtonControl.exe 3132 XMouseButtonControl.exe 3132 XMouseButtonControl.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 3388 2448 msedge.exe 101 PID 2448 wrote to memory of 3388 2448 msedge.exe 101 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 4508 2448 msedge.exe 102 PID 2448 wrote to memory of 2860 2448 msedge.exe 103 PID 2448 wrote to memory of 2860 2448 msedge.exe 103 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104 PID 2448 wrote to memory of 4876 2448 msedge.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
PID:3056
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x641⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffee2e246f8,0x7ffee2e24708,0x7ffee2e247182⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:82⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17652230576440583372,13657500143313273568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:2292
-
-
C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3132
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4472
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4036
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll
- Size 364KB
- SHA256 0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a
- MD5 80d5f32b3fc515402b9e1fe958dedf81
- SHA1 a80ffd7907e0de2ee4e13c592b888fe00551b7e0
- SHA512 1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0
- SSDEEP 6144:tv+VkJpn803Q9eg3rX9FudjTLNjGGtOCiKTBObg:tvfJp8aQ9eg3rX9Fudjx5Tk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
- Size 1.7MB
- SHA256 7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8
- MD5 bb632bc4c4414303c783a0153f6609f7
- SHA1 eb16bf0d8ce0af4d72dff415741fd0d7aac3020e
- SHA512 15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5
- SSDEEP 24576:WB9zyuRx7jLNquqvzbsM/m0GNYbOVgmXUWU7mFNeSOML3QaYyipFovO:WBJpf7j+LOVgmXUWU7UDTQaviXo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll
- Size 1.0MB
- SHA256 c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0
- MD5 d62a4279ebba19c9bf0037d4f7cbf0bc
- SHA1 5257d9505cca6b75fe55dfdaf2ea83a7d2d28170
- SHA512 6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323
- SSDEEP 24576:k9YEYaUkALnN57d2KiGiccvn+KAUxZswMPOML0MW:FhnrNtScc+KAAZ1MPOML0MW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
- MD5 4dd2754d1bea40445984d65abee82b21
- SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
- SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
- MD5 ecf7ca53c80b5245e35839009d12f866
- SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
- SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 755a4871a6cc3c1c9099fd8668d3cc9e2c512f3e1dfede3ecf5d8ba3db4caf80
- MD5 3e7a8659ad95a2f29990cb33bb67ba64
- SHA1 107ae7069d5a201f9cfb7845d0aea63f4820a451
- SHA512 52800b8820ca17ecf8cfb08ecb2f85df5b7f17924363faf27a237bf07bb4291e1b577c4f29f97f5dc6dd64b6320f7cb91e1475db3635583b8311084361c06c32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 62de5135fc56090efc7ec3e213019c6312ddd95d5563258d04626a257b93de6c
- MD5 3d811941ef3599be7c5161c0277acf31
- SHA1 33bd75eda986b786994552eca1861a3a685a3ea0
- SHA512 17707cd7a45f51c500ec943df89e5b57913cdc7e7a22f6873ec112df83c577b6353897923b471fad1342de96707f8a6ba6a5a567da04285d638a6c1717b616b7
- SSDEEP 96:nzkR041oHTNwpvWMoiVmdeH44YAN7UWQyV+VDCziEwb:nzkRV65GWMX4w7ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 48182ff0ffb090db6646489c5566cc997a135f511ba94f9f3387eb9290d1d83b
- MD5 e2fa5e47ec98445719ff3bf3db9da7f2
- SHA1 fff7d0a01b5f8cf9dbf4294d42a72de5234b6d69
- SHA512 d2ffad74dda06b75f20db677a91a720ffebac6dff74344fe748ebc9043d5736daf80e7a8d4e467e7cb90f7f290145852fe62a3b19229f0b3fb29126052ff26a2
- SSDEEP 96:nzkRT41ofTNwpvWMoiVmdeouS1DUIb/244YtI7UWQyV+VD7AiEwb:nzkR06RGWM4uSdUk/24S7rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 9034b21a400f6117086dd0f5ddb17960c226c4ea606a81c84f3f94bdb3f0741c
- MD5 54f7baf90fca63fcbbe97f19cbecc84a
- SHA1 06e9f70d0f8f1c840ce8f7d4391c823952c38576
- SHA512 a37c107bcd5acce1d213341002fa170dc4d60582df5c5587196d6329d0d9e5486d3860c789f4243fb498a32b88939292780312a1f8a66215e01a8dbeca4e9a96
- SSDEEP 192:zoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCe2RUZ/OkqTeuLJ5cmZ:T9iIxuERzA83h09RZxY8oXq7JC8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\ShellExecAsUser.dll
- Size 7KB
- SHA256 27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115
- MD5 86a81b9ab7de83aa01024593a03d1872
- SHA1 8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be
- SHA512 cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac
- SSDEEP 96:GFZf6PnleKYcBVGKLyhkrw0qyz/sRXQVgKXohw8FFtkqCp:Gnf6IKTAKLyGOCqQomItQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\ioSpecial.ini
- Size 613B
- SHA256 da49fce65359213129efb85fe700c3caefe9db34000cc069030164d8a7cfe4dc
- MD5 741db8d9cf1bf0a75711bb3200554f32
- SHA1 83a1e4b8da6dd69a2373fcfb56cff67c921c214d
- SHA512 7cd121b5300d194499b86366cd9a76902f457ba4dcb2037b51ffb424d42b7362bfd0f2d4c511d394e60f7d3945fafc47c007b049e66af053d2cd8a402ca046b1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\ioSpecial.ini
- Size 696B
- SHA256 8d75af8ee0ba131f4b40ac4d729e891c7a58176466ad2f2f0000d26de812f979
- MD5 b6c96694002b9cc602b68060212fb839
- SHA1 d43323776d1c326f933b4449265276f86e6383cf
- SHA512 2584bd2fc36b8c3c2e8cf8b0166c24f74d7d9be500e057a7a7907968cda47b4dbdb614ab18caf922d62bb0d6941f114e59da39b08dd449be1ab0d52c4428c942
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\ioSpecial.ini
- Size 710B
- SHA256 d234a1eb8b0188419b174ae817ca1112a162e32ff9118d781974d792d1028298
- MD5 cccd725a27cf35e5a51dd2ebcdb8e92f
- SHA1 cb7ad7e86a7212bd6b7c66e300bf2dfe201bb40a
- SHA512 9ffac26550f3bb29951f2844288a7069c2f621bb94c08d986f33d7871f7ecfa4c6f9204c041cd9604e19b15af5ee236d1fc24e3856e01c0a216e20bd184626c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\ioSpecial.ini
- Size 726B
- SHA256 40e19d735c983c8b58d90745cf3afc0f531711774e8dd2e7dfa15464ebdd51a3
- MD5 96634f10d5185eba8630e299ef666bee
- SHA1 af0cad9a4b13f0d2d802c33992b71b6f7212ba34
- SHA512 41edd9681f3d2ee17acd36c2dba0e6cd8763be59e3ecdffbbf7cebe154b517207127392af286edd9f01b7a2b5ea9e32e4a6c5f676ec165baed60b23f2218a192
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsj900D.tmp\nsDialogs.dll
- Size 9KB
- SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
- MD5 f832e4279c8ff9029b94027803e10e1b
- SHA1 134ff09f9c70999da35e73f57b70522dc817e681
- SHA512 bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d
- SSDEEP 96:ytJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4yndY7ndS27gA:yyj6QS8HREf+BYYxbdqn420
- MD5 SHA1 SHA512 SSDEEP