Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-es -
resource tags
arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
07/02/2023, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
lghub_installer.exe
Resource
win7-20221111-es
Behavioral task
behavioral2
Sample
lghub_installer.exe
Resource
win10v2004-20221111-es
General
-
Target
lghub_installer.exe
-
Size
39.6MB
-
MD5
e11bc00bbe8a70a3cb7786d16434d9ca
-
SHA1
89bf143bfe0af7cb1372b8e5e24524d2df8ed13f
-
SHA256
234be8544a1cacdaadccd0718d14be477c861e38a1a8cf06ea5669ea5a472fb7
-
SHA512
b73e33bdfc9d4c8c35ca1ee0947fdebb707c98c79fd731e23529a601aeeffa61e972b5a0bc12d3c8efcbc64b59382238dd8c62ca12cef07716f85c924dc951d5
-
SSDEEP
786432:U05sfbEpttD7yBG/4M3OW+upttD7yBG/PcXU9g5D:U0cEpttD7y0/pnpttD7y0/0XUm5D
Malware Config
Signatures
-
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\logi_joy_bus_enum.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\logi_joy_xlcore.sys DrvInst.exe File opened for modification C:\Windows\system32\drivers\logi_joy_vir_hid.sys DrvInst.exe File opened for modification C:\Windows\system32\drivers\logi_joy_vir_hid.sys DrvInst.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation lghub_system_tray.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation lghub.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation lghub.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 8b7c-658e-5121-c908.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation lghub_installer.exe -
Executes dropped EXE 17 IoCs
pid Process 908 vc_redist.x64.exe 2376 vc_redist.x64.exe 3308 vc_redist.x86.exe 3600 vc_redist.x86.exe 4868 lghub_updater.exe 1688 lghub_updater.exe 2780 lghub_updater.exe 3420 lghub.exe 1440 lghub.exe 4500 d653-bde5-30d0-24df.exe 4972 lghub_system_tray.exe 1568 lghub.exe 2844 lghub.exe 2628 lghub_agent.exe 396 lghub.exe 4272 lghub.exe 5052 8b7c-658e-5121-c908.exe -
Loads dropped DLL 52 IoCs
pid Process 2376 vc_redist.x64.exe 3600 vc_redist.x86.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1484 regsvr32.exe 2376 regsvr32.exe 1536 regsvr32.exe 308 regsvr32.exe 4388 regsvr32.exe 1436 regsvr32.exe 3420 lghub.exe 1440 lghub.exe 3420 lghub.exe 1440 lghub.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 1568 lghub.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 2844 lghub.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 2628 lghub_agent.exe 2628 lghub_agent.exe 2628 lghub_agent.exe 4972 lghub_system_tray.exe 396 lghub.exe 1568 lghub.exe 1568 lghub.exe 1568 lghub.exe 1568 lghub.exe 1568 lghub.exe 2628 lghub_agent.exe 4272 lghub.exe 4272 lghub.exe 4272 lghub.exe 4272 lghub.exe 4272 lghub.exe 4272 lghub.exe 4972 lghub_system_tray.exe 4280 regsvr32.exe 4256 regsvr32.exe 5144 regsvr32.exe 5204 regsvr32.exe -
Registers COM server for autorun 1 TTPs 63 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2605-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2608-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260D-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260F-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2610-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1ED6DDBB-0401-4498-A093-7D249203200C}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2601-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2609-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0402-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2603-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2605-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2606-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260F-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62B43F0E-E7DB-4329-8C13-A966D84A289F}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260A-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260C-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0402-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0402-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2604-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2609-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260C-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260E-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2606-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2602-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2603-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2604-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260A-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260C-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260E-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2602-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2605-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2607-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260E-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62B43F0E-E7DB-4329-8C13-A966D84A289F}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2602-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2610-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62B43F0E-E7DB-4329-8C13-A966D84A289F}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\hidpp_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2603-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2607-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2608-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260A-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2601-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2606-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\hidpp_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2610-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2607-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2609-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2601-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2604-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2608-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260D-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1ED6DDBB-0401-4498-A093-7D249203200C}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1ED6DDBB-0401-4498-A093-7D249203200C}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260D-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260F-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LGHUB = "\"C:\\Program Files\\LGHUB\\lghub.exe\" --background" lghub_agent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET7500.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET7500.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_hid.inf_amd64_66435b0f755eebe7\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\logi_joy_bus_enum.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET7740.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_5e984dae08ef9545\logi_joy_xlcore.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\logi_joy_vir_hid.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\logi_joy_hid.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_hid.inf_amd64_66435b0f755eebe7\logi_generic_hid_filter.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET772F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\logi_joy_xlcore.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\SET65CC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\logi_joy_hid_filter.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET7740.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET7511.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\logi_joy_bus_enum.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_vir_hid.inf_amd64_9f941d7e3c42f879\logi_joy_vir_hid.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74CE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74FF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET7511.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_hid.inf_amd64_66435b0f755eebe7\logi_joy_hid.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\SET65CC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\logi_generic_hid_filter.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_5e984dae08ef9545\logi_joy_bus_enum.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74BE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74CE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\logi_joy_hid_lo.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_hid.inf_amd64_66435b0f755eebe7\logi_joy_hid_lo.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_hid.inf_amd64_66435b0f755eebe7\logi_joy_hid.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_5e984dae08ef9545\logi_joy_bus_enum.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_5e984dae08ef9545\logi_joy_bus_enum.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\SET659B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_vir_hid.inf_amd64_9f941d7e3c42f879\logi_joy_vir_hid.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_vir_hid.inf_amd64_9f941d7e3c42f879\logi_joy_vir_hid.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74BE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74EF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET7741.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_hid.inf_amd64_66435b0f755eebe7\logi_joy_hid_filter.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET7730.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_5e984dae08ef9545\logi_joy_xlcore.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_5e984dae08ef9545\logi_joy_bus_enum.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\SET65AB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET7741.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\logi_joy_hid.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\SET659B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET772F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\logi_joy_bus_enum.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\SET65AB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74EF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dbc4ae55-c17d-d94e-97e0-4c9d7046c6df}\SET74FF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\logi_joy_vir_hid.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ae7112b0-78ef-2e49-89d0-60dd001047bc}\logi_joy_vir_hid.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a967d8f7-fee3-ac49-bc49-72c4caf9a53b}\SET7730.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\logi_joy_vir_hid.inf_amd64_9f941d7e3c42f879\logi_joy_vir_hid.sys DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\LGHUB\system_tray\Microsoft.WindowsAppRuntime.dll lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\components\LabelControl.xbf lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\logi_system_tray.winmd lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\de-DE\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\hu-HU\Microsoft.UI.Xaml.Phone.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.WindowsAppRuntime.Bootstrap.dll lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\nn-NO\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\ro-RO\Microsoft.UI.Xaml.Phone.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\data\lighting\effects\screen_sampler.json lghub_updater.exe File created C:\Program Files\LGHUB\locales\lv.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.ui.xaml.resources.19h1.dll lghub_updater.exe File created C:\Program Files\LGHUB\locales\cs.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.UI.Xaml.Phone.dll lghub_updater.exe File created C:\Program Files\LGHUB\Qt5Widgets.dll lghub_updater.exe File created C:\Program Files\LGHUB\resources\icon.png lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\fa-IR\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\is-IS\Microsoft.UI.Xaml.Phone.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.UI.Windowing.Core.dll lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.UI.Xaml.winmd lghub_updater.exe File created C:\Program Files\LGHUB\locales\et.pak lghub_updater.exe File created C:\Program Files\LGHUB\locales\sl.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\MRM.dll lghub_updater.exe File created C:\Program Files\LGHUB\locales\pt-PT.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\ka-GE\Microsoft.UI.Xaml.Phone.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.Graphics.winmd lghub_updater.exe File created C:\Program Files\LGHUB\data\lighting\effects\mouse-verticool.json lghub_updater.exe File created C:\Program Files\LGHUB\locales\hr.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\en-us\Microsoft.UI.Xaml.Phone.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\kk-KZ\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\resources.pri lghub_updater.exe File created C:\Program Files\LGHUB\sdks\sdk_legacy_led_x86.dll lghub_updater.exe File created C:\Program Files\LGHUB\data\lighting\effects\redwhiteblue.json lghub_updater.exe File created C:\Program Files\LGHUB\locales\it.pak lghub_updater.exe File created C:\Program Files\LGHUB\locales\he.pak lghub_updater.exe File created C:\Program Files\LGHUB\locales\zh-CN.pak lghub_updater.exe File created C:\Program Files\LGHUB\resources\app.asar lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\components\SeparatorControl.xbf lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\fr-FR\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.Windows.ApplicationModel.DynamicDependency.winmd lghub_updater.exe File created C:\Program Files\LGHUB\data\lighting\effects\audio-visualizer-generic.json lghub_updater.exe File created C:\Program Files\LGHUB\locales\ar.pak lghub_updater.exe File created C:\Program Files\Logitech\Direct Input Force Feedback\hidpp_forcefeedback_x86.dll 8b7c-658e-5121-c908.exe File created C:\Program Files\LGHUB\system_tray\th-TH\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\sdks\sdk_legacy_steering_wheel_x64.dll lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.UI.Xaml.Internal.dll lghub_updater.exe File created C:\Program Files\LGHUB\locales\nl.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\cy-GB\Microsoft.UI.Xaml.Phone.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\Qt5Core.dll lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\is-IS\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\data\lighting\effects\audio-visualizer-kb-zonal.json lghub_updater.exe File created C:\Program Files\LGHUB\locales\id.pak lghub_updater.exe File created C:\Program Files\LGHUB\locales\th.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\components\AudioMixerControl.xbf lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\da-DK\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\vk_swiftshader_icd.json lghub_updater.exe File created C:\Program Files\LGHUB\data\applications.json lghub_updater.exe File created C:\Program Files\LGHUB\locales\fr.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\eu-ES\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\ko-KR\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\Microsoft.ui.xaml.dll lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\th-TH\Microsoft.UI.Xaml.Phone.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\locales\ru.pak lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\az-Latn-AZ\Microsoft.ui.xaml.dll.mui lghub_updater.exe File created C:\Program Files\LGHUB\system_tray\cs-CZ\Microsoft.ui.xaml.dll.mui lghub_updater.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log d653-bde5-30d0-24df.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs d653-bde5-30d0-24df.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom d653-bde5-30d0-24df.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags d653-bde5-30d0-24df.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID regsvr32.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\Colors lghub_system_tray.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2609-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x86.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260D-BE85-4D30-8797-8BA0A23A5D53} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1ED6DDBB-0401-4498-A093-7D249203200C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1ED6DDBB-0401-4498-A093-7D249203200C}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260C-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech Force 3D Pro FF DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2604-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2606-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x86.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0402-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2603-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260A-BE85-4D30-8797-8BA0A23A5D53} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260A-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFDE0402-02ED-40A6-BC30-C7AF99D2D588}\ = "Logitech WingMan Force API DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260D-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e8dfb59f-141f-40e4-8dd4-5526ead25a4c} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260E-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x86.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260A-BE85-4D30-8797-8BA0A23A5D53} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260D-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2602-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a6519e67-7632-4375-afdf-caa889744403}\ServerBinary regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63BD165D-1584-4E75-AB56-08330350545F}\ = "Logitech GHUB Legacy Steering Wheel SDK" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63BD165D-1584-4E75-AB56-08330350545F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260C-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2610-BE85-4D30-8797-8BA0A23A5D53} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech WingMan Force 3D FF DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a6519e67-7632-4375-afdf-caa889744403}\ = "Legacy Logitech LED SDK Wrapper DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1ED6DDBB-0401-4498-A093-7D249203200C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2605-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2609-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2605-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x86.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2605-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFDE0402-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\ = "Logitech HID++ Force Feedback API" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B43F0E-E7DB-4329-8C13-A966D84A289F}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\hidpp_forcefeedback_x86.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2604-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech MOMO Force FF DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2605-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech WingMan Cordless Gamepad FF DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260F-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63BD165D-1584-4E75-AB56-08330350545F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2604-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x86.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2602-BE85-4D30-8797-8BA0A23A5D53} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260D-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2610-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2603-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2609-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech WingMan Cordless Gamepad2 FF DLL" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\com.logi.ghub\shell\open lghub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260F-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech G27 Racing Wheel FF DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2607-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFDE0402-02ED-40A6-BC30-C7AF99D2D588} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2602-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech WingMan RumblePad FF DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2608-BE85-4D30-8797-8BA0A23A5D53} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1ED6DDBB-0401-4498-A093-7D249203200C}\ = "Logitech Legacy FF DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2606-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B2602-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260B-BE85-4D30-8797-8BA0A23A5D53}\ = "Logitech Driving Force Pro FF DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{920B260C-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{920B2600-BE85-4D30-8797-8BA0A23A5D53}\InProcServer32\ = "C:\\Program Files\\Logitech\\Direct Input Force Feedback\\jerry_forcefeedback_x86.dll" regsvr32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 lghub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 lghub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 lghub.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2628 lghub_agent.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe 1736 lghub_installer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1736 lghub_installer.exe Token: SeAuditPrivilege 5076 svchost.exe Token: SeSecurityPrivilege 5076 svchost.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeLoadDriverPrivilege 4500 d653-bde5-30d0-24df.exe Token: SeRestorePrivilege 1164 DrvInst.exe Token: SeBackupPrivilege 1164 DrvInst.exe Token: SeRestorePrivilege 1164 DrvInst.exe Token: SeBackupPrivilege 1164 DrvInst.exe Token: SeLoadDriverPrivilege 1164 DrvInst.exe Token: SeLoadDriverPrivilege 1164 DrvInst.exe Token: SeLoadDriverPrivilege 1164 DrvInst.exe Token: SeRestorePrivilege 1508 DrvInst.exe Token: SeBackupPrivilege 1508 DrvInst.exe Token: SeLoadDriverPrivilege 1508 DrvInst.exe Token: SeLoadDriverPrivilege 1508 DrvInst.exe Token: SeLoadDriverPrivilege 1508 DrvInst.exe Token: SeRestorePrivilege 4908 DrvInst.exe Token: SeBackupPrivilege 4908 DrvInst.exe Token: SeLoadDriverPrivilege 4908 DrvInst.exe Token: SeLoadDriverPrivilege 4908 DrvInst.exe Token: SeLoadDriverPrivilege 4908 DrvInst.exe Token: 33 3532 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3532 AUDIODG.EXE Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeLoadDriverPrivilege 4280 regsvr32.exe Token: SeLoadDriverPrivilege 4256 regsvr32.exe Token: SeLoadDriverPrivilege 5144 regsvr32.exe Token: SeLoadDriverPrivilege 5204 regsvr32.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe Token: SeCreatePagefilePrivilege 3420 lghub.exe Token: SeShutdownPrivilege 3420 lghub.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 3420 lghub.exe 4972 lghub_system_tray.exe -
Suspicious use of SendNotifyMessage 26 IoCs
pid Process 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe 4972 lghub_system_tray.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4388 regsvr32.exe 1436 regsvr32.exe 2628 lghub_agent.exe 2628 lghub_agent.exe 2628 lghub_agent.exe 5144 regsvr32.exe 5204 regsvr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 908 1736 lghub_installer.exe 83 PID 1736 wrote to memory of 908 1736 lghub_installer.exe 83 PID 1736 wrote to memory of 908 1736 lghub_installer.exe 83 PID 908 wrote to memory of 2376 908 vc_redist.x64.exe 84 PID 908 wrote to memory of 2376 908 vc_redist.x64.exe 84 PID 908 wrote to memory of 2376 908 vc_redist.x64.exe 84 PID 1736 wrote to memory of 3308 1736 lghub_installer.exe 85 PID 1736 wrote to memory of 3308 1736 lghub_installer.exe 85 PID 1736 wrote to memory of 3308 1736 lghub_installer.exe 85 PID 3308 wrote to memory of 3600 3308 vc_redist.x86.exe 86 PID 3308 wrote to memory of 3600 3308 vc_redist.x86.exe 86 PID 3308 wrote to memory of 3600 3308 vc_redist.x86.exe 86 PID 1736 wrote to memory of 4868 1736 lghub_installer.exe 96 PID 1736 wrote to memory of 4868 1736 lghub_installer.exe 96 PID 4868 wrote to memory of 504 4868 lghub_updater.exe 98 PID 4868 wrote to memory of 504 4868 lghub_updater.exe 98 PID 504 wrote to memory of 1484 504 regsvr32.exe 100 PID 504 wrote to memory of 1484 504 regsvr32.exe 100 PID 504 wrote to memory of 1484 504 regsvr32.exe 100 PID 4868 wrote to memory of 2376 4868 lghub_updater.exe 101 PID 4868 wrote to memory of 2376 4868 lghub_updater.exe 101 PID 4868 wrote to memory of 3016 4868 lghub_updater.exe 102 PID 4868 wrote to memory of 3016 4868 lghub_updater.exe 102 PID 3016 wrote to memory of 1536 3016 regsvr32.exe 103 PID 3016 wrote to memory of 1536 3016 regsvr32.exe 103 PID 3016 wrote to memory of 1536 3016 regsvr32.exe 103 PID 4868 wrote to memory of 308 4868 lghub_updater.exe 104 PID 4868 wrote to memory of 308 4868 lghub_updater.exe 104 PID 4868 wrote to memory of 4388 4868 lghub_updater.exe 105 PID 4868 wrote to memory of 4388 4868 lghub_updater.exe 105 PID 4868 wrote to memory of 3308 4868 lghub_updater.exe 106 PID 4868 wrote to memory of 3308 4868 lghub_updater.exe 106 PID 3308 wrote to memory of 1436 3308 regsvr32.exe 107 PID 3308 wrote to memory of 1436 3308 regsvr32.exe 107 PID 3308 wrote to memory of 1436 3308 regsvr32.exe 107 PID 4868 wrote to memory of 2780 4868 lghub_updater.exe 109 PID 4868 wrote to memory of 2780 4868 lghub_updater.exe 109 PID 4868 wrote to memory of 3420 4868 lghub_updater.exe 110 PID 4868 wrote to memory of 3420 4868 lghub_updater.exe 110 PID 4868 wrote to memory of 1440 4868 lghub_updater.exe 111 PID 4868 wrote to memory of 1440 4868 lghub_updater.exe 111 PID 4868 wrote to memory of 4500 4868 lghub_updater.exe 112 PID 4868 wrote to memory of 4500 4868 lghub_updater.exe 112 PID 3420 wrote to memory of 4972 3420 lghub.exe 113 PID 3420 wrote to memory of 4972 3420 lghub.exe 113 PID 5076 wrote to memory of 2056 5076 svchost.exe 115 PID 5076 wrote to memory of 2056 5076 svchost.exe 115 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116 PID 3420 wrote to memory of 1568 3420 lghub.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\lghub_installer.exe"C:\Users\Admin\AppData\Local\Temp\lghub_installer.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\Temp\{98DD47CF-CAD1-4964-A03E-644007B479D9}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{98DD47CF-CAD1-4964-A03E-644007B479D9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=656 -burn.filehandle.self=684 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376
-
-
-
C:\Users\Admin\AppData\Local\Temp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\vc_redist.x86.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\Temp\{5BBBB5C4-C3EF-4A13-A6B7-7E14F292DFE2}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{5BBBB5C4-C3EF-4A13-A6B7-7E14F292DFE2}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3600
-
-
-
C:\ProgramData\LGHUB\depots\162476\core\LGHUB\lghub_updater.exe"C:\ProgramData\LGHUB\depots\162476\core\LGHUB\lghub_updater.exe" --install2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LGHUB\sdks/trueforce_sdk_x86.dll"3⤵
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\LGHUB\sdks/trueforce_sdk_x86.dll"4⤵
- Loads dropped DLL
- Modifies registry class
PID:1484
-
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LGHUB\sdks/trueforce_sdk_x64.dll"3⤵
- Loads dropped DLL
PID:2376
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LGHUB\sdks/sdk_legacy_led_x86.dll"3⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\LGHUB\sdks/sdk_legacy_led_x86.dll"4⤵
- Loads dropped DLL
- Modifies registry class
PID:1536
-
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LGHUB\sdks/sdk_legacy_led_x64.dll"3⤵
- Loads dropped DLL
- Modifies registry class
PID:308
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LGHUB\sdks/sdk_legacy_steering_wheel_x64.dll"3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LGHUB\sdks/sdk_legacy_steering_wheel_x86.dll"3⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\LGHUB\sdks/sdk_legacy_steering_wheel_x86.dll"4⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
-
C:\Program Files\LGHUB\lghub_updater.exe"C:\Program Files\LGHUB\lghub_updater.exe" --run-as-service3⤵
- Executes dropped EXE
PID:2780
-
-
C:\Program Files\LGHUB\lghub.exe"C:\Program Files\LGHUB\lghub.exe" --background3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Program Files\LGHUB\system_tray\lghub_system_tray.exe"C:\Program Files\LGHUB\system_tray\lghub_system_tray.exe" --background4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4972 -
C:\Program Files\LGHUB\lghub_agent.exe"C:\Program Files\LGHUB\lghub_agent.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
-
C:\Program Files\LGHUB\lghub.exe"C:\Program Files\LGHUB\lghub.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming/lghub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1980,i,7851070124695019333,5523402046936884024,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568
-
-
C:\Program Files\LGHUB\lghub.exe"C:\Program Files\LGHUB\lghub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming/lghub" --mojo-platform-channel-handle=2184 --field-trial-handle=1980,i,7851070124695019333,5523402046936884024,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844
-
-
C:\Program Files\LGHUB\lghub.exe"C:\Program Files\LGHUB\lghub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming/lghub" --app-user-model-id="{6D809377-6AF0-444B-8957-A3773F02200E}\LGHUB\lghub.exe" --app-path="C:\Program Files\LGHUB\resources\app.asar" --enable-sandbox --force-color-profile=srgb --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2444 --field-trial-handle=1980,i,7851070124695019333,5523402046936884024,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand "C:\Program Files\LGHUB\lghub.exe" --background /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:396
-
-
-
C:\Program Files\LGHUB\lghub.exe"C:\Program Files\LGHUB\lghub.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Program Files\LGHUB\lghub.exe"C:\Program Files\LGHUB\lghub.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming/lghub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1800,i,6387103595884988767,13004195122017161262,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4272
-
-
-
C:\Users\Admin\AppData\Local\Temp\d653-bde5-30d0-24df.exe"C:\Users\Admin\AppData\Local\Temp\d653-bde5-30d0-24df.exe" --install --verbose --logfile3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\8b7c-658e-5121-c908.exe"C:\Users\Admin\AppData\Local\Temp\8b7c-658e-5121-c908.exe" --install --path "%ProgramFiles%/Logitech/Direct Input Force Feedback" --logfile3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
PID:5052 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files/Logitech/Direct Input Force Feedback\hidpp_forcefeedback_x64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files/Logitech/Direct Input Force Feedback\hidpp_forcefeedback_x86.dll"4⤵PID:2808
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files/Logitech/Direct Input Force Feedback\hidpp_forcefeedback_x86.dll"5⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files/Logitech/Direct Input Force Feedback\jerry_forcefeedback_x64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5144
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files/Logitech/Direct Input Force Feedback\jerry_forcefeedback_x86.dll"4⤵PID:5184
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files/Logitech/Direct Input Force Feedback\jerry_forcefeedback_x86.dll"5⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5204
-
-
-
-
-
C:\Program Files\LGHUB\lghub_updater.exe"C:\Program Files\LGHUB\lghub_updater.exe" --run-as-service1⤵
- Executes dropped EXE
PID:1688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8516143b-fd27-a84c-b576-24f838b9d626}\logi_joy_vir_hid.inf" "9" "4cb2f5daf" "0000000000000144" "WinSta0\Default" "0000000000000138" "208" "C:\Users\Admin\AppData\Local\Temp\437905d1-423e-4358-985f-1bd17132e273"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2056
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{934bd6c6-4f5b-2e47-b09a-cfa86478e469}\logi_joy_hid.inf" "9" "456fee487" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\AppData\Local\Temp\7c8fbbf3-a678-4cff-87a6-8bd7a6925023"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1480
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cc7dff71-73a2-a143-9083-c50f6dbac8c5}\logi_joy_bus_enum.inf" "9" "4846e9907" "000000000000015C" "WinSta0\Default" "0000000000000138" "208" "C:\Users\Admin\AppData\Local\Temp\e0d877aa-ebf0-49b5-8813-e01dfe934afb"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2868
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "1" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_5e984dae08ef9545\logi_joy_bus_enum.inf" "oem4.inf:*:*:2022.3.0.2:root\LGHUBVirtualBus," "4846e9907" "000000000000015C"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "LGHUBDevice\VID_046D&PID_C232\1&79f5d87&0&01" "" "" "409067b8f" "0000000000000000"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "LGHUBDevice\VID_046D&PID_C231\1&79f5d87&0&02" "" "" "41dc813d3" "0000000000000000"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:872
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x308 0x3bc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.1MB
MD5a58c2051c6d2176a0b8392270882e840
SHA1332830b02f673e40a578e8302ecef56e29cf20f9
SHA2561f223646ff8a0f1e918f1425ff31ea406bbfed1d645be0d84da0010b4c842310
SHA512e0e7ca3cf20e97b2a3faa8f8b2e6825f4de14b6b769e2d1aa9d234ccc81a4ebfc980341eb406bb06a2fc853d836a47eaf227d5f2fdb6f080b262bd2053bc9e38
-
Filesize
2.7MB
MD53d8018c2e770107bb9959db2bb9fdeb1
SHA1cd02285e9b086e651b694b4c2e360195839ed59f
SHA256522385b660a4a45df5535085bc5f57ba9a7b918d758b4e254f15b12f3940e7ae
SHA512e218470a209c07c7d957d41b6f179947132c28568f99b66aafacd2bbee7b13cd99818b892e3ff0295dd06cbc4d5e6f7b3c96cd0295f286156a0b69a704264f74
-
Filesize
32KB
MD55ee1a69bbde20239c35a2707492c9970
SHA16a6e8741f1a5b69fac6c24df7632c9d0965e3d03
SHA256628fa1a58689691ce7ae23c610e82304244a01d376f4f06b7d3dabd099360e3b
SHA512babb3423e8db119ddfa1a8dee1e9afa81f32913e8b167a1e9cba426a86960da6055e3e7be2823d41f6c124ebdd9f480fdab9915a99cc82629b5957afdef5172a
-
Filesize
9.7MB
MD5d49895a1edec1c7930fa5a793aaf4757
SHA1c3db66e0567abdec67ba1242f830807ab7b7501b
SHA256818582e3185d1ab69f4b3780485f27aeb3a1f773d854a2dba200fdf82020f8b9
SHA512a76394bcda9a173a7128e2bb9b44dc6791120a4bdced8505ea992e90bd854ee610d958dd588d092825b251b39ac59ac2263f660f3041a21d8ea3b4d74e3db4fc
-
Filesize
19KB
MD58df338dd986a329ee1a75167b859a276
SHA1057c1ae0d05ee71e8016e439a7b0bdcc970546a0
SHA2564e3ace7885da937699f65a8b46a8e91880c01ab67f97230583adc1c428d484bd
SHA512d932be77ef5cc2bcf6bf4e552f05be7c604db57e0db79ba008077165385d446b6be6908fb81ef0b7bc537fdfd43b2f7965b7773cdaba578e0119eb2c09ceb995
-
Filesize
228KB
MD523e86a70c0747f0f06280df475ca02ef
SHA15915c30308940840e441e4d99b3fded0f02102ff
SHA2567b1fb70f7df44542028495a4a69d94797103298492670a779854d9ba2e00cd75
SHA51223d64c3e04911093fd25ebab3b21f32c12ff6288c4c408cba58414ae1e5cb124edf72f11e4d22ae44d54f8bd3d641b46d434ed56b73fe785ecd01ed1abda053d
-
Filesize
54KB
MD55296c5f6db0cb3f7ab94d5a07ebc0595
SHA10e52742fb2e0af5f0d74f2a34de85daaf426c0ec
SHA25682b6fb6d759f5050d9b59f5832f7a2c3fb999cde1bc360718843f56f3ce44189
SHA512601808c8f3dce1e9ea1d8919dfbf4b17bacd4a5c4a2093d06198d4f33ba1e0106b4bf4cf71fdee4cba4002249286d7bc1191c543e974637e90a9a6e4cf8d8a2d
-
Filesize
51KB
MD511e745e7b5c110212ed311ee767fe545
SHA126d72ff0b5ca0458afdb4fd80473baadfd15f6ba
SHA256fda75a3de7f76220542060792ee754f34dc775899915e9e6e3b440ad00aa9963
SHA5129ce5a8235d7fa93dd1fcf8b38ae753185dac51780371cf9879b417c40b415db2b83db7c614f7241a8a95bd300f0ff2af5287c6b86d067085359fd311f7af1874
-
Filesize
133KB
MD56133dd33231f223aa43c00ebf573f896
SHA17f8a30aece9199d5a37f149de42c03f546823c3c
SHA256a6dfd36e16e16fb866930d86b5c24cfb3fcf1832570463317ee2936d22330e0c
SHA512f56ff48cb1c787bbe6b4e590fff10f4b1e4cd7b50bd03edacf8cba47f79769bbfaef0c67663ca727104c59f7c6705ab52b99edf1211fa66552178cbec9d99745
-
Filesize
60KB
MD5da563f1cc4b0c9821f34219e656b54d0
SHA14df7652fccbd1ed0df72b9674924d8a1575edb42
SHA256f92d9eaab28c7033e5c822ac74f25adfba3abeb17c7ef57c225f7f65ffb7af80
SHA5124ffab91cec2023cd110f2b5e6d06465f16bb7f65c17d975057e501061e93d78dc1fb005dd1ab96451ece23da34a0412f0a4f74441337fb9fd55ab923d7e872df
-
Filesize
161KB
MD56ac1573c54c4304331694c8de32af2f5
SHA109fe8e7904f36f3676732071c5f408b8d8ba9a0e
SHA2563ec8287126a24d5f05877ddbbc2105ea9ee3fe3a6545d732d4d7b14122ba9cdc
SHA5126833df18fd417094e6a89362c02dc9ec61c3573f2abd1a4bcf943ecaa5b89cae4d852a3e32a33e1369f811389424b4458ac2af71545bc4bf2c5b431ead20482b
-
Filesize
74KB
MD580a43056f0596e3845a647e5b3a873fa
SHA16cc181f3d0850245b179998b849b5b15271e15b1
SHA2560b15d8fe7ff28a70f2d0fc8691fa192f171001cf7ad39e177dc63a451b592c13
SHA5126c103c77eb12fa3d55d019b3a40cc7343cf36c5b09d48aa27ce8ae309d3e37fed81d9ee6e7b52589638a9747061484073b1155d2ee87249bbc258f6844a976ac
-
Filesize
205KB
MD5f9a7137f84f0fb237f72d7d693866abe
SHA13ea354cb3c06a1ddd4af23418737591bd674df9d
SHA256ea6112bd8695bdd30a1323de6361d412405b35674bf98334fea70eb0fcb34773
SHA5120b0f16f09ad8d1671daa30afdb07a3e92b818e353ea425fab12945bd801a4984a585664cdfea9595883282694b91dd6ced653a0760e48291838267a474fd8422
-
Filesize
61KB
MD5b1ee042adf3bd2869ff92ea677215c34
SHA1e490d3607f62b31bf489288e94e943c34f1505c0
SHA256cd4daa719922c655d6ac6fd9cb33f68d21988299840e441d225345428962cbd9
SHA512e9889dbaaad5462196c547216f5af447c912d019040fbce081276290429ff394e585024dc47a3f44cdb8b0753dbf476f5d35ddbb364f4ee8c4871fe9d8e0efae
-
Filesize
23KB
MD574eebb887eac7db53fbb8b3c5760dfd8
SHA1a5e77141efcbe567d997b76e7045f3da32b6539b
SHA256a98286fc203b1ecfe3b88979e70052b6488b04225c820424016827b40fad4278
SHA5124d34eae5f080c6099cc3ce8500d9d5994ec52e428cdcf0ed495fe78f0ed6c80469490ace06490bf329bcd11cb7748321614dec826dc91ded4b704631070ee4ea
-
Filesize
84KB
MD5e77e651158dffb339f6edbeb5b0cedcd
SHA1eaf72f56a90295f5873babdd8a61706abb5c414d
SHA256dd2ed4f094467e25f0336253abfe658438857d6c19b59c99ee457b6dadcddae4
SHA5125960ceec4bf079e417068362d00b2d6e978cf9e676df7e7993948ebcce63ba9c761ff1325f66a8c48751b35688b38601a890b9cc482eceed8b8c2ab066319596
-
Filesize
74KB
MD5ab66be2f019eb49c12df613d89e6a165
SHA1649a015002c2caafaa0e38d0d7f8b14872745c39
SHA256b55481c781a06ccf2e961c370b06576f9406a0a77acac3f766a57ab288a99c77
SHA512bc2b54f1d088d0fd0b1e3c45c0bf163449e5b49c1b1b3558ff6da8b9147e3876b480da7f76d5beb6ec91016243e73fede186014aa893f80b1d006f6aea156306
-
Filesize
49KB
MD5eb6e43bc864a5cf5f67da4024eecbe6b
SHA1ed5119e4844c1735b0f52056551999e1a1294210
SHA256e6207d2d05eb3e66f479c9270d908bdf96bf9fb659f6962dbbbef6b6652bc6c5
SHA51274e3be35e1a06a40c9aba201236d90a18f7cfbf1c205630aef48cb39f82b21d0fbf4a7e9b2016ebab5427a5e86f7a5c6ecbab4381696cace3cf044167f011e4b
-
Filesize
218KB
MD54ef63d3e41901eda3cf1ecbc0db0562e
SHA15eab45273a4b151d437cc650f9e4d64053ffdd38
SHA256d8212e4d1c9021744ea3d3dfb2bdb992131a5895d726366869645d49947f6dcb
SHA5121091a30376ae661de3350bec9e9799257c1bc562fd45d1be8056e22c4c1198c7fc5323b0bdbbb7962b82fe05ee19f85c22b4ee12b914e6a76f31f129d48a3534
-
Filesize
40KB
MD5874c6a988d3827e9bd3f6709e73482f8
SHA1179da6f5515092967ad582e089b90cb97fcec1d3
SHA2567dd4b7b024542b416532f529e25b3b9281e6c426a878fe415348f86f6cc4ac79
SHA51294013f3796210913c9d772d9eceda6aeb2df9086e903f198ff2ff63b7598da6b7f5657bc83784ce2414914e652e8306bbfdaad86dc404ae9b67f9c33d5dcd9e1
-
Filesize
62KB
MD50d5226d781cf54649f5336afb816e336
SHA19e37e1ee54b6a3bc4f07dcb7e03f538e342895fd
SHA256ff81e0d788d8ade4ba48cf983df6de8381832abaf8f599e218e1db35ffbe0ccc
SHA5122ae75567223d86c7451eae94cec56c7abe355617b47ddd4c51e71507cf7781a83716c08fbbfe86ab73660fb3719e00276181de7f9b17dd0c56606b10ce0bddd7
-
Filesize
179KB
MD56e927579562b152a4908680f0ad5a5bb
SHA16cee07a76a999aba64e6f7296271c92285abac63
SHA256071fb8fc3408c11d0534b523cebaec9cf31d032d60802ccfbebd32f49d3610e0
SHA512ab89245f75947e8c00f02fee5f36e5f704d70fe498fd2c1fc464910a6cf3d8c2529c8bb1efc3b4532e3fc5f9b9d683201dde2600bd7c6542171e1b82f400ed1c
-
Filesize
61KB
MD565ac4892747644306cf0722de79d0244
SHA15c85ae894c0c5f53dceb6bcbe913c874ba72dd07
SHA25675d542c6d2a06ff5618e0390783d30d1859658dd7d5f89eb52ccd13f6f0ca604
SHA512ed1e793a16a84000485bc297f08572a032863f50bb326935058395af26fdd044ea748add9f77fef5e750b762aecfb215f7e21bb8b9bdcec030cbdb9da9e77434
-
Filesize
83KB
MD564aaae9e03e40238c2cb99d0cbbcb02d
SHA1112e46a5925987255f8525c50c395bf5dbafec86
SHA256ea8068e6d0c4239a78227da46d1f3a984415d424043a60dc3e2412a0d97f4528
SHA5127fd9f94be9b73d2e6d4711a5a584c6bfb8794972ab63f0415ccef40560ef950ae41299967dfaf098c87c3689363006f5ce8f269f0fb0ca44a4e5858b3abd9594
-
Filesize
160KB
MD52dce2f170e004c3b5a973405caed69f7
SHA17a3da4ee9ba070c2e92d234c74cb88e7f23b53b0
SHA2569815537dd2cc3b134653fe1c974943e9dc0c8c6260302c57b4ec6225c6b3be44
SHA51220f5387a18dac574cf9db666e02e178005334b7d143f0ef4065bc6a5be86a532c347ac184cadbd9f0754b632e46546a8136fad6c9f0696dd48c86715ae052d03
-
Filesize
132KB
MD572df43915e80982e7fa08cbe49ca3ad1
SHA1bb59f8191f5b0e0e74ccfa7d42404a24ed2163af
SHA256ce063d2dea582b91ec5670b4f81282f8a5bace89e147e379a1283e15f35e0304
SHA51268a325f5b9e1d6615902bb49ba6800c6924842f451e04fe2a1e985abbc3c2ecfd8744670bfda50d81f991bae5af10a60426ec54f1dd92a6abf076c61be2511e2
-
Filesize
150KB
MD5e89a00caf7fa081793cb65f596fa64f5
SHA17a708057937ad707b2d3ae728a35fbf7e41a2f67
SHA25685d63a4860f542e5b2977c4bd9668cfb7cbdd37aa19238335502220c2c1bc204
SHA512a6513d7e17a9234af4d8d90c76c9ab4ea58aba86d89e55fe18eac5c9733ead66fd1570f966afad8854d43094025dbfb30a9abbe4f60ff345b7138ee14d11cbac
-
Filesize
188KB
MD5a34a0bad428fcae66265adcd76860af2
SHA1d3e043a4d82bac50b757fa25ae0f5f70654509b8
SHA256e4f8b31f7c506d4eb1fc3e4405575e12cc2343403b28f29873be9c390c600704
SHA5127d08a2cafd06cd3e83159e480034daa0580cce269d807af425c9a110d9e64bc99732df3300dd384b257f0896fe96dfa19988ec0bc10823cb9e045f1654c4f4b8
-
Filesize
77KB
MD533911d23c16a990b3e012769cc1fe130
SHA1b432bf5ea94f6138a595980b63437f3ac9d71724
SHA256c2f76fa723e65930ac4b6e775967cf37e06efe28e3be8aaa554dd85f5faa7aa3
SHA51229462648df20ee815ea11a046f52d8d063f6612247c99c37cac16c1577cfd9662aeea2f0891f6a5f978b09b965c903b66f74fc8be56846aaa59542fa9e4c654f
-
Filesize
75KB
MD5a193c862e1d8fe7920fb42496735bf7d
SHA189fdf169ca0758464675e9d41f44d27c7c833411
SHA2566a8573e89771ce398bde645a3c4b0453af96ed1f6a07e1373081fc18840b603b
SHA51264795fb8cf752800d838b8c9da7e250f92362cda3f5de950586d9ec659c39e583d4044e7a71e2d9f7a166d75dfe81a6b1efaf5c960955f55e8df5ad2afbdae24
-
Filesize
106KB
MD51a893d479967953b537bb0266f9d1498
SHA18d103f7739b89abd72f49997f5d50dd9ae27a321
SHA25640d6f25a1bc7ff1c787dfe8cdd9baed50602a4e45f392a9d3544009a16ea6bcd
SHA512dfa87a1a1902ec06763ae69b61b0f68ed050a4435c24535003e5a5708d24a822781c026241668750a6bd63b9c269b970e42d3235b5106369dc90e3e57c822412
-
Filesize
46KB
MD513bbf139de96883f60da508a7b30fb3c
SHA1f77523523b842ba4d2fd248d9f779381f8c79f2d
SHA2569f8b06e8de285bc8911e0ea56009ced6d7e00edcc607c0d74779f77665597f2e
SHA512921c14f86dcc006e5ca4fbaec7624e7c7378f62704ef8f8b4b80166325f6570f2123f040dadf896f5452cb4272a523b98c7c43824f6e48ca9be8e4f79014949d
-
Filesize
147KB
MD516d7794b745e4472b84dd392e4f7a48e
SHA1f3b94cac4d7707c1912e25ad477ebca890db16f9
SHA256fe6923d2c799411ac96d8a17b6c405c745801b29509f6d4176ef58db974eb022
SHA512ba59cfc1f9c53b8c522335b376bbc0c79ec04a765bb7d1a7bbc65a5ccf87d327da7f90928b75004e05ff6ae7af5834792c87bbbe8dbe4dd44caccacf87637f1a
-
Filesize
157KB
MD53201960ed9fb1cb568d3c81b416c9feb
SHA14183ff0c028b321bf1b57347ddc000560224d9cb
SHA256718d0753bc11b531b090cfec54f3efaf200f4e77f5a495cb9382d80d12f01446
SHA512a427339f42b9a03bcc9d2d7c972946f4f95d579e6ce50bcf659d35ce84a7079a3497a662ab76a144aee119fb65a5a15efaa581fd6dfc2be7534ec8756764341d
-
Filesize
158KB
MD52b2e9e1bcdd84bf178f1ed61d2744344
SHA12e69ba283249d020a1b793c48bae6628b8c4e490
SHA2560e9780499795acd2a70de5aecf70ad904cc21af74f486cc74ccb851fa668076a
SHA512714a83fe9df2f1289f1855c7439d8dda891f01bc05951003cfc10c54b14a332472f3ecf7779ae1f5d5d9d1777aee16375fb13b37bda0cf128cd9361432dc757c
-
Filesize
129KB
MD59134ba35a1ece680ae236487731cf5c6
SHA117bf6fffb43342550e829f5455a5abfd02dfce79
SHA256f6e10e99b4b5b768acaaa39b6c3a3ad5a0de31f372e95aa93de981f0e8d9fb8a
SHA512e13458897740b0fee05c46e4f3452408a93ddd0c23a8f74c8516274ae6d26c7b7050b574317e6fedca155607d3f4d264914b5b9dead60f3b37c74b9d5bf69bcd
-
Filesize
118KB
MD504ed02ad466d41ed3be9b1661a9609da
SHA1664c928d9bc45d089d10bbcf2a5382315e514e37
SHA25665f727ceb3461f80c497ac1bed245154bf04c6cd8d9a5927270d8b2fe04edc2e
SHA512b5812add5379cd755012c0373bb260a81b482ea138085cd9b193217c82d3ef2613ed9d28aa113563787847ab32f7533c62b9c9ab664b4c9a07a4e8fda06f37c6
-
Filesize
104KB
MD5dc39931179556890f186ffc517d0586d
SHA145e66eda0500cb424a116b4ad109c28d8a9f2d9d
SHA2562822f5856b864c10c328c58fc9db05c60551c5869641fb518cd0fb1f04928bbe
SHA51225587d1e8189cc976271bbaefc44e33f388e858da03286a7dc842478d64ff6bc9941931246a21b8b2efa62964c85ccee9d3844be20d8bb3ee8485d211ecc1b42
-
Filesize
156KB
MD56a0dbe6f5f14d5617b23e3924566daa4
SHA1e253b495fc494f4be3719ee97f8664f8bb4dc218
SHA256bf4592d4c403d29c5fe3078a8f34a85cd047c612c6ad0045c2b0a4bd3b5fdd68
SHA5125e0bd28910fc42556aaf09a72fb9ab099e9d92efbd9a178ace372ee7c458aaf59b99d33cd99febfd036d63cf4da367b679bd8fb5ed3670eb620b40de114b785a
-
Filesize
57KB
MD52faf9035b13d186ece0730f876ab653b
SHA1f8c40afeafe16a657d3f08108020e2a7cf42d887
SHA25698311fd6bdfc7654e0c57e1fba6b6391a5ef76a5b9348b1c82d42f305e54dd34
SHA51296d01371b23ddaf43cd331ec8018d9ac70bb8fcf4856ca3e4c1fffeedfca1b175678abd012930a5df4795a4fd1a2694711dc7e72736069b7c8404034a237add2
-
Filesize
152KB
MD53e523d61b8a30a594e2e657d82af02e0
SHA14054942a2e38a92aa94af1175847f6889226f4ad
SHA256cabae501105cd194c1d4bfad8e26c8756e5afe8385e483eb84bfafb319de8c97
SHA51298b2ebbb8672a4f257faef52624ee8d3921242a0e6bdf174d0594f4fdd1daf24bb460afd9236f603432749ae11ec24df25bb03c9179f58ebd1f7f8e613b6346b
-
Filesize
168KB
MD5d89e11c9eb1bde49ec0c2e16ae20b16f
SHA133ac249badabeee141b1f40053061daf68de3a2d
SHA25683ecbd7b5b4c25f0d2d41e5e3fbaab992053ede7ee75e0f7d3cf9981b9725fd2
SHA5127b07123c9301c5d1affe36796b7830eedb3b0ca8a8146b79c49c0c4d3f05ad2e5a9bd680f8e8192b0c8d8e0862a360e117b1dadb6219d8a3ece7b599b580f55f
-
Filesize
63KB
MD53982ae4dea2e7977221f844ff9c08e17
SHA1633be10e258cf4188d3155f9ccd2a63fe438234f
SHA256b34775711fc3d552c0273d08353d316cec89f94c690cdb17d9d4727b651790ae
SHA51273c1028680e01c646c58488b20d55ac481e7c835037b98da4a2ea110870008c134d239a0a7633cfeb29567d1d7df8c85b5b1f417f7e9800af7a45bffafc69093
-
Filesize
18KB
MD56d0bef2de8cb712d66fb77781f14e831
SHA1d90441f0ff126f8e549064f7dc342b2d7070f52a
SHA256ac16373d4f9896d41d90743e8e2265952464eab9384d693895ad166ab2d75dbb
SHA512e6da91efe42b832a4c0b1a0563508eb2143be5a07138a65e4a997164eda3077afbb08dec4ba4ef65ec68826cad7f157a889ed7b7acbc2aec5add2f6d16a76e49
-
Filesize
58KB
MD53ed27feaef3ddde178a6571d62567b08
SHA1a388a07eccf84e19185042882d40504f671e5cdd
SHA2563e0a9eb72c57852017a6f0c41ef64622686dc76bd8622dd23ff6b349b397e682
SHA5121438d18f5e4079950cdb38219ebdf913f2566c8973910a40fe817d2d907ce725fa65628963fb46144e9c5d27c2e758e2a652dc2167df2e7ba4484e4c393d5bb8
-
Filesize
133KB
MD54416db95c8673167aa6941c6b41da5db
SHA13c90d155132925f544af5e546fe98d0c928b80ca
SHA256299f70d308ad0e13440f3402a001fd254571256313cb2f5272de2918c8475c83
SHA51297b17d58c40d441e49ed11fc1bf1fe29e26134035b860f003fec9f463b5db55e2357b34eb5622feae59a82e737908f8fe415f5dd6a25a1d8abd69da662bd92ae
-
Filesize
23KB
MD52ae6953ab2661e7f4e24d0c2fe068b3f
SHA14bbb0009ba568283deb1a6f64967de0eb6c0c206
SHA25658e6ff02914e8636c595aee774a42303f7128c6bc1426abb2261ad7ec75dd56d
SHA512ee3b991126373ce661683e5399c998c76af7e43f1facb5bbc0ccabd77623639d1c5fe14c67babf9251c757732a10f41f23594b82cb7bfb7a2f96b565b4616536
-
Filesize
178KB
MD5125d842268029977351fdcb7c54e92a5
SHA1303075679d4dad00f89a1425118b1a8e818f1312
SHA256ff361af24a60f57de38a4617f12f2bea68039bc318c43c6f68bbfc1566ce942b
SHA5124702d21f26d1a77e496f86d80bba39cc1586af62bcea1531734d39f178786dae3191c332a897f2ecd1ac5a6f681ed25873986367bfef963fd03fbea26a0f694a
-
Filesize
151KB
MD5da32d5b58514f39a722129ea28932a88
SHA11dc844dd8fd26df2224c40d01aa3a7795ef85574
SHA25623d34b95a7c95c97f3b089738c2c058495998d69695bfffce33cc4d848a22239
SHA5128d52249f13506b324de578c057eab7bc60caf9fed38a73af6157a367a13471da44689319bf857e2fbb1e7fea05522088738de8f5f2197710eef09d44b5c9c583
-
Filesize
234B
MD51d73b018ffd6970cdef6d20041b2fbaf
SHA15cb890453e1ab1273491a34da736d1e3a3a96cec
SHA256c3c0688421ef62d40f8a343b8e13434f865f37407f357db412d540170e8b3e73
SHA51220ab5aded7a83aca677bf9216b147f82361bba85f9055f395307bca47a6f4c4d97b2829732489f25962ce3a32d52d8f3baccebcf1c007c03d9dbd4b3247f3837
-
Filesize
1KB
MD59b6e6ad1321c8d857e98fba96498628c
SHA108fda1700f6863e51c777bd44047fe8f3944e8ad
SHA256b4de7e6ebd47c32f52437c87afc702a70cd23ae57753e85025fc6cc635a46191
SHA5124bc6c40185ca8fb44c54da1aa7cadaf14a1b1013fe6af7dd3a699d4253ebf9fb87d442508ca659db3c0fc00aa88fed64c856aa975ec06181e8b92fdaf4d1f4d7
-
Filesize
638KB
MD59bf313ba8355a495655f1f4b923d496d
SHA188569aa67d2a97553b33e03585fd3a0d6fe51353
SHA256b12751294e980478511396cadf3e05f900d463f3f2e83c99711f701623591be9
SHA512c0e9e5f807635aec3a17246e40bfe6b52c118fa1c957149418731c2e9c4daaf2d65dc8fe744dcc146c2489b054bb8a09a98e17649a07811ab4e679aecc643081
-
Filesize
624KB
MD5ae74a99fb9f5d5e19307134301ccf089
SHA15e06c7be14ead1e818b7c4b8d5ba74ab47ffba4b
SHA256872ca67c70c4150fe57de2aaed17d77e5e993501074739694182c62f335c45e1
SHA512d8fbf7ca389d8c28e00e0fd65a06057a15790d03e679f1e12eba41a9a681c6467dbc534470691f303ec07b242723404d0f492b5e6fc9b7d59218fc295dbdbca3
-
Filesize
5.4MB
MD5e7d7ad719aeafc88d6f77210e1baba5f
SHA1008aab25b118529dea18f420d47c1de4edd87f83
SHA256c000e45fa080aa45e39beaf1b67bae677eb3823d8f410f0995e7080e054ef582
SHA512c750271b298b2a43503671c1c369bebb4e9e05ac4954123d545d59163af71ffddcfc925462649455afcd134558a8830874c0802d7def659ebad731b32984597d
-
Filesize
14.4MB
MD5be433764fa9bbe0f2f9c654f6512c9e0
SHA1b87c38d093872d7be7e191f01107b39c87888a5a
SHA25640ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
SHA5128a050ebd392654ce5981af3d0bf99107bfa576529bce8325a7ccc46f92917515744026a2d0ea49afb72bbc4e4278638a0677c6596ad96b7019e47c250e438191
-
Filesize
14.4MB
MD5be433764fa9bbe0f2f9c654f6512c9e0
SHA1b87c38d093872d7be7e191f01107b39c87888a5a
SHA25640ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
SHA5128a050ebd392654ce5981af3d0bf99107bfa576529bce8325a7ccc46f92917515744026a2d0ea49afb72bbc4e4278638a0677c6596ad96b7019e47c250e438191
-
Filesize
13.7MB
MD524e8177b25c072f4fb0d37496ccdbb34
SHA1afa5badce64ee67290add24e0dc3d8210954ac6c
SHA256e59ae3e886bd4571a811fe31a47959ae5c40d87c583f786816c60440252cd7ec
SHA5122fda8abc77b6ed9e98a2b120628e4e3b9458f2b18998c836eec1de82642244fe55234c7e52d6036d8b75c4b707a24f12fa639cc92d4234e94ed604a259d651e4
-
Filesize
13.7MB
MD524e8177b25c072f4fb0d37496ccdbb34
SHA1afa5badce64ee67290add24e0dc3d8210954ac6c
SHA256e59ae3e886bd4571a811fe31a47959ae5c40d87c583f786816c60440252cd7ec
SHA5122fda8abc77b6ed9e98a2b120628e4e3b9458f2b18998c836eec1de82642244fe55234c7e52d6036d8b75c4b707a24f12fa639cc92d4234e94ed604a259d651e4
-
Filesize
632KB
MD5c9d95472a5627c6c455e74c8b8fef5be
SHA134cb7f8f8b8dede7be6fd99e2b4bddaa37e5db82
SHA2564b1bf90a0e4e3a628613c2fe42ddba589ee6303e37ccc70cf99ddc92dde03b0b
SHA512989caff542f310972c15364925af542984ca73c1c1eec82fcbd1ea4bf9186487fd8349989afc95db4e761ebcbb8b14ce49482bc61d51b3259d134c571f4fab31
-
Filesize
632KB
MD5c9d95472a5627c6c455e74c8b8fef5be
SHA134cb7f8f8b8dede7be6fd99e2b4bddaa37e5db82
SHA2564b1bf90a0e4e3a628613c2fe42ddba589ee6303e37ccc70cf99ddc92dde03b0b
SHA512989caff542f310972c15364925af542984ca73c1c1eec82fcbd1ea4bf9186487fd8349989afc95db4e761ebcbb8b14ce49482bc61d51b3259d134c571f4fab31
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
632KB
MD594970fc3a8ed7b9de44f4117419ce829
SHA1aa1292f049c4173e2ab60b59b62f267fd884d21a
SHA256de1acbb1df68a39a5b966303ac1b609dde2688b28ebf3eba8d2adeeb3d90bf5e
SHA512b17bd215b83bfa46512b73c3d9f430806ca3bea13bebde971e8edd972614e54a7ba3d6fc3439078cdfdaa7eeb1f3f9054bf03ed5c45b622b691b968d4ec0566f
-
Filesize
632KB
MD594970fc3a8ed7b9de44f4117419ce829
SHA1aa1292f049c4173e2ab60b59b62f267fd884d21a
SHA256de1acbb1df68a39a5b966303ac1b609dde2688b28ebf3eba8d2adeeb3d90bf5e
SHA512b17bd215b83bfa46512b73c3d9f430806ca3bea13bebde971e8edd972614e54a7ba3d6fc3439078cdfdaa7eeb1f3f9054bf03ed5c45b622b691b968d4ec0566f
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2