2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

Analysis

max time kernel
97s
max time network
106s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1128	Process not Found
964	XMouseButtonControl.exe

Loads dropped DLL 9 IoCs

pid	Process
1016	XMouseButtonControlSetup.2.20.5.exe
1016	XMouseButtonControlSetup.2.20.5.exe
1016	XMouseButtonControlSetup.2.20.5.exe
1016	XMouseButtonControlSetup.2.20.5.exe
1016	XMouseButtonControlSetup.2.20.5.exe
1016	XMouseButtonControlSetup.2.20.5.exe
1016	XMouseButtonControlSetup.2.20.5.exe
964	XMouseButtonControl.exe
964	XMouseButtonControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XMouseButtonControl = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe /notportable /delay"	XMouseButtonControlSetup.2.20.5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\License.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\ChangeLog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\X-Mouse Button Control User Guide.pdf	XMouseButtonControlSetup.2.20.5.exe
File opened for modification	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\changelog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe	XMouseButtonControlSetup.2.20.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouseButtonControlSetup.2.20.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00050000000194d4-133.dat	nsis_installer_1
behavioral1/files/0x00050000000194d4-133.dat	nsis_installer_2

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop	XMouseButtonControlSetup.2.20.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	XMouseButtonControlSetup.2.20.5.exe

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435186896"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508d51fb421fdb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000f8b8581f5e0bee6316983e59ae4ff8a3749588f6b48706601ceb970c741bac42000000000e800000000200002000000066a663362b8e5813398cdd807275fc3d4c5305811f63a3ab0e063e7a40ccdc3d9000000034b507cad10bd75dd590044a29e8c55f70621fe7fbf91b02892ff7508d70f1f9cc39d92ec2e726e3001295ca94c0e418037d0754f22474af912dee7c25043f0db45af24033b5701eb84f1d13edb4d6825d27d1c626709d50331818291c9f8f25714876c4e42042efea9df8d91af5f2245bd8879fc46f7610f290311d6d932deeb32d287e04d516309865249e0678a2aa400000002990b06de66727f77931df1dd17f25eca39a4d84802578b18c82ad073efd9269c6730225f0dff62df4e94b0252da6ee599e0495f9bd4fd1489fc6e9367ff6ce6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D83FBF1-8B36-11EF-8EB4-4E0B11BE40FD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://roblox.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = a0c741fe421fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000037789d7bb0e9036393ed81a6afd1d0e0badc7436d65ebcd2624e99101eecf813000000000e80000000020000200000008e463038c20c7f55795952313bd3a6740f9375af98c2c7ea0c1dc42ca44f7be520000000108cdfb36993c92ccc923a7b4b18b1204f5e72f506878cf70b5cd12f3b6411d540000000d05d7dc709c26c564982deead678ec0c346ca9356de5d0730150649e3bd11f636fded01e9f7e3cd4f7c027caf66ab086be19adc26168c650cbbfcc944ed118f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /import:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /profile:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /install:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1172	iexplore.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1912	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1912	AUDIODG.EXE
Token: 33	1912	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1912	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1172	iexplore.exe
964	XMouseButtonControl.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
964	XMouseButtonControl.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
964	XMouseButtonControl.exe
1172	iexplore.exe
1172	iexplore.exe
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
964	XMouseButtonControl.exe
964	XMouseButtonControl.exe
964	XMouseButtonControl.exe
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1172	iexplore.exe
1172	iexplore.exe
1172	iexplore.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1468	1172	iexplore.exe	33
PID 1172 wrote to memory of 1468	1172	iexplore.exe	33
PID 1172 wrote to memory of 1468	1172	iexplore.exe	33
PID 1172 wrote to memory of 1468	1172	iexplore.exe	33
PID 1172 wrote to memory of 1948	1172	iexplore.exe	35
PID 1172 wrote to memory of 1948	1172	iexplore.exe	35
PID 1172 wrote to memory of 1948	1172	iexplore.exe	35
PID 1172 wrote to memory of 1948	1172	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
PID:1016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:537617 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1948

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:964

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
51cff899455048e33bd1ba14f8acd31d

SHA1
ca53d1c08ffe3865c8908774c248fdfb1f89bd10

SHA256
68f01d97449d25c131dbda38bf6cb05a5a0b32f056e76124f57325e5b97bd7a7

SHA512
a23fde9434fe75be70a40e8292dc2ef77eab25f9f08563e421f095055bb347aef15fde18dda2510c84859b0fd64a2ad567476053efe6f97681228fb72e1f3533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc2e255ef8fc3a64bd8b3c31cc001761

SHA1
56b4c2f572079904a1f4128222852ca1d4505fb8

SHA256
1d7d06f7fd57718b8311daf3f2ca90a49f83b96f72421d874f5ad66dbc3d4063

SHA512
b8aed56f03f59243fce64d0b007b371b3a27d6011682750ea8596bde2a3a2e5b4044ecd50fb9094604c365717c156abdda358a39470c94a02f158cb076203474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
803321cb42480348644441f4e0d79c53

SHA1
85002503a193bfca92cf951157e21d65d18e38ca

SHA256
fdba0f9b6123855d5d9d0b465d7d1e7fce40a57b822441acfeb0e4789df77d2d

SHA512
66daf9ec19264c0b401d73268219060dba4e93fcffaafada592d7d9fbf01780c191e609aee3e6d2f37e2f0860f4733ff067a25254744260411f52ea0dca43fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38dc849167b90d5060d78011a5b2ec88

SHA1
2a8cd34a892cefbf4accc613e3d55874f252e5ff

SHA256
aa454f1fa8f66e8d72f7338db0b0d5665861c26deaf4d312f703b10dedbc1321

SHA512
bfd7b5bfbcff02070e37903064f2e7646f1d21380af90138c1dd4d1de5caf5a312a8d98f205a2c028168952b234b0f71f3c0191071e8be479ff90ec380ed8fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
293733d0e35165ff03601684f792ac1d

SHA1
e48d1b73ad1caf5681010835ec6156799c5753dd

SHA256
55dc2add4fd03eafdad90140f94a9c199ac6bf4b69c938c079885aeb5ce9e1b5

SHA512
820958f458b3e8b7b61429046e7253f00e034a195540c00e9bc567b04e5c82b6d51e35be97bd61f18da6f1f3e475ac73aa8a39d450bbd49ea1d7a5c69d391a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed4aa557a2c3cc325087cc4e1bb83f41

SHA1
44dbcef79c3b5f825f0b1222ce392fdd2cb2bdb5

SHA256
842361e4fd9949b61e36113c7bbee7ffa23bd948b97ea0ba918d69afa0aa8c33

SHA512
57daa6ecc73329a26b34545ea828297c17b993b7fa3b0f34a3855accde3da427d1b13be250d390f6606ac428809fe33b810f05e3ed5e9db9f252609fc16d12f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25ee5f3582ae718f96b88c4eb8100377

SHA1
0c20553154469a7b93d5cf223303590584a10624

SHA256
d9e0b62eb4461af652bf1db19ecf07a27ce087ff1defa53e7fcf9049eef8dac5

SHA512
3f9c20f4c2f4606719da56aabaa82d333de88d96913e3340178e85b77f5eecbbaabad973bce804d19cc1f83fc804d414ce3bddde215657d1a31d4910ebc3fd97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77cdddecc452643288622e0107b7ec98

SHA1
f7a64cd236eaa9c47c5fd2aec13a21331ba5ca1e

SHA256
cb68c36f0594d353baa43550882203f6aa80f436d0a1af72df294ec87fd81cb9

SHA512
126cb755f9b5070a8c4353d0a25240942877d80361c4b6650af233b7a648f48bd5211c5b8fcce25a53737401020d691df1ab72244284f673c5325accf4e40edd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c33e2bd57b756036460e1da887465d3

SHA1
74f889d0fa5f57ed2587b5911c27e60b538018f4

SHA256
8f4e2503e2ef98edc8e41d5b02da0cdc969e304657e2bf0d137dbeab550ca83b

SHA512
466356c72706be1b1f4fcd5cb278f35b05d5e6c2428e68a9f3ee66c272ee4024ed127cf1cc43b8ba3ed2a555a9d12d81eb9a9b8a61c13521eb8447e69839a22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9497f4bf85a5b440d15c98091833c2d1

SHA1
86315dca3d509c3efbb4688d8eb50bf51c97f3eb

SHA256
935ee3edbe54a994a927b3e1311fb64d93122cbeabc7a68143cddecc8df0664c

SHA512
434162d843adf7acefe91da479b463fa974c5fd6fad794f00ee5ada4aa40a59d268c88f8a7b33905cb1ea8a0a3bfd56c524df0f9ee3df7f3afd8ed511c4ff545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d182e6a2d74f7bb26a9669cbf23281a3

SHA1
f9d3da6d363d67675ba5ebad90f33f93df73b118

SHA256
5e15873e5b7bf770762a7129a3313e18bc58ad0ae911429f0d0d44ee601ce99d

SHA512
dbb74211a047cd4707a8d16c1a51056b0d02f0aa93c6bfcdbcdc38322ce5126cbabb35a2c1a4a6f279970775ee382702200ef94ef719312249ac4a275f1fa8aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b5e994862f4a9a478a4e798846c15dd

SHA1
51e7529bc7b60f31a56e42294ec32b4e22a89174

SHA256
42613340869fffd738dd9690dac5bffc65882fa689f45e25f8ee2a4c05ed3e35

SHA512
ec5c4e61390c3440dd9f450effbdd4af9496e0b8c343be957c6141d618bd0af3eff1e39f8c2098b0bdd5f04eb7a2aa3e38bae1e989344d78ddb8dac7892030c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
017f59947aa6e24722c313fcac4930e1

SHA1
614e8672514bab74ede10bcaec801784a45b9541

SHA256
32a2400f32e8c90f7a2783a210168876cd828111dd42b63d29290788a7a4cb62

SHA512
823e03362191fce3b8aa876c7bdcdec43ecf619b525b46c2690ddbc147b1419828d7ed6bc3d6ead33f84445dc3922bfb1c9e9330d50ec63ccdc4e89fef27bcdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
637acc065e0aca3bbcc4eb480bdbd656

SHA1
e2a6856eba80f4ea67983608b822641d63c96f93

SHA256
3e2695a3ef27930b009f6f2ada9683c7f585a9b5c2cb517e40d39b74341dc979

SHA512
4127a0486d615937b33b830cbe6041d25a340a10457c2e17865d9dd2ee6561e0d7dced024706570e03ca297837875d4713eda5584017dbb55b29fcb66179f836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdb320598c58e742d4ea08f56b3e88d9

SHA1
c83668e0890fb7931723864753fec9e907e985e0

SHA256
de181e9d0aab1e6e860c9ade9a0a68954cb4d263fa730e81aefcddd1214410c8

SHA512
03c9ed12b4279b9268e726521c657fc1f5737eccf428124d5d0bb9ce16262c7171f2950f53e9687e9c49316ed99dd2ceb72285f723950e3c5ca206e13a32f54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29c6a136d9b9554dc1e12cfbfd580b60

SHA1
cb6cf886a53437a1321df21e32399774484bb298

SHA256
41dc1e8f0922ddee16d59f632f75523958370d5d00117290843663354157e848

SHA512
59dc7ba58da98aa2db517e8a908dec9f1ede825570ad4744e94d35cee55cf9db1d2957da0490cb011b42421bce06cd03166e5f6797fc1274dd51ca53976adfa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98327ceb85b3873c8a7af755fdc4cd7a

SHA1
ad00dc61318b929ac450142662e0b402900707ac

SHA256
18aaf9eb0cd6dfa3eb3121fa4ff8ad3e5713281a596f50c432ed8cc423d6ae9e

SHA512
38caf920a36faa7f17720cb94dc7d2a83bda406ef16aacebecc90070373e46211f9d478d9bcc5b32b071c5b475f69e3b5c2c7963d8ed5ce1076166d76bd57db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
add216e6743c2895efea3ca1ba5f1e26

SHA1
7d517d38c44bcf6a5afb9570a6cb5c6a1f0b11e7

SHA256
49bf936fc97cd03b942f8f209365406d6430a48e283688e7fff21ef7dbb5f0d3

SHA512
64290653cdda163c6d94a88c6e526b7bb25463383ff9f116fc8a85d03af10c5b6a0fa79b7eb33fcd408a7918d25ca994719aea3328291916d7fdc2a20a90fa98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ae4c2eef83eb1eb39dcba9b521f8f8

SHA1
cd34b0a97a4edac52616187765f82670046168fc

SHA256
cc0f463b53f6c183e04c39a1c82afcedf919262b76df5670e7082357e41aca6d

SHA512
d20a263de6f258f243458d8817a0624eee37d43af25b206794e2db1a222df33a1bbedba5e113721bf2ff5700e52ee0be97455dfe83095739fba0a681669510d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2879578250e9fa9e4c00f593b19d845e

SHA1
d6f5c5d5fce39ff7d9ad259e9f94f5af86f8ffd1

SHA256
d4584413fb01d7b971d2a46ca5c2877ac2e86d387c29cce4bc629215ecceffad

SHA512
265c6e65d4a8b4d9102edc8a0b33fa8714ed574c36b983ccdd6b50d954de4767617899b6a95a3c20f6e15e872aed8ae6a0b2282bedd41c01df9f9f3400ddf8ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fa6e8f30b63f57d4c4d4422d747cd79

SHA1
6ed91e38ebecde38dffb87f44002eacabd8baef2

SHA256
5bdd671c429b258acc3cde3a40efeb0e1745b21d34e9b21ad7e019177bed3460

SHA512
bcb2e58d4a91597ca10c025c4efc514905b8dc6a5f203a056bac7b8fa18ef94b1df3b81272a2451b01e7294af418a228c34fae966f8c93c31279103812323496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2019a461e2676686bd9cf7d6d421afe7

SHA1
0645fda2242dc883fcbf0d7e0cb35e2e689179ea

SHA256
c895c8bf448298ad0ecc58668bb94858ccb4006a8e3f63b5e1f3320ba8170c34

SHA512
7ceebc0df2df241afe2b1331687df1cc61f7db1c802eec6104076cbe7cf09801139377c7091946998efd144a19fdf2218de0e3f5aa42e299d75ed14954b16a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
883f6f5f798ff7dddbfd570ec1403ced

SHA1
d746d44c64574d1c09b02b7e27b1702b72137019

SHA256
8697532e6ef92593259afd6b4db862169eb3d3af82cd52202bd06d725857715d

SHA512
06c2d5979d36834297296d3c7880a9afa29b90cfce910d32da582b6363883df27903ba23482a93e045e8d8506dffa0f6536cf908909af7e1941e62cac1375b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbd3014d3917e26785f5450222dd0758

SHA1
8f3accddd7b897a57fe19a0879d0b8d3048de1b9

SHA256
b6edf99f8ab074fc24c8f66dd01a0f83e0d869f8bbcf4f30d0851c108d7ef8c9

SHA512
eb57595cf98cd3df26ad32c668843dfda6c939aeb93382ed003839069023602b61e091915ce02fa176742097edc8d739786b345c891b453f27342f98d386b413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949ba7a855dca57bc4e85a198762b0ed

SHA1
cce30c5d9fc91df77bc9850ccb24ec75023c7a1b

SHA256
3a1659cc778fbd005fd52e1de48eab22d9cdfde3157a76a306589beebebafa5f

SHA512
1080236e0ecace531973315a28271af65a98f4c23689b4644fa4e4694fb7f89847d6f4b2d3f060701cae86e9e8927d7b86b4e5151b7bde05a56a3d2ea9123b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c090dbb12a419537476b9683b36f2f4a

SHA1
accee73aedc40db59e6955ceec3e5c40369c6ac3

SHA256
2629906a34543c882e30443722f8e5bc95c4432079e6c40a9354a4df19530c18

SHA512
11a9ea667cc54522a0c497fcdfa11d0870114cf75b5dec1b3e01e1a7a9aad7382427fb15ef9aa4df23066dfc0abc2742d6651413d1216b8732955d8681c96c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c3e826d1952a2ddeb7f95adf4a101577

SHA1
fd3b0cc6ac52fdef718e707fb2e7a62c906a19ad

SHA256
dc84f137fda93b8a13061be7d9eb475a8c57ae875075d69f00225b8dd2cb1169

SHA512
2493312a4c3ddb7bf7190fcce574263f23eebb2533db1568c3090cd3eb7e87188152fd1aee57b57b18f74898c3b52e2af95a6e1ac0184886de3650b496c36417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
3KB

MD5
9e61bfdf98e68b3603398d4d55357923

SHA1
17e975a482d53447802fb2b6c681d4b36d60dbc0

SHA256
862a65354ae10b334033b8afa347b6024b7cc7926f792a424ba2b3fb8965c9d2

SHA512
42b5caf0e732ba76377d792b98c3d57db1245ca8845e37e6b65053045ca52f58da4059bd2977dbbbfed31b41670fcaf83ffaf3c5a6f5a2be48db3312e212b27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\qsml[1].xml

Filesize
533B

MD5
cb9012db6eabf4446674e489ecdb9641

SHA1
719e9d3ffcb11cc1ccafd047def8a46e9ca0da33

SHA256
db9344d76bf1607c02abfa56b986097428f46084bc9d3825a502ab1d8c3ec7ac

SHA512
d265f2d7371e81b605ecf3f959af3a7d9f4cc5b66855f5bb93a5633f7e6d0bc85b23be98710f67d7bf83527f2809a3910ca839365a36455a9a7e2bfba529e40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\qsml[2].xml

Filesize
534B

MD5
54d875ff3b7ba2d55bf0aff7b9cf9f60

SHA1
866c269212dc1f0ba23ded84d7eb2a4180d5f558

SHA256
b8e9bb7f3cb7b596d96d1f1fe477d8a8376feb7e11021d7dafc73b015a0ae99e

SHA512
3d11a20e8c87dac417ec902fff48e9a27a71befaf65f4f37a6fafa11dc1ee2863f6d186fddeca385d9de0159b16e1359593cc0b3edac8b80a52ffd9bc052a275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\f[1].txt

Filesize
181KB

MD5
f1018ee4b9060da44aee28ae4c1fa373

SHA1
40bd53560ddae629f4d504eba1f900b39f222c2b

SHA256
589088f33d96827a368ce92777e96d8248ad0f2d8ef422a9ce2a8accb191d935

SHA512
58db1f08bc792b469ee191c7129ef9a6a42c5fc0539c314bf0fc0862e3c4ce611c2cff2134374fca7ddbd3d0b537fb05f9ca9b0d98cbad283ac7d0de3063888d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\xmbc[1].ico

Filesize
3KB

MD5
1279bf31d9659ad2017369ec1b90473c

SHA1
0f21c5a8266c36af7909118899e1fa07590f2df8

SHA256
74e3162830413f502277c221381f07b34d77a155f5cbeca379e1a4ffc29af116

SHA512
18ab594628c7873c56a85cc748585a3422f06d3f3ad70e5d33e86bed8bb9595d43513960731db89820d89b2ed950b48d6b891dbda768164f968ab06f5a86c277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DD6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB01F.tmp\ioSpecial.ini

Filesize
696B

MD5
26a533e64f3b4214a214b81b588fc375

SHA1
9f98b03a7b94fa3cba47f22905722ca1907868a0

SHA256
eb59547353a3b416ffffba91377dd3ee6c51bd8534ae350c64e39e922b0dc73f

SHA512
b491463e175901e83275cf0a7faf9360a1bf23041496b9e64f28e93a2f211744b18d14ad1a6910859ee00c9aeb05e5253c6b06502f8d1dc1d27b71394c9a7a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB01F.tmp\ioSpecial.ini

Filesize
709B

MD5
92b8730422b674b56000cdc4ee092f1f

SHA1
a895d4ee88ab372fdb72006b897ea529a7ed0a4c

SHA256
bffb9bfb43a9f23ac3289ece57749b95828fc69c353a167b0ab14a9f6038ae84

SHA512
ccedcecd81de7694e64d5d83af1bf57b5b34dec2207b32bbe4ad49117a79e4d013e57b9e985aea45bb313964316b773ccbd4dc430e7889ba54babb1793b37258

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB01F.tmp\ioSpecial.ini

Filesize
726B

MD5
f2152e8e14a7cfdfd01529fb0dcabe2d

SHA1
e1a7c661a6069109f0fc099b36259ff780c1a631

SHA256
2cbfc9e27ff6a2414017e9acce67e5f2a1cd151aac143755bc0168c3fa71977f

SHA512
69707499f5a3599394fe7640e39e958380514db2991b6d7efe3beeb4fa5d92cf5aff888911076bc95c8497f3be407868419a4e21360a9bba33f3d3173264dd19

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFF9C7BCDF5A4C9430.TMP

Filesize
16KB

MD5
24a645b4b98aafc922144e2f36bed3af

SHA1
50cc986ddc5ff1d82ba5ac1d908e8010d913d9bc

SHA256
e341bd61f803b178bdc15e9bcb468ea3f619bed05efc105cabe673b84c8cdab5

SHA512
d4167119b3d1550fcd31a77d602a036e9eae7344f2bc3225bd8434a857be5e6c516dc564380df299d7a01ae5e12b9eaa0a70d1b30ba949f1e455c6e9d7fa87b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R1TS8VLA.txt

Filesize
509B

MD5
4ff4825ea09e50ae36b68f1888131305

SHA1
3afb9f1cc351e065989577489d19d98b26183a10

SHA256
941c2898aec2e145c3393d1623a82b0f65776d2f4e801e161934f65f75a9d334

SHA512
1157ce407f48d7d89d62c9b928ade84a8aa2da779bdd56eb1c6b925802ca38181894d2be3e9bdc714e2cadbc6d5efcb5a06453deabe91f1b3a8c8435f94c27d3

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

Filesize
364KB

MD5
80d5f32b3fc515402b9e1fe958dedf81

SHA1
a80ffd7907e0de2ee4e13c592b888fe00551b7e0

SHA256
0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

SHA512
1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

Filesize
1.7MB

MD5
bb632bc4c4414303c783a0153f6609f7

SHA1
eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

SHA256
7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

SHA512
15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

Filesize
1.0MB

MD5
d62a4279ebba19c9bf0037d4f7cbf0bc

SHA1
5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

SHA256
c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

SHA512
6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe

Filesize
74KB

MD5
bfffc38fff05079b15a5317e279dc7a9

SHA1
0c18db954f11646d65d0300e58fefcd9ff7634de

SHA256
c4e59737ffd988ef4bc7a62e3316a470b1b09a9889f65908110fba3d7b1c6500

SHA512
d30220e024ac242285ea757006e7da3874e5f889951de226d48c372a6a8701b76d4a917134ecc1e72c6c3a8d43444762288e7134a25d837e9f43d972675c81d6

Download Submit
\Users\Admin\AppData\Local\Temp\nstB01F.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nstB01F.tmp\ShellExecAsUser.dll

Filesize
7KB

MD5
86a81b9ab7de83aa01024593a03d1872

SHA1
8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

SHA256
27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

SHA512
cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

Download Submit
\Users\Admin\AppData\Local\Temp\nstB01F.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nstB01F.tmp\nsDialogs.dll

Filesize
9KB

MD5
f832e4279c8ff9029b94027803e10e1b

SHA1
134ff09f9c70999da35e73f57b70522dc817e681

SHA256
4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

SHA512
bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

Download Submit
memory/1016-232-0x00000000007C0000-0x00000000007C2000-memory.dmp

Filesize
8KB

Download