6db9f6442d46fbde0953f8bfbc36bd714e5e31a62f927563594cafd60724d3e0

Analysis

max time kernel
149s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_32_/1-LGS-x64/Setup.exe
Size

118.1MB
MD5

5217f677000ea8c475eea1131163076c
SHA1

d76425f38d1869106a33c4c406ba3e5cba1c344f
SHA256

034c3d6537e802c6eaf3b40aca1f6242888a5091a51eec509f46815c75edc681
SHA512

9a620bdf8e44f51197b91c2c1822bebac2f55818b15dbf2f072514a74f46b9245fb8099ec1179ebf875d24c894247074d7630b0f6a3a0538065ae43063122efd
SSDEEP

3145728:0isR3UqWFXT54Abwop3Nfbv1FYBqQaYuvZU8PzZdzNOWeY:0isR37K4A0MVtFcBQXzr

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\LGBusEnum64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\LGJoyXlCore64.sys	DrvInst.exe

Executes dropped EXE 18 IoCs

pid	Process
1380	vcredist.exe
3820	vcredist.exe
2056	vcredist32.exe
1624	vcredist32.exe
4112	LGS-9.04.49.exe
3024	DifxInstaller.exe
2384	DifxInstaller.exe
3676	DifxInstaller.exe
3084	DifxInstaller.exe
3948	DifxInstaller.exe
2760	DifxInstaller.exe
3912	DifxInstaller.exe
1864	DifxInstaller.exe
1380	Install_apo.exe
3144	Install_apo.exe
9972	LogiRegistryService.exe
9912	LogiRegistryService.exe
9864	LogiRegistryService.exe

Loads dropped DLL 59 IoCs

pid	Process
3820	vcredist.exe
1624	vcredist32.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
4112	LGS-9.04.49.exe
14292	regsvr32.exe
14312	regsvr32.exe
14328	regsvr32.exe
12296	regsvr32.exe
10368	regsvr32.exe
10356	regsvr32.exe
10336	regsvr32.exe
10308	regsvr32.exe
10292	regsvr32.exe
10272	regsvr32.exe
10248	regsvr32.exe
10232	regsvr32.exe
10204	regsvr32.exe
10184	regsvr32.exe
10168	regsvr32.exe
10148	regsvr32.exe
10128	regsvr32.exe
10112	regsvr32.exe
10088	regsvr32.exe
10068	regsvr32.exe
10048	regsvr32.exe
10032	regsvr32.exe
10012	regsvr32.exe
9996	regsvr32.exe
9824	regsvr32.exe
9808	regsvr32.exe
9784	regsvr32.exe
9768	regsvr32.exe
9748	regsvr32.exe
9728	regsvr32.exe
9704	regsvr32.exe
9688	regsvr32.exe

Registers COM server for autorun 1 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B957A89F-1F2C-4D0F-ABEE-E61E5F698B22}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DD075CB-CCF0-4A26-B970-2ACD092662DB}\InProcServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\LGJoyHid\\LGHppFrc.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DD075CB-CCF0-4A26-B970-2ACD092662DB}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3A1BCE4-8217-423D-8934-3823F395B5C2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B82825-6E21-4249-B372-C2A1F8E948AA}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7734DE5F-5567-4C16-81A0-8127AFA4F1FC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B957A89F-1F2C-4D0F-ABEE-E61E5F698B22}\InProcServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\USBAudio\\LGSpeakerPropPage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0400-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14599217-F4F5-4B07-BF65-249B9D59C915}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7734DE5F-5567-4C16-81A0-8127AFA4F1FC}\InProcServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\USBAudio\\LGRenderPropPage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\InprocServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\USBAudio\\LGSpeakerPropPage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\LGJoyHid\\LGHppFrc.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0400-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32\ = "C:\\Program Files\\Logitech Gaming Software\\LGJoyDriverAPI.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B82825-6E21-4249-B372-C2A1F8E948AA}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B82825-6E21-4249-B372-C2A1F8E948AA}\InProcServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\USBAudio\\LGCapturePropPage.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3A1BCE4-8217-423D-8934-3823F395B5C2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7734DE5F-5567-4C16-81A0-8127AFA4F1FC}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DD075CB-CCF0-4A26-B970-2ACD092662DB}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14599217-F4F5-4B07-BF65-249B9D59C915}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14599217-F4F5-4B07-BF65-249B9D59C915}\InprocServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\USBAudio\\LGCapturePropPage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3A1BCE4-8217-423D-8934-3823F395B5C2}\InprocServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\USBAudio\\LGRenderPropPage.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B957A89F-1F2C-4D0F-ABEE-E61E5F698B22}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0400-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{050d4fc8-5d48-4b8f-8972-47c82c46020f} = "\"C:\\ProgramData\\Package Cache\\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\\vcredist_x64.exe\" /burn.runonce"	vcredist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{f65db027-aff3-4070-886a-0d87064aabb1} = "\"C:\\ProgramData\\Package Cache\\{f65db027-aff3-4070-886a-0d87064aabb1}\\vcredist_x86.exe\" /burn.runonce"	vcredist32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Launch LCore = "C:\\Program Files\\Logitech Gaming Software\\LCore.exe /minimized"	LGS-9.04.49.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA33.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgaudio.inf_amd64_2c12e9bd731d3023\LogiHeadsetCaptureAPO.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgaudio.inf_amd64_2c12e9bd731d3023\lgAudio.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETC9A4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\LGJoyHid.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgaudio.inf_amd64_2c12e9bd731d3023\LogiSpeakerAPO.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18c1d2d4-fd25-3442-9c04-c365b3da66e1}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgsfusbfilt.inf_amd64_c58ae453c0b215ec\LGSUsbFilt.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETC9C4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA43.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgjoyhid.inf_amd64_b9c068f3b67c9ab5\LGJoyHid.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{18c1d2d4-fd25-3442-9c04-c365b3da66e1}\SETAEFA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3a109f78-4b40-c24f-999d-df2795a18e0a}\SETB224.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f05faf93-943e-3249-b1a7-48ea5400f1ef}\SETB90B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a603a368-2b82-c644-af0a-0f0eb17729df}\SETC4B4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lgbusenum.inf_amd64_6c2dd07805be0c76\lgbusenum.PNF	DifxInstaller.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DifxInstaller.exe
File created	C:\Windows\System32\DriverStore\Temp\{8b8e02af-3f3e-8644-9c9c-f37184898c2b}\SETCFAF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA6AD.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA6AD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18c1d2d4-fd25-3442-9c04-c365b3da66e1}\LGPBTDD.sys	DrvInst.exe
File created	\??\c:\windows\system32\driverstore\filerepository\lgbusenum.inf_amd64_6c2dd07805be0c76\lgbusenum.PNF	DifxInstaller.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3a109f78-4b40-c24f-999d-df2795a18e0a}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\LGBusEnum64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgbusenum.inf_amd64_6c2dd07805be0c76\LGBusEnum.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETC9C4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA44.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA6BF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgsfmouhid.inf_amd64_7704a84ec2ea5556\LGSFMOUHID.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a603a368-2b82-c644-af0a-0f0eb17729df}\SETC4A3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a603a368-2b82-c644-af0a-0f0eb17729df}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DifxInstaller.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18c1d2d4-fd25-3442-9c04-c365b3da66e1}\SETAEF9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgjoywinusb.inf_amd64_08aa7b168df66386\WdfCoInstaller01009.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA5B1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA6BE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\ladfGSS.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18c1d2d4-fd25-3442-9c04-c365b3da66e1}\SETAEE8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3a109f78-4b40-c24f-999d-df2795a18e0a}\SETB236.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a603a368-2b82-c644-af0a-0f0eb17729df}\SETC4B4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DifxInstaller.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f05faf93-943e-3249-b1a7-48ea5400f1ef}\SETB8DB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\LGBusEnum.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\SETBED9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETC9A4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA5B1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3a109f78-4b40-c24f-999d-df2795a18e0a}\LkmdfCoInst.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgsfmouhid.inf_amd64_7704a84ec2ea5556\LGSHidFilt.Sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DifxInstaller.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgjoywinusb.inf_amd64_08aa7b168df66386\LGJoyWinUsb.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgvirhid.inf_amd64_a850191decca9c59\LGVirHid.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA33.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA837.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lgsfusbfilt.inf_amd64_c58ae453c0b215ec\LGSFUsbFilt.PNF	DifxInstaller.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\SETBEC7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8b8e02af-3f3e-8644-9c9c-f37184898c2b}\SETCFE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lgjoywinusb.inf_amd64_08aa7b168df66386\WinUSBCoInstaller.dll	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Logitech Gaming Software\Resources\G29\Images\outline_wheel_R2.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\ArxControlMgr\perfMonitor\img\MiniPerformance_ClockSpeedIcon.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G302\Images\G302_no_glow.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\THAI\Letter_0x3e.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\checkbox_disabled.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G300\Images\pulseglow_G300_btn6.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\US\Letter_0x35.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\C920\Manifest\Device_Manifest.xml	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G9X\Images\pulseglow_G9_btn4.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\PowerModel\46D_4079.xml	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G310\Images\Svg\G310_DEU.svg	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G502\Images\pulseglow_G502_btn4.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\CHT\Letter_0x38.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\US\Letter_0x28.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\qvga_background.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\ArxControlMgr\jQuery\jquery.mobile\jquery.mobile-1.4.2.js	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G310\KeyboardLayouts\G310_TUR.xml	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G900\Images\G900_Buttons_Right.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\THAI\Letter_0x0e.png	LGS-9.04.49.exe
File opened for modification	C:\Program Files\Logitech Gaming Software\SDK\Updates\G-key\	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\ITA\Letter_0x34.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\KOR\Letter_0x53.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\TUR\Letter_0x09.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\US\Letter_0x4f.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G920\Images\icon_xbox_y.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\surface_tuning_hover.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\xC336\KeyboardLayouts\xC336_RU.xml	LGS-9.04.49.exe
File opened for modification	C:\Program Files\Logitech Gaming Software\strings\deu\Strings.ini	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_0x16.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\NORDIC\Letter_0x47.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G930\Images\pulseglow_G930_gkeys.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\LU_1\Ita\LUpdate.xml	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G105\Images\Svg\G105_UK.svg	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\CHT\Letter_0x0d.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\ESP\Letter_0x46.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\ESP\Letter_G4.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\DPIStickYDefaultShift.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\panel-bottomright.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\RU\Letter_0x19.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\UK\Letter_G3.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\mono_up_arrow.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G29\Images\icon_PSbutton_circle.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\DEU\Letter_0x1d.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\FRA\Letter_Mute.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\KOR\Letter_0x16.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\ArxControlMgr\GKeyApplet\img\[email protected]	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G29\Images\outline_G29_btn_minus.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\CHT\Letter_0x08.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\NORDIC\Letter_0x11.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\TUR\Letter_0x3d.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\ArxControlMgr\perfMonitor\img\[email protected]	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G900\Images\Icon_Layout_Basic.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\CHT\Letter_G6.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\JPN\Letter_0xe6.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\btn_levels_hover.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\sync_button_animation.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G13\Manifest\Device_Manifest.xml	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G430\Images\G430Device.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_0x34.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\JPN\Letter_0x58.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\NORDIC\Letter_G7.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\G910\Images\UK\Letter_0x1d.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\checkbox_selected_disabled.png	LGS-9.04.49.exe
File created	C:\Program Files\Logitech Gaming Software\Resources\Images\tuning_surface_custom_selected.png	LGS-9.04.49.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe
File created	C:\Windows\inf\oem6.inf	DrvInst.exe
File created	C:\Windows\INF\oem7.PNF	DifxInstaller.exe
File created	C:\Windows\inf\oem8.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem8.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe
File created	C:\Windows\inf\oem10.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem9.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe
File opened for modification	C:\Windows\inf\oem6.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem7.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem9.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem10.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem7.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DifxInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DifxInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DifxInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DifxInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DifxInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DifxInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DifxInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DifxInstaller.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DifxInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DifxInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DifxInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.CapturePropPage.Redirect\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E19EFD4-8AEE-4D1A-ABF4-315488FD0F16}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28F5257E-A699-424A-908E-AC7D53F53589}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	vcredist.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{f65db027-aff3-4070-886a-0d87064aabb1}	vcredist32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B82825-6E21-4249-B372-C2A1F8E948AA}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EE933E9-B835-49EF-B708-86A1DAC8E69A}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F17E2123-BEEB-4563-97E5-A97E2277905C}\TypeLib\ = "{5EE933E9-B835-49EF-B708-86A1DAC8E69A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.SpeakerPropPage.Redirect\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFDE0400-02ED-40A6-BC30-C7AF99D2D588}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267cedc5-dc30-4155-818b-c023a80aea78}\ServerBinary\ = "C:\\Program Files\\Logitech Gaming Software\\SDK\\Arx Control\\x86\\LogitechGArxControl.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14599217-F4F5-4B07-BF65-249B9D59C915}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.SpeakerPropPage.Redirect.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.SpeakerPropPage.Redirect\CurVer\ = "Logitech.Gaming.Audio.SpeakerPropPage.Redirect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28F5257E-A699-424A-908E-AC7D53F53589}\ = "ILGPropCaptureRedirect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.CapturePropPage.Redirect\CurVer\ = "Logitech.Gaming.Audio.CapturePropPage.Redirect.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B957A89F-1F2C-4D0F-ABEE-E61E5F698B22}\ = "Redirect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\ = "{050d4fc8-5d48-4b8f-8972-47c82c46020f}"	vcredist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{267cedc5-dc30-4155-818b-c023a80aea78}\ServerBinary\ = "C:\\Program Files\\Logitech Gaming Software\\SDK\\Arx Control\\x64\\LogitechGArxControl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14599217-F4F5-4B07-BF65-249B9D59C915}\ProgID\ = "Logitech.Gaming.Audio.CapturePropPage.Redirect.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E19EFD4-8AEE-4D1A-ABF4-315488FD0F16}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F17E2123-BEEB-4563-97E5-A97E2277905C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F17E2123-BEEB-4563-97E5-A97E2277905C}\ = "ILGPropSpeakerRedirect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.CapturePropPage.Redirect\ = "PropCaptureRedirect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14599217-F4F5-4B07-BF65-249B9D59C915}\ = "PropCaptureRedirect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B957A89F-1F2C-4D0F-ABEE-E61E5F698B22}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3A1BCE4-8217-423D-8934-3823F395B5C2}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DD075CB-CCF0-4A26-B970-2ACD092662DB}\ = "Logitech HID++ Force Feedback Device"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fe750200-b72e-11d9-829b-0050da1a72d3}\ = "lgLcd API DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{267cedc5-dc30-4155-818b-c023a80aea78}\ServerBinary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a6519e67-7632-4375-afdf-caa889744403}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{261AB881-2625-48AC-9364-B052CE81F3CE}\ = "LGSpeakerPropPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.SpeakerPropPage.Redirect\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3A1BCE4-8217-423D-8934-3823F395B5C2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7734DE5F-5567-4C16-81A0-8127AFA4F1FC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28F5257E-A699-424A-908E-AC7D53F53589}\TypeLib\ = "{0E19EFD4-8AEE-4D1A-ABF4-315488FD0F16}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.RenderPropPage.Redirect\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DD075CB-CCF0-4A26-B970-2ACD092662DB}\InProcServer32\ = "C:\\Program Files\\Logitech Gaming Software\\Drivers\\LGJoyHid\\LGHppFrc32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267cedc5-dc30-4155-818b-c023a80aea78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.CapturePropPage.Redirect.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B82825-6E21-4249-B372-C2A1F8E948AA}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E19EFD4-8AEE-4D1A-ABF4-315488FD0F16}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\ = "PropSpeakerRedirect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DD075CB-CCF0-4A26-B970-2ACD092662DB}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\ = "Logitech HID++ Force Feedback API"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.CapturePropPage.Redirect.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14599217-F4F5-4B07-BF65-249B9D59C915}\VersionIndependentProgID\ = "Logitech.Gaming.Audio.CapturePropPage.Redirect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F17E2123-BEEB-4563-97E5-A97E2277905C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f65db027-aff3-4070-886a-0d87064aabb1}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501"	vcredist32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E19EFD4-8AEE-4D1A-ABF4-315488FD0F16}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DD075CB-CCF0-4A26-B970-2ACD092662DB}\ = "Logitech HID++ Force Feedback Device"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D042C8-EAC5-4F86-85D1-F4446AAFE1D4}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EE933E9-B835-49EF-B708-86A1DAC8E69A}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74210DE2-C7E1-42FE-8959-287D5064D433}\TypeLib\ = "{95152CB7-6F45-43EA-BDBF-5ECE2C797216}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logitech.Gaming.Audio.RenderPropPage.Redirect.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F17E2123-BEEB-4563-97E5-A97E2277905C}\TypeLib	regsvr32.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeBackupPrivilege	968	vssvc.exe
Token: SeRestorePrivilege	968	vssvc.exe
Token: SeAuditPrivilege	968	vssvc.exe
Token: SeBackupPrivilege	3348	srtasks.exe
Token: SeRestorePrivilege	3348	srtasks.exe
Token: SeSecurityPrivilege	3348	srtasks.exe
Token: SeTakeOwnershipPrivilege	3348	srtasks.exe
Token: SeBackupPrivilege	3348	srtasks.exe
Token: SeRestorePrivilege	3348	srtasks.exe
Token: SeSecurityPrivilege	3348	srtasks.exe
Token: SeTakeOwnershipPrivilege	3348	srtasks.exe
Token: SeAuditPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	3024	DifxInstaller.exe
Token: SeLoadDriverPrivilege	2384	DifxInstaller.exe
Token: SeLoadDriverPrivilege	3676	DifxInstaller.exe
Token: SeLoadDriverPrivilege	3084	DifxInstaller.exe
Token: SeLoadDriverPrivilege	3948	DifxInstaller.exe
Token: SeRestorePrivilege	3348	DrvInst.exe
Token: SeBackupPrivilege	3348	DrvInst.exe
Token: SeRestorePrivilege	3348	DrvInst.exe
Token: SeBackupPrivilege	3348	DrvInst.exe
Token: SeLoadDriverPrivilege	3348	DrvInst.exe
Token: SeLoadDriverPrivilege	3348	DrvInst.exe
Token: SeLoadDriverPrivilege	3348	DrvInst.exe
Token: SeLoadDriverPrivilege	3948	DifxInstaller.exe
Token: SeLoadDriverPrivilege	2760	DifxInstaller.exe
Token: SeLoadDriverPrivilege	3912	DifxInstaller.exe
Token: SeLoadDriverPrivilege	1864	DifxInstaller.exe
Token: SeLoadDriverPrivilege	9748	regsvr32.exe
Token: SeShutdownPrivilege	9356	MsiExec.exe
Token: SeIncreaseQuotaPrivilege	9356	MsiExec.exe
Token: SeSecurityPrivilege	9324	msiexec.exe
Token: SeCreateTokenPrivilege	9356	MsiExec.exe
Token: SeAssignPrimaryTokenPrivilege	9356	MsiExec.exe
Token: SeLockMemoryPrivilege	9356	MsiExec.exe
Token: SeIncreaseQuotaPrivilege	9356	MsiExec.exe
Token: SeMachineAccountPrivilege	9356	MsiExec.exe
Token: SeTcbPrivilege	9356	MsiExec.exe
Token: SeSecurityPrivilege	9356	MsiExec.exe
Token: SeTakeOwnershipPrivilege	9356	MsiExec.exe
Token: SeLoadDriverPrivilege	9356	MsiExec.exe
Token: SeSystemProfilePrivilege	9356	MsiExec.exe
Token: SeSystemtimePrivilege	9356	MsiExec.exe
Token: SeProfSingleProcessPrivilege	9356	MsiExec.exe
Token: SeIncBasePriorityPrivilege	9356	MsiExec.exe
Token: SeCreatePagefilePrivilege	9356	MsiExec.exe
Token: SeCreatePermanentPrivilege	9356	MsiExec.exe
Token: SeBackupPrivilege	9356	MsiExec.exe
Token: SeRestorePrivilege	9356	MsiExec.exe
Token: SeShutdownPrivilege	9356	MsiExec.exe
Token: SeDebugPrivilege	9356	MsiExec.exe
Token: SeAuditPrivilege	9356	MsiExec.exe
Token: SeSystemEnvironmentPrivilege	9356	MsiExec.exe
Token: SeChangeNotifyPrivilege	9356	MsiExec.exe
Token: SeRemoteShutdownPrivilege	9356	MsiExec.exe
Token: SeUndockPrivilege	9356	MsiExec.exe
Token: SeSyncAgentPrivilege	9356	MsiExec.exe
Token: SeEnableDelegationPrivilege	9356	MsiExec.exe
Token: SeManageVolumePrivilege	9356	MsiExec.exe
Token: SeImpersonatePrivilege	9356	MsiExec.exe
Token: SeCreateGlobalPrivilege	9356	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1380	2116	Setup.exe	83
PID 2116 wrote to memory of 1380	2116	Setup.exe	83
PID 2116 wrote to memory of 1380	2116	Setup.exe	83
PID 1380 wrote to memory of 3820	1380	vcredist.exe	84
PID 1380 wrote to memory of 3820	1380	vcredist.exe	84
PID 1380 wrote to memory of 3820	1380	vcredist.exe	84
PID 2116 wrote to memory of 2056	2116	Setup.exe	97
PID 2116 wrote to memory of 2056	2116	Setup.exe	97
PID 2116 wrote to memory of 2056	2116	Setup.exe	97
PID 2056 wrote to memory of 1624	2056	vcredist32.exe	98
PID 2056 wrote to memory of 1624	2056	vcredist32.exe	98
PID 2056 wrote to memory of 1624	2056	vcredist32.exe	98
PID 2116 wrote to memory of 4112	2116	Setup.exe	102
PID 2116 wrote to memory of 4112	2116	Setup.exe	102
PID 2116 wrote to memory of 4112	2116	Setup.exe	102
PID 4112 wrote to memory of 4992	4112	LGS-9.04.49.exe	103
PID 4112 wrote to memory of 4992	4112	LGS-9.04.49.exe	103
PID 4112 wrote to memory of 4992	4112	LGS-9.04.49.exe	103
PID 4992 wrote to memory of 2196	4992	net.exe	105
PID 4992 wrote to memory of 2196	4992	net.exe	105
PID 4992 wrote to memory of 2196	4992	net.exe	105
PID 4112 wrote to memory of 3024	4112	LGS-9.04.49.exe	106
PID 4112 wrote to memory of 3024	4112	LGS-9.04.49.exe	106
PID 2688 wrote to memory of 2596	2688	svchost.exe	109
PID 2688 wrote to memory of 2596	2688	svchost.exe	109
PID 4112 wrote to memory of 2384	4112	LGS-9.04.49.exe	111
PID 4112 wrote to memory of 2384	4112	LGS-9.04.49.exe	111
PID 2688 wrote to memory of 4284	2688	svchost.exe	113
PID 2688 wrote to memory of 4284	2688	svchost.exe	113
PID 4112 wrote to memory of 3676	4112	LGS-9.04.49.exe	114
PID 4112 wrote to memory of 3676	4112	LGS-9.04.49.exe	114
PID 2688 wrote to memory of 2372	2688	svchost.exe	116
PID 2688 wrote to memory of 2372	2688	svchost.exe	116
PID 4112 wrote to memory of 3084	4112	LGS-9.04.49.exe	117
PID 4112 wrote to memory of 3084	4112	LGS-9.04.49.exe	117
PID 2688 wrote to memory of 1108	2688	svchost.exe	119
PID 2688 wrote to memory of 1108	2688	svchost.exe	119
PID 4112 wrote to memory of 3948	4112	LGS-9.04.49.exe	120
PID 4112 wrote to memory of 3948	4112	LGS-9.04.49.exe	120
PID 2688 wrote to memory of 1380	2688	svchost.exe	122
PID 2688 wrote to memory of 1380	2688	svchost.exe	122
PID 2688 wrote to memory of 3348	2688	svchost.exe	123
PID 2688 wrote to memory of 3348	2688	svchost.exe	123
PID 4112 wrote to memory of 2760	4112	LGS-9.04.49.exe	124
PID 4112 wrote to memory of 2760	4112	LGS-9.04.49.exe	124
PID 2688 wrote to memory of 2844	2688	svchost.exe	126
PID 2688 wrote to memory of 2844	2688	svchost.exe	126
PID 4112 wrote to memory of 3912	4112	LGS-9.04.49.exe	127
PID 4112 wrote to memory of 3912	4112	LGS-9.04.49.exe	127
PID 2688 wrote to memory of 376	2688	svchost.exe	129
PID 2688 wrote to memory of 376	2688	svchost.exe	129
PID 4112 wrote to memory of 1864	4112	LGS-9.04.49.exe	130
PID 4112 wrote to memory of 1864	4112	LGS-9.04.49.exe	130
PID 2688 wrote to memory of 2912	2688	svchost.exe	132
PID 2688 wrote to memory of 2912	2688	svchost.exe	132
PID 4112 wrote to memory of 1380	4112	LGS-9.04.49.exe	133
PID 4112 wrote to memory of 1380	4112	LGS-9.04.49.exe	133
PID 4112 wrote to memory of 3144	4112	LGS-9.04.49.exe	135
PID 4112 wrote to memory of 3144	4112	LGS-9.04.49.exe	135
PID 4112 wrote to memory of 14292	4112	LGS-9.04.49.exe	137
PID 4112 wrote to memory of 14292	4112	LGS-9.04.49.exe	137
PID 4112 wrote to memory of 14292	4112	LGS-9.04.49.exe	137
PID 4112 wrote to memory of 14312	4112	LGS-9.04.49.exe	138
PID 4112 wrote to memory of 14312	4112	LGS-9.04.49.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\$_32_\1-LGS-x64\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\$_32_\1-LGS-x64\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist.exe
  C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49/vcredist.exe /q
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist.exe
    "C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist.exe" /q -burn.unelevated BurnPipe.{B5EB283F-9D01-4167-AA18-F0983B6976E7} {E9A1D52D-C77B-4BD8-8C59-ACDF9707D356} 1380
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3820
- C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist32.exe
  C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49/vcredist32.exe /q
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist32.exe
    "C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist32.exe" /q -burn.unelevated BurnPipe.{C8EE4AB9-2C66-42D7-90E5-4C0E36C4366C} {35D5FF4C-39B8-4B7E-814A-71942A680B29} 2056
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1624
- C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\LGS-9.04.49.exe
  C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49/LGS-9.04.49.exe /langid=ENU
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\net.exe
    net stop LogiRegistryService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop LogiRegistryService
      4⤵
      PID:2196
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\lgAudio.inf" DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\LGSBulk\LGPBTDD.inf" DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\LGSHidFilter\LGSFMouHID.inf" DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\LGSHidFilter\LGSFUsbFilt.inf" DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\VirtualBus\LGBusEnum.inf" npnp=root\LogiGamePanelVirtualBus DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\VirtualBus\LGVirHid.inf" DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\LGJoyHid.inf" DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe" install "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\WinUSB\LGJoyWinUsb.inf" DRIVER_PACKAGE_FORCE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\Install_apo.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\Install_apo.exe" --remove 1 --inf "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\lgAudio.inf"
    3⤵
    - Executes dropped EXE
    PID:1380
- - C:\Program Files\Logitech Gaming Software\Drivers\Installers\Install_apo.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\Installers\Install_apo.exe" --repair --inf "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\lgAudio.inf"
    3⤵
    - Executes dropped EXE
    PID:3144
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\LCD\x86\LgLcdApi.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:14292
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\LCD\x64\LgLcdApi.dll"
    3⤵
    - Loads dropped DLL
    PID:14312
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\SDK\LCD\x64\LgLcdApi.dll"
      4⤵
      Loads dropped DLL
      PID:14328
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\G-key\x86\LogitechGkey.dll"
    3⤵
    - Loads dropped DLL
    PID:12296
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\G-key\x64\LogitechGkey.dll"
    3⤵
    - Loads dropped DLL
    PID:10368
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\SDK\G-key\x64\LogitechGkey.dll"
      4⤵
      Loads dropped DLL
      PID:10356
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\LCD\x86\LogitechLcd.dll"
    3⤵
    - Loads dropped DLL
    PID:10336
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\LCD\x64\LogitechLcd.dll"
    3⤵
    - Loads dropped DLL
    PID:10308
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\SDK\LCD\x64\LogitechLcd.dll"
      4⤵
      Loads dropped DLL
      PID:10292
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\LED\x86\LogitechLed.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:10272
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\LED\x64\LogitechLed.dll"
    3⤵
    - Loads dropped DLL
    PID:10248
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\SDK\LED\x64\LogitechLed.dll"
      4⤵
      Loads dropped DLL
      PID:10232
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\Arx Control\x86\LogitechGArxControl.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:10204
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\Arx Control\x64\LogitechGArxControl.dll"
    3⤵
    - Loads dropped DLL
    PID:10184
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\SDK\Arx Control\x64\LogitechGArxControl.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:10168
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\SteeringWheel\x86\LogitechSteeringWheel.dll"
    3⤵
    - Loads dropped DLL
    PID:10148
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\SDK\SteeringWheel\x64\LogitechSteeringWheel.dll"
    3⤵
    - Loads dropped DLL
    PID:10128
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\SDK\SteeringWheel\x64\LogitechSteeringWheel.dll"
      4⤵
      Loads dropped DLL
      PID:10112
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\LGCapturePropPage.dll"
    3⤵
    - Loads dropped DLL
    PID:10088
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\LGCapturePropPage.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:10068
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\LGRenderPropPage.dll"
    3⤵
    - Loads dropped DLL
    PID:10048
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\LGRenderPropPage.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:10032
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" /s "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\LGSpeakerPropPage.dll"
    3⤵
    - Loads dropped DLL
    PID:10012
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\LGSpeakerPropPage.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:9996
- - C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe" -install
    3⤵
    - Executes dropped EXE
    PID:9972
- - C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
    "C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe" -start
    3⤵
    - Executes dropped EXE
    PID:9912
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32" /s "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\LgJoyFrc64.dll"
    3⤵
    - Loads dropped DLL
    PID:9824
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\LgJoyFrc64.dll"
      4⤵
      Loads dropped DLL
      PID:9808
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\SysWOW64\regsvr32" /s "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\LgJoyFrc32.dll"
    3⤵
    - Loads dropped DLL
    PID:9784
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32" /s "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\LGHppFrc.dll"
    3⤵
    - Loads dropped DLL
    PID:9768
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\LGHppFrc.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:9748
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\SysWOW64\regsvr32" /s "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\LGHppFrc32.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:9728
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32" /s "C:\Program Files\Logitech Gaming Software\LGJoyDriverAPI.dll"
    3⤵
    - Loads dropped DLL
    PID:9704
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Logitech Gaming Software\LGJoyDriverAPI.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:9688
- C:\Windows\SYSTEM32\MsiExec.exe
  MsiExec /i "C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49/Upgrade.msi" ARPSYSTEMCOMPONENT=1 /quiet
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:9356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{64260511-6c08-a048-bcd0-f73fd0addba2}\lgAudio.inf" "9" "42004d2f7" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Logitech Gaming Software\Drivers\USBAudio"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2596
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{97a7d7c1-d029-0348-9734-2a572570f13e}\LGPBTDD.inf" "9" "4ccae46eb" "0000000000000160" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Logitech Gaming Software\Drivers\LGSBulk"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a64382b9-d9ed-bd4c-849a-9594030d098b}\LGSFMouHID.inf" "9" "418ebcfdb" "0000000000000154" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files\Logitech Gaming Software\Drivers\LGSHidFilter"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2fc64c50-d2ac-cd40-9cd0-4efa040d72ea}\LGSFUsbFilt.inf" "9" "475cfce8f" "0000000000000148" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Logitech Gaming Software\Drivers\LGSHidFilter"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1108
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6e3f53f3-1fa1-2842-91f6-5ad94e595e40}\LGBusEnum.inf" "9" "4cdf5f31b" "0000000000000148" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Logitech Gaming Software\Drivers\VirtualBus"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1380
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem7.inf" "oem7.inf:741f41b5bfe56c0f:LogiVirtualBus_Device64:9.4.30.0:root\logigamepanelvirtualbus," "4547e049b" "0000000000000148"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{17bd65f1-9503-d041-b960-58ca6a50806e}\LGVirHid.inf" "9" "41bd82f03" "0000000000000178" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files\Logitech Gaming Software\Drivers\VirtualBus"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2844
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c33044c0-7f1e-f94c-96a8-79836b248023}\LGJoyHid.inf" "9" "40177f85b" "0000000000000190" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:376
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{670ad582-aa83-8844-b2c7-3b389a410d2c}\LGJoyWinUsb.inf" "9" "4f5aa04f3" "0000000000000144" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Logitech Gaming Software\Drivers\LGJoyHid\WinUSB"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2912

C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
"C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe"
1⤵
- Executes dropped EXE
PID:9864

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:9324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\LOGITE~1\Drivers\LGSBulk\LGPBTDD.sys

Filesize
30KB

MD5
f705a641c18df31b48b5dbda94b425e4

SHA1
158ce5ec84f2bc0edad46a20cd337188721e51c4

SHA256
1f47ee43cafe5458e56467e127ee99b5fdbff8b810cf92b232094b475dd42b21

SHA512
b7ff9f285205328c69ab97d87b998e0b82ab2df05593363617b93dae9ba097227b4c11c3ac23f2a27aed24462db9d3648d71f021092af06ffaaaf6937e9ac66d

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\LGSBulk\LGPBTDDx64.cat

Filesize
7KB

MD5
b51f079efebf1d5d752e9c06e4fa26e4

SHA1
692bd9cf63fd79ae77370fc6dc8c225db67f14a8

SHA256
4b2c0c2333a356c8bae5b8919097dba47a350e4be50fe96a3193e42b93f1b222

SHA512
df8a31f01454f74ef8d4cfff5b0557065b80a079cd781ad30574a24114e7032cbbbc06836c463977ca05dea31e4962d4881867a5ef74759a0dfb451a4016fd03

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\LGSHID~1\LGSFMOUHID.cat

Filesize
10KB

MD5
eafb1487954d2dcebd1237611e10046c

SHA1
5b2036192dc6c208e7655d9cecf3a10d06a12cdf

SHA256
caf86f71ce7df14425af77c8980126e0c8640cd0e750ca2ac6c1f3d38c8761fa

SHA512
c0e2390f5d779026036df07f48c1648cab400ae183e8d986ecd94a096093df532bbabf6a9e5763cfff1a02891dc4f3e0aee3c371241e9057fbb11494bd11f944

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\LGSHID~1\LGSHidFilt.Sys

Filesize
62KB

MD5
94af1384a67b9fcf5651e70bc9d4c526

SHA1
0ae7038061e09b5beb5243b65b32f9f191d901f9

SHA256
9c025f7bbb5bbe9daf3def2f6385ce77c8f413912c4d16930814f6d19b62b367

SHA512
f38835a0fdd44dac87f6fd482eff633f062494a486ec1fd650de6eea913da9233de043aa9f262b8ca93639bcf5d3f8c440d02809936d7128f3750127bbf02317

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\LGSHID~1\LkmdfCoInst.dll

Filesize
1.8MB

MD5
23c8c188c7a05f7cc046f52c3508e261

SHA1
31db106bd1e7bfe9a91830bc852f42dab27d40de

SHA256
027edb8231b425fbd8f39675e838d72769170cafda8b932e885ada74b762798f

SHA512
c2c21e1992ac78f6ef64ec258fad8fc2c71055f2ec2de215aea1b3f005440bed6d2ff58d1e1369d6d65a566a03523fde0f02fe02d5e59be96752276121fe939b

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\USBAudio\LogiHeadsetCaptureAPO.dll

Filesize
2.0MB

MD5
32d2df14c194d308b9785e41af549766

SHA1
7f2a5d2b0b0c8118f0227e31935629ea2890f162

SHA256
59bf18d25af07f6725192e6e0379842c14949939e569355bf8bde028e36beded

SHA512
654dd245c6e76daa319405dded5f7b85bb30b63ff50265990d8452b227bc2d5cd0fe865f5a0026e12ebb1a1d3db008d1355689c0701a78d37d47d84f2b5587b0

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\USBAudio\LogiHeadsetRenderAPO.dll

Filesize
4.1MB

MD5
2201af97505077f7dc7563a9fba23269

SHA1
c4789f554be1753117341cb7e6c5b0e2d9c7e0f4

SHA256
a2cd411e395706fdfdaf2afbd73b57d6172843b1d8d9c2f8519e3b011a873659

SHA512
253d2ebf3bad4bbae196f1bbb06d398d191a07b4e425e442572d618f95635ad119c74d350c8861e254c559818744676ebd1af7400d69c3591fdc64b62418d2fe

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\USBAudio\LogiSpeakerAPO.dll

Filesize
2.2MB

MD5
280b8deaeb4b9770316514d6ec339f52

SHA1
54d6b16a9fcd1a1b6dde141c480423f91ba74b6b

SHA256
2b1f4cb797240f2aa8c9a2e9a78cae16ece856bf8530a8ceb0aedb7e0c88501b

SHA512
6970c1a975f8ad9217e822abff56431ed258d79fb0f2b2cd24db2cb73b90a6b36775edc04f1645e3a10d9c7f082f3573d1625b3405bbda372dc0be3e381b5f6f

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\USBAudio\ladfGSS.sys

Filesize
44KB

MD5
bc15a3f0b0ee88a8bba054426b2a70c1

SHA1
be455dd39fb5bf491b5e7a72011eb7f209366caa

SHA256
108719c5eac2262d575a3503bb6a9173a060e577c5c56aff7255919d59daaef6

SHA512
10ab0ba41dee5f1f811641c9ced877f5ed9e9708833fe4419c0b0f8d0e3a7e3eb0a75bf23c4b30926bab36d1a2c105c6238269004a26b040c8277e70fa92c66f

Download Submit
C:\PROGRA~1\LOGITE~1\Drivers\USBAudio\lgAudio.cat

Filesize
60KB

MD5
8185c8420a156dd26109808db0480847

SHA1
2712622d583028b26673c484b8eb6b968371ab55

SHA256
4c4ea5f4e3ffc869adffe7a4b30acfb7abf3b0dabc172c2fada5682061c4d0d7

SHA512
ca9d3fdc24e3e92c051484edf02368acad3676b6e4d202210241e53a8aa82b2cee4e984e84f9bf32eb680a641170b2a1bcdad1b245d196186aadf8be4fb79ddf

Download Submit
C:\Program Files\Logitech Gaming Software\ArxApplets\Dota 2\Applet_Files\jquery-1.10.1.js

Filesize
267KB

MD5
bd42b401ab68f9eb54eee47a873b5769

SHA1
b39b6f7d8c5f62a40960ded5c40cc288c10b438d

SHA256
ebaded49db62a60060caa2577f2a4ec1ff68726bc40861bc65d977abeb64fa7d

SHA512
4d762996fb0f803cc2a912ed869ca4e98d11c9459c758919ab7f1238380f1d6ee0e329f02bedabef47b79238618e55ff50e4a498003170cb8d098b41ea31b277

Download Submit
C:\Program Files\Logitech Gaming Software\Drivers\Installers\DifxInstaller.exe

Filesize
149KB

MD5
c40d18edcb3d4c3490f8cc60022f31a7

SHA1
fefcf5d8d37ddefad7317f72d941c50e484a1b1b

SHA256
2d4932011ed98e41f94ea88c8616cbddcb5f2ae0a6a6506e3f9bd58546230293

SHA512
fb610c961cf1c4b6ae35a125a5aa83717e4680be50573e1ff14a619a2cf13289035d6697c5c685b41d5e0321b7752d4e0913bfe6779e6ded1992f5d3151a13b4

Download Submit
C:\Program Files\Logitech Gaming Software\Drivers\LGSBulk\LGPBTDD.inf

Filesize
2KB

MD5
ca0fe9ef7f074aa8e72fabc0f54a61e2

SHA1
dac9489f097794424e029e6fa38da174d568d27a

SHA256
0ca409c16d4f53e57c593d8b61943c6fe3b36bbc27c3bbfe2636293cf5169f11

SHA512
cf38f29e74c742ff70513d0c4f027a5920c2f9f59c4ec180cb1bce820eb3dc889633e2eab9aa3b4765e30d21659ad4bc8f8f8884822d7f3c65bb77584f6a944e

Download Submit
C:\Program Files\Logitech Gaming Software\Drivers\LGSHidFilter\LGSFMouHID.inf

Filesize
6KB

MD5
5670f30ae0c06e19a8f5cc5601213f05

SHA1
e6ab570737e38cd1be8001bb4ead21520c011f28

SHA256
09f303fe2ffb1b741b1baab6199d2d466f50ef17f8cd782448396d6adb162222

SHA512
985d399c2894fbbff1d334160faf659f51c8d356bdd8acbf14c714343431c348c05a4b41e1b083aa74c97624fcfa7e2d524f0de4e0202fc3ded353a6a39a4d32

Download Submit
C:\Program Files\Logitech Gaming Software\Drivers\USBAudio\lgAudio.inf

Filesize
26KB

MD5
350a96ecd278a1d97fe847059a10cc58

SHA1
d947a7434437dde6775879ab1d3d146ee62a6cc2

SHA256
e3b4a62602beff5f132dc4a6d2b0635c2ca41267f7acb444970937b6623db82b

SHA512
c09cf2c31fd9651f3bccb6c5de1ef92c040f33b85e2b939d2e0fcc124ef1c285eea20d780cc6d7bbc2d766b0d5e1e5f44360433c88b669c5e232d4cf608be9b0

Download Submit
C:\Program Files\Logitech Gaming Software\LU_1\Lth\LUpdateProd_Legacy.xml

Filesize
5KB

MD5
7474dffcda1253a2d3284312906bcb83

SHA1
6ee1da0ffe4e6c90a1701259e3f16b2a3d271516

SHA256
e966caf988f9a43b22dc20c93eda921d217d82485aecfe7c554a818db784f502

SHA512
624d4c72c9f20a2602808115538c12d238efaf757e6ba89b8fbce7645552a07b9145bb7adf55376b3bc97740638e4d9e06c4219877fcc9f3ef32ca6186991caf

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\36b64f21992dbea6\09016d197ff8a448\a413d5d045c37441\3fd2c650a9419e60599d24abfb70cdbf

Filesize
143KB

MD5
a1feeebf476506a62b0d2baea899e547

SHA1
5ff98e525e5cb9f6b7cdd2a6e9c357fc8cf5c3ac

SHA256
bb077ef5dfe6788bdedb79fc3f20468740fb32dc3c00e344ed672c1d16cf4bb5

SHA512
caaba5b4f2d41c99bea6ff3fd3e4eb46eac93f7ab36858d7e09eaa3a235139ec2bea30355c70e876a5e42187b142683769f73abbe246039738b8c25604ffa4e3

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\36b64f21992dbea6\09016d197ff8a448\a413d5d045c37441\3fd2c650a9419e60f4df4aa78d60091c

Filesize
144KB

MD5
af3a0e5c38e6e39e1d80cd06664d5377

SHA1
a8cd983b118152159631fa88c22d931ce505969b

SHA256
030e8042f996096c7aa0367e3cb79c4c1578b3baa5348a51e6388cb8a7cd075d

SHA512
d1212063a57d33ac3bf21335d0a67b5a8238c1db8fbfdc677478cb399d84a52285c7e55cbd665a12d9e3f3ffafecaac102ae1777042d71001ddae31bf21c92ff

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\ArxControlMgr\GKeyApplet\img\nextDevice.png

Filesize
1KB

MD5
24410fd7c82fcbc4005eddb7a4ec907b

SHA1
6de65bf42cb3b2d5440aff4292cf5d8e6a57be82

SHA256
ee800f50e4c07dbc39e007639733b7930f886bd53e31668fdf6807cedd20781f

SHA512
b4a5ed07dc4f8d0e9cf8b1df7435c5b86579d806cc38e47c28f2e38fb2cb36ccf27c24a4adda0e8cb77fb4252a8ec4644f5a4eb820964bd2d377edcd1fe128be

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G105\Images\Svg\G105_KOR.svg

Filesize
188KB

MD5
638844a064723840f4dcdc2d5a0b0325

SHA1
610cd04abe8bf728f9b0569f9fa455638d373de6

SHA256
e515e5414ccd3afe906051deb03463033e5bc7e32406cfa0dd066e8b25fc7199

SHA512
6db592c7fb6fded05838d849ce9c386279233cf8072c009ba99e13d064f2a55b4ea6efe94842d9ca1141c44317819ddc9b2da2378591593b9d9bee78bab4f598

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G105\Images\Svg\G105_NORDIC.svg

Filesize
187KB

MD5
1b6e2b6f1e566594e21f8c3070efe462

SHA1
3b7410a19ae3588f258b6d3c6bc277d0530df1a6

SHA256
08316159d60c606ffb63e6c438bfe76ffcaf20c0eb40bb00b8f1d04516a35592

SHA512
4838fe130377ef9efea471f70ac9ae87978c6e58120d3d63859f10e7129ea3dcc75ee96dcb8e659c282e86ca2146100e84159b1d473d77b74130a14098b8c183

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G19s\Images\Svg\G19s_KOR.svg

Filesize
197KB

MD5
768d01ba2522daf1df4f0bb6c5dfab82

SHA1
b6a49185c34691651ce68cd280bc2b8101e134a8

SHA256
d54d75947ba8a423668ccb5521610182009a76a7890657a105aed57b4fc36b0f

SHA512
ad069205ba266016e5cf92544b5607fdf32faec3bda77695be203675011af4389214f5aa9b85adafc06f4d440d2880629fb50dcaa3dee7c00d7675a855f5c29f

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G19s\Images\Svg\G19s_NORDIC.svg

Filesize
196KB

MD5
e2ac3eefc3609575f95a36132b7a6ea5

SHA1
705df57b681a6da753fd2eff24ff7c0d145800e9

SHA256
f12feb04cbfb1edde734ef98039837cf00813bfe983d87858190b0887659d022

SHA512
0d087832da786a53c87b779c4a1a480fc46c0b4b210f36b198270b5d29f770370fe411f6c2594649af6ab4bf5b6a98c1691974ee9e46c5ee0ab202f32b51c4cd

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G303\Images\G303_no_glow.png

Filesize
102KB

MD5
2cfc82842f365ee05a5ec098d0488b42

SHA1
3156916e1f22453cbc2f289e4bea36e88053dac2

SHA256
0b8116e40db7083c136886defc244a1bccc55d4d395867f821222f9fb0463f40

SHA512
d049dcf5ab627d3384f276c1e389c2c7a9d128b6ef330ae2803d9c7d55c5b1b71be670bea9984b9d8eb28f9700192375fc947d6cdd7a05e4e0bc2b20f99bed00

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G310\Images\Svg\G310_JPN.svg

Filesize
276KB

MD5
004a489d880c0c0554b56aa90f3b4ef1

SHA1
87463aaec0774fb62128d972272c2292866628ed

SHA256
6fb1ad3de9848f2cb0a0a9e81b20213a3787d977c8eb1084ba3fb326972b17eb

SHA512
d61f085b504f064c4c73d670998df30fdc25aa2e93aa698da5520b38e626cdb727a720bd285fb9b1e67297261f7da48dd8ea160cbb938895ff7ad38d802dbdec

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G310\KeyboardLayouts\G310_DEU.xml

Filesize
3KB

MD5
9f8e2e792818895f5727013875a61042

SHA1
65dd2531a058f139b9978ae6eabcd91745386446

SHA256
d0fcc4bc6583878ca84998007178c52708ce8e2b17481aa9b6f0898a5da81171

SHA512
67444a4fe6e3a88d9dc8f40f3c6366530de488a54efbd182f68aeb41cfd6b9206327296385fa0a56c3dd8de9ad829b75316f540c91d3f25815000e2abed819ac

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G410\Images\Svg\G410_KOR.svg

Filesize
154KB

MD5
53d5a93f9b97adcb39f0eb5ecea9c3dd

SHA1
4d18d5212f3b3b1fb840ac12e82647bee51b83fd

SHA256
1222d81cb1cd0a224edba89b2455d772bdf1ce4c5eeae712b1aaef948adc7160

SHA512
0e1a15441611dd82ff76a9ab3ac3662ea856f0a717ae5e5a51da860752f535eb5424c0e7823c91d2d130d9ab15a8165cf58efb43c5454db6338214c3338d8e0f

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G410\KeyboardLayouts\G410_DEU.xml

Filesize
3KB

MD5
f32464e59e4db709ee60cba450d5112e

SHA1
e059980654388304a684e74479f0d16dc7889d4a

SHA256
b31fd06a2b443d70d029545cf2dd4ff2e7e2e843f0069a305598e87e64c8edcf

SHA512
b43ac5ad010944a2753345cb6c37715b1d1dc32cfbf4f2252eccc7a9f8a050469ba85afec1da2cac2b0c175396f48e64eacdb9384609f7f7b50038b271be8009

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G510s\Images\Svg\G510s_KOR.svg

Filesize
207KB

MD5
2d2ac09388898c2916255798a1d14643

SHA1
236e5538baeeabe86600eb0691f4cc03f02ef6d9

SHA256
87db8862a8b417e8de2b7df3629c66d5ed436298c555a7f317e376ff76e590ff

SHA512
3e8b55d8f47ba4c8252524fbd7d9bfe909250256ac904a4772065ad989fdb846205baf1bb5cda4ae3e176fa50baaa2d4bce2b804eb36a0eaac91aac42e9e0f95

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G510s\Images\Svg\G510s_NORDIC.svg

Filesize
206KB

MD5
62f66c79e8e0f45d8676cc52a0152363

SHA1
ab81f18d46c30e8f15fc90ec27f9da9de1f4ffcb

SHA256
2ca5c8a91795be169734c917959340e735e3b1add0649e0dbb5a1889a0ed24ca

SHA512
2bb32b859b0307566cb0708369e08d45b5c392029e33ec8e1f0fb1d34eb6d9aa396fc4420bdd01ff5f0013d4bc91a7f88ca450bf49cd7c4fd8825ddc04251d19

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G610\Images\Svg\G610_ITA.svg

Filesize
158KB

MD5
011c77f815952dfdde3b4db213617e9d

SHA1
cbe1481c1cb5df1552d3fba4bcd3e1f8f05738b4

SHA256
f07c08555f5f7d531a34ace57021d01ff7731804ccba47a8387b810d77a03e28

SHA512
b2ff7ee78e6ae52313b9472913b952b7805486582f1a94fc2adb589595002e0b836b5e3804a52a5cd60d303b6856e78a8d75877625cd4f67e680f89d4d00fec6

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G710\Images\Svg\G710_KOR.svg

Filesize
188KB

MD5
fb85c075b49b09f7ee401ebc63240774

SHA1
1bbd9fedeb3091d58b3b5191fa7adf55cb804307

SHA256
5bf75e5b0ca19570da4bc85e1a182d9a813f2396fb1374176c861b6f6183eec6

SHA512
de1ce95dba21beca61aa5f10f618683c554d03be35af79dbbad1f07ce1a7fbe2d284d774d551cc8220aca46e8c463a2d7ec2a6b110950130abf6d80b2d4dc050

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G710\Images\Svg\G710_NORDIC.svg

Filesize
188KB

MD5
788f21e162890397065d64126f9dc9b6

SHA1
fee169de8f216ff797ee6d404ce4adc976b24463

SHA256
9305498946e41bb05d04d256de41cc409bd9e1cdceae4d7345c7624c3817a796

SHA512
f0b0a6738904c9de347d81edf2265600b4f19ea7a4a20be767b7850e44764e09dc773c275f5d6e18044f34d9f9ac82179524a0f29010fc5ad414b9791f80f918

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G810\Images\Svg\G810_KOR.svg

Filesize
179KB

MD5
c080447d9e9f7e7056db380a039f522c

SHA1
5a3266be79738cd5492f0a3b7b16a3eb5a6b4978

SHA256
adee1adc8374c1f00d6716e219061d5798549c449567931a0669dd0616adc1f5

SHA512
56320d2b5c1b853472429196f8212ff5fc2fd92a77c30409dc2a6b048e1b9af63deea14838a8e2f241b934c0055162ada8500e8fa34df2d5b8fb1b13ec0f1f45

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G810\Images\Svg\G810_NORDIC.svg

Filesize
178KB

MD5
a4543ebcd48ff16c0a61e2a5a6b0b34d

SHA1
5d3ef4f68cfacbf58dd70164d530afe4fabce28f

SHA256
328da8b50b8515cc28d57d0122abe8109698234e60da626f68236267e49d362f

SHA512
167ab198a27beaaf412e2e090a7e0a11d5b3aeb349e549302860902e4dcab9c337534bb2072382c6a9e637e4e85f8387ab5521d819603244306c3150329420ae

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G810\KeyboardLayouts\G810_PIDC331_INTL.xml

Filesize
6KB

MD5
b9e4efe7d1e4d1f2354ead2b002df3bf

SHA1
870bb04d5827325913ba3f5fecc689d70d3c3aa9

SHA256
26f087b99ea27b19d37bdeecf023a41edb1c2514cc768f7b0f19ead951b0c50b

SHA512
bc30e4866cb1deb36210f73a5426eaa24d30def78618f79bbee7e5d1203ed96bdb7ec4136b6eeacbf241fb7d970e7e0f5b9661a7b47f7434fb51f7bbc21b8f23

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL2\Letter_Game.png

Filesize
1KB

MD5
e13007d5673237be2a107df77260894d

SHA1
b6a95b4c73319cf82564df1ca8e2877dffcb9cbd

SHA256
88ea728a0ed90bec44fd603fbf2348b4a8eb5dcfaa1d778c6954998d5ffe9668

SHA512
08f3e62c12d8705a64dbc8546d70b6adc71b7afd3319572941e4c0745672a8205a81b95d68dd840fb860ac27d3a0433b164634ad843d60dc5c49dc6cebf4cb00

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL2\Letter_Light.png

Filesize
1KB

MD5
19d19188d5d12fc4ba9cacdae0cafa59

SHA1
d415c8681bf5bf491fdb494a68a21c46c72796d1

SHA256
faf636ea7d6b894749148c85433a2f63edf07fd54b640e52f53c2b8400074e43

SHA512
147200f9ad03a28750632aeff486a6a5208d5f68b9393b21a75ba78d8f775836af1606e848f0a2438d16aaded5e8cb0017afa1dafb5ea5b964ff8f117221a1dd

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_0x2c.png

Filesize
703B

MD5
1710cb1ea66a16e07e2b1d0c6258849f

SHA1
a1b01b0c881044b40bf611506f14735e67d47bdc

SHA256
3830b0b1efad27b17a92b6dfc745bb6f4b3ee6678f13185e16d6fd501858b6f1

SHA512
021eb2a1de1320588a4acdbfeee5186034827e8a0ce0bccf806baef7a8af8fdfde4c54d635d8db46ecd62bbf1e3f40641c5ad3dac14719dd13ddef9f53ff7e40

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_FN.png

Filesize
1005B

MD5
33f85a094ce6db078c7bf72b291a470e

SHA1
5ae391eb2b11ef919f370ee0193621eab300f841

SHA256
09175b4ae0425c0301f180fc89a90164c5b4d994582b4e0d970db2e149671408

SHA512
3bca377dd901432dc4071265fb1b826c70fb2456e2308acb7969eeb3e20ec612eea6999d134f3482f42dc583a123173cc7c2e891e0bc0393ecaa77a0f53d4075

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G1.png

Filesize
831B

MD5
10bb024cc8baee259d1bba995e040531

SHA1
7001c8d826574c09e096bcdb79a8d4691dad19fb

SHA256
2bf33ec1aeb4de01ba88da1aef1b4a51316a96bd3e5d5898f7cd398d395db809

SHA512
a18cf1f239ed6e62dcaa0557491293a4af3dfd79720d2086bc7a2653a5373d2dc0aa1a78fda6fe1fae9f69b5e8e42406340ba7ce396466bd808eb5cadb2ea70d

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G2.png

Filesize
1KB

MD5
9c715be419d05c55aca11e4d6ed4dd5c

SHA1
a79e1969cb6414378f8c302d93716fa8ca396405

SHA256
4dd691444f94bd3eac902a9858ee69c771467dcae91eb139a4db6a488ea44bc6

SHA512
26b983ed5c3e7b539fafc9fe1406ce169b0223b15a779618928e865ce1fa6a31cfa33833738b58687d8d25fd73e0a0dcf16994331d9e8c33b152ca4c5758784a

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G3.png

Filesize
1KB

MD5
aaa3a5b32e9558b167ec31fff0281564

SHA1
cd0e48848fcc3398fc852b49aee1acf6cdd64a84

SHA256
e5c2efb06f93745802d07456b2653d3e6ba57097fd9c313401c56c85e3db038a

SHA512
13a2ed646133d3c8782b8ab46060c13d287291132f6847bac3d6c0c14f3f5c24feabfeeccfc088f2d524192984f967d6cedefca9e8a27c39722d6e22b7e1eac0

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G4.png

Filesize
940B

MD5
f681c89235ddcc6ca2083b12a2053b3d

SHA1
4f52c0b9bb6cdee3f1b6ec81018cdd84e5514234

SHA256
9bf4f2839f778afff1ca38b18ad086ebbe37a8b9a41b77cc2fecf9a4ecae9ce2

SHA512
7011c02209d659a3f9c1beedd70adaba445409fb5d57b9d6f0f60fab591d5875e1ea91c384527f61f06049c5b7d8387872eebeaa72931723ea2a154e3aa25d9e

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G5.png

Filesize
1010B

MD5
b8d7bbd7838bef3648f128dbdfc2afd7

SHA1
d3b7085a65d184bf39c2938962700581fe10bc8c

SHA256
b0a3ae6418cc5f327890366f23dc579358cc0582593f0ef651cbaae056d1ea0d

SHA512
1e1fd32f4e3a03b0f92a937736c0ba4f92e1da4ac4e70fc97c2e04f2971e04fd499d42ced1fec04b22d01fd9899257b0e6e895fbb5841e1c76614d0bcc21fdf1

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G6.png

Filesize
1KB

MD5
b192a82254ac62757679caf2690cd939

SHA1
bb4bf7b5a621561539530394359f639e7948bab7

SHA256
61bab5e0cd74396d67a04ff1993e298142bf5b864fa5505a2dac50185b0ae00c

SHA512
b32ac4cd308545eae38d9025d352963abc5e06ccd1c2fa0bc930f744301f10158459af02ca6a2d0c019d286ec1937e9febf4cd8477bff75ff5d873c96489f80a

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G7.png

Filesize
1007B

MD5
eff510d3ff99b14433b3019b599f5826

SHA1
d30522698096e0b9c58f6839a813a18b2abc99c1

SHA256
f107e8cb549092d7687430bbba043f166bd089c4c6f25e9fc25620b0018eb2b8

SHA512
bd2491a3eab4cb7e98aa1944bd3cfd87ad59b546511448526d0252f00a3122f258c6ac71a6130b3d21636f2c97107e29fbe25a84c10d9a6e746fb33cd44e2d6b

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G8.png

Filesize
1KB

MD5
9acb9b4ccf5cc2016b60224369248c38

SHA1
ab3354371e254517b1df467bbfcfc12cf373ba82

SHA256
b734bbc50dc8e09f870180ea3dff8a625f474fe93ef9e8273644e12814022f60

SHA512
3384dc5c6083bf4db8e7eb820c12a0a1dceb755c4653e9d304045d8ca84cfd6d89f7c9da8e4a61df89bd121cbc21bb00fd5f698f114d2f91b464937e6811ac0f

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_G9.png

Filesize
1KB

MD5
66a72191be58452cb2ff9dca2491e0e2

SHA1
a43e42540d533b1c2b33055ea138004fe67e3bfe

SHA256
e714eba21323ac219de9f853cbc712fdcc9d905f77a48f93bab3b0d74bac3b0a

SHA512
e9f05235bd8e3cb263959d266ac05b3bd9fe681ff5c4654f80ba7312dbd8cee06f0d150767911584282c7530c79f9102f85e880e4383456c14b76b775d1cedd7

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_Mute.png

Filesize
964B

MD5
6e7ddff9b94b66bd7d45ccc2a6a1f7ba

SHA1
a5eab6a225aeb9af72e93b83373649812786153a

SHA256
8836997adb53d46dc54f781a3ddfe8e7f4e79a06a2f72b509bd4506a68ea210e

SHA512
98042b0ffd13de286bcb8ea8a0fcbda85d663d4ac6d202890397ee4340f83fa1c5f616678c489dd77c350dffa20c0a399b647ac9fcd6ac5091a372a43521a700

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_Next.png

Filesize
1KB

MD5
41534d09b9cd773d3a3a2683566cc4bd

SHA1
9f8714e9804662e8edd9b8b5acd2d9a6f63b1ee8

SHA256
1a99577c0dd78f4319de6ef87e7ef1d371a0eabbb6b6391ccc9f46cf13927e52

SHA512
acded495f93d974c55c04b3d410e1770da55cefecbd38a710b695f883b57433609bd0059032b6811e1c5e0db7810e73b93677f4db01c2fe1f409e5d918228a9d

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_Play.png

Filesize
781B

MD5
1cc22fc2cfd318dfdd1f5146450982f1

SHA1
0570c95d6ed0fa60082231d8b38e260fe31bea9b

SHA256
9ce7a2ea38a174fda5921281af60eb85b0c14fa695e7fc8320e557b0b5914157

SHA512
fc64a8dae7d2f1d986c3ff888fb6cda82fc6f3da0935946ff1dc40cf236db55d918096a2fb70f0b91076296028495a447dd496838e65901d2b2c044c6ba93d33

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_Prev.png

Filesize
1KB

MD5
c9304e6c16391950e4f553b8b747ab64

SHA1
e3cc1382ed1a722def358de1fc3519ddd7c15cf3

SHA256
545499dde3b6b2af195d981ad2d932117ee8a19f690b7ce25185441234b1ac80

SHA512
49f2610bf996ae4a19c9f12585474046c4f948d0539e68aa450b9a605c0a820bb409350bf1ba23bb401a03d641ec04327d28286e8e127c3597cc54480b5beea3

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\INTL\Letter_Stop.png

Filesize
254B

MD5
5a1a03b2ea49751a995a725657d3d8bf

SHA1
1ff1f719350e8a86d186e8953833f0870cfa73bb

SHA256
1c5e3a754740c46e8198142ed2e90709902b86d369ac0a3b0f62e2dac31bb1f2

SHA512
8e2b546feb525ac9d87990224609c377ecddb05732b700c28bd005572f44db3a7a13e2c38fee01ae71c4929f63a553f8bbba5f2cb0aa33964bee6495583b100f

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\Svg\G910_JPN.svg

Filesize
320KB

MD5
8648de40c9a8f67947511ec6ba9a203e

SHA1
9746abf266bd8f0a3299a8e09a43c45dfcbca75c

SHA256
3ab850dfbfda63c2f4034800b1e0d8bc87faf2b9cff518dcdb52bca3f0c11531

SHA512
6e660ee100f764facadd9573697aebbccfca80faee31ada7399f310b9a259d191cc8c8c3b90ba835ece3e1e1b00f6e87d9de244601db6a8594ce288994328b60

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\UK\Letter_0x40.png

Filesize
700B

MD5
4142ced48b12cb38d135d126abd36af4

SHA1
6e69d2d5a8fc6c1c5b586bcc28120bd0912daafe

SHA256
e2a113ec4a413bf1b82e56a693c8255c8fe8a473f9ca962e54bbeda451db6056

SHA512
2f8c4a3e1b8e9323dc6c8388559b602534d1c03725700231837c1d1e806befbdcfb15e8bfed0a67a30e1b3e87a19e3a25f9641817ee3385d2a40b57d54fa0de2

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910\Images\UK\Letter_0x5f.png

Filesize
1023B

MD5
f8c1bb761e214d868505f3233374e0ac

SHA1
e05185e9c1bb07c3b074dd3f224846226a9a074d

SHA256
08bd54cc3036ce47364e12b779d54cd872f1ec279cefad7eaf95a69f7666f06c

SHA512
1e3734e96c461f458e58e369d24c932f133156fb9c8a9bac0835a46b8852d18064ffe0602c5fd9f114682b3be7c46d2ff74cd97261206e010bcb8e9e895e6980

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910v2\Images\Svg\G910v2_ITA.svg

Filesize
177KB

MD5
16b25baf2434891fe2bd1366ec55e938

SHA1
5b5deccf8051b069922a1c5445503ada08b93972

SHA256
f4537da826bd282077e8251c2561c46b435056821bfbb79525ae85a0175724d2

SHA512
a35deb8d18e9517057fc0cf5599e79dcb07a3746b573d9482ebb3afa76d0d163bd73059d6cf5e71b42fcaa07fdd53a99c43c6225938029712ee58c68c1d19c55

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\G910v2\Images\Svg\G910v2_KOR.svg

Filesize
198KB

MD5
8d86c1ac6a84d85993e7054f466c536b

SHA1
7f0942004a6ebb2856a3bf98e6d5878ea03bd9f8

SHA256
afa275a238e74c7a6bc49b4f83e385037e1887b1dde24eaf22ee671ed9423a96

SHA512
3b1db789b1a9ec7107941f4a1a77043fcecf08f5259e4348c227b00cb8d0df4d228098899a288645abcaed644a5b885b496cbe0fbc0274a7a1e883f158c8c20a

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\GenericDevice\Images\Svg\GenericKeyboard_KOR.svg

Filesize
198KB

MD5
07954d76407d4625508b6a7e23171a24

SHA1
576413e6aa298123952c8e6e6699036db28215f0

SHA256
d5e29c34901be2337bd46e1712998772fee31cc8f7e116eb69c67029c8016653

SHA512
a8d58086d9c041e8563561e8fe4d9515970a33084ca827cbe7c605ea8d2b99cf3b6d3bea14c1a660b237361e7c14cb52547442dfa19fa957ff07d1f7a8731f5a

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\Images\balloon_center_normal_expanded_gshift.png

Filesize
172B

MD5
92868e58346ef41b0714b775c91ba317

SHA1
a2fcb9660b699035c09eac04e7a40ff753ba674b

SHA256
32b42d3b95c797f6f90429211b44c38dc2e3769233627834652b008d2c853cc8

SHA512
439841e1179b633238d04d737613d994c8025174e46c3cd1bd71feab5372fc1fee1916f9424907b318557a6bf6fefce60fadaa6b4cff2ad69c6dc50b7d2fd313

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\Images\btn_disclosure_normal_closed.png

Filesize
594B

MD5
0b67b821401ddb064b33fc531ad0c8e2

SHA1
81eaaa3ab5704a8e6ce6adcc503bf294d243daa1

SHA256
62bfd7d44be8806dff7befd7b0d08e438c567d9062ce9219ca14e6fb6e22ec61

SHA512
53d81324247cd9f3c5eed84dccf748bd6da43f7a46015f7137babe2646101ae1881b89e2a1aad091811eea702f58af7353ccd74a07dbcab580004254ad65323c

Download Submit
C:\Program Files\Logitech Gaming Software\Resources\xC336\Images\Svg\xC336_CHT.svg

Filesize
266KB

MD5
6e74be899c584b1cedfde1c03e04261d

SHA1
e5bb46fccbfc85c188327ccc485e1d493394c806

SHA256
b03334a5851bf400d52af3c2d890b8aa7e163a3b3aa18067ae8c75dbc06a5d06

SHA512
ab3fd02f905a84e76a48f68230d125376e9034258cf921b2bd5706fbe35b29dc39d86fe304db388aaf0b8d0b9ff52c8d05fb85aa364ec2dbfd8367b669ab53c8

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\Arx Control\x64\LogitechGArxControl.dll

Filesize
1.5MB

MD5
98b1af3fc2f6e0643f535d35777a43dc

SHA1
17a37683d3ffe441547515daef5d22c96c64d019

SHA256
a87fb4467ca53c99ac25f0faa86b019974656a1707c301698dc90476a5f38ad4

SHA512
2c8bc6f0e228088a00d56978e85e226e202b4cd9f4943890c097f1fcf54e882e321a2201c92c8887c1dacb8dff14709d87693c6e4190ce5f83b4198feba0ad9e

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\Arx Control\x86\LogitechGArxControl.dll

Filesize
698KB

MD5
c2ccd60a9c8e2676899513527a49e1fd

SHA1
164e39c7f56e1cf4dc86ba3821714a4de634eb26

SHA256
6fbb465b06b11f99fdabbcde1ff04334f66dae9eeb784b5553eddee9cb92ab9b

SHA512
3b2ee11c89c1ea4da58a205cecb1fb1f49f99272d43827a171995cf4f5a7053fe9f5366ba10fa09b4cca8a8aef7e5f6696c9f88c22996f1e91e66732b4e35d0e

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\G-key\x64\LogitechGkey.dll

Filesize
120KB

MD5
c4529f3872918bfd724895d45104f4e1

SHA1
5a15a11587a47f1f80ad969709ba2a6d1238b463

SHA256
f5f214de9400da62a35ba8a0e706c10dd416cf93b9c524a6c2ed74f346e2ffa3

SHA512
d2ea98938560bf9cca94e691ac30bbfc6f29dc30dbfe8f0f03958db8d851232eca9ee1f3a7c3beff1d9965c7f5cce3b404c6f0ce7fd52a8d26a881abba63410a

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\G-key\x86\LogitechGkey.dll

Filesize
103KB

MD5
d53e41f3b04aa4a7b4c767c81b65a6a9

SHA1
c7ccfd39267a1b8408f5b3ea8f27db16fa60a8da

SHA256
f5c7ca17d3d9ab24d235ce28e9fded4db2b64534946d4c37af46b311fc9c8f5d

SHA512
618dd3fcc6e22cded31bb307019474d86762a787a72aab75f1df3e3e9f23c1abf40b89d119141e15be612f73568cf971e2ba4222deb9a2051cb9d644adff9aaf

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\LCD\x64\LgLcdApi.dll

Filesize
652KB

MD5
9aa9cf9b832d9beedacc5c99b6e7ee7a

SHA1
12ff8e1e98cee764fcb247f2f80f7c5b9667e0a9

SHA256
da9d496a2eab38038f2ce48665256c96fc99443f4eb70c5941723a2af446e624

SHA512
e8079bb642f6a4ee8e350ad60d61e5853b8ad55987e217e235a733b56b5a17a8831b8cb3fed5d91cc192d3d83f16032b1fc41fa1f05a2c31fb0633af07dd4ef6

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\LCD\x64\LogitechLcd.dll

Filesize
157KB

MD5
2f171dbdb111e5f1e2c2c2615e8edb38

SHA1
1b10c6a1b3c06b3c517b55a54859110a87fe03b2

SHA256
5c1980413e6b01683463c1db8f7b764d9ebf1f505756ab4ccf6de79d5c8cf240

SHA512
2d6778114040df926afd49e860c54bc09d3cb08a47d13873eb4dc6afe268fe9da1844a463626c86577df9519b0f535de4d3a44ec3c048646ba82c84e467e36fd

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\LCD\x86\LgLcdApi.dll

Filesize
511KB

MD5
89b203cd15a3f47aea36148eacdb4d80

SHA1
b40b58468bd01ba6fd34577256b71f14cce568d8

SHA256
f7a4bfcaf107740727a7a387ded69012e83b2477685498f841ffb66fb12c7866

SHA512
996075e5b400fa44009bf62d33d34488b0cdfe1d266e23d5df77650743a4e35ae3225ed8959c6007883cfbfb7eb56d560547b6548c6e9727c5e276b43bd445c1

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\LCD\x86\LogitechLcd.dll

Filesize
206KB

MD5
d4f71d124134bfd939da9efbd57fcfc9

SHA1
b366d5b7de7bbd42e37b042abfccf9d262ddf7ed

SHA256
0b9ceb666e99effe08b68710d7b6af35eaa6f3da390ad6ad9bd45a8317c4f7b1

SHA512
73209e5e8ac9e473bda3fa339b76538dd08db1dd76dd3efffccf2ea7ba17cead683c24aa7819eec4975628a02c2835a6c640cbd98381047c9c07481a1b712b2d

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\LED\x64\LogitechLed.dll

Filesize
160KB

MD5
a74360b505791b921be0cf83cad1fd7f

SHA1
ad530c6633efeeb572af93a20900ddca972226ee

SHA256
5078e82bb7120a065c7388265bc410aa193f994cd9a60eba7789584711b06e6e

SHA512
bdfb4b0896c910199e2552a1d26d65abdd76fe663d56c75c458647e779213286f06c49e0a74cede23214a8d611e6a807cccdd6b63246c058ebc978a3cb557ea4

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\LED\x86\LogitechLed.dll

Filesize
212KB

MD5
ac4d67c793d00cc618c182846f2d6f80

SHA1
00d0310d29e0a4c64ff3ea9fcc7e6d89dc1c3eae

SHA256
92d86e3bf045c0de01994a2bb7fba9fca007916f6f3e851683844a9440fdd486

SHA512
d7b0e241138efb527e84c1bd421c53f8238bbc7ea678d44eb44bd37df2312e3c38ed39bc6df1f3e41792f1643332c548644f313009ecfa0b88d46b7585fa75db

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\SteeringWheel\x64\LogitechSteeringWheel.dll

Filesize
198KB

MD5
4c7c9ceedf290a1e9256ce5755781d94

SHA1
43834372fa0af8fb563c95bc117929cd53d4981b

SHA256
fe42d2e95887ca0d8aa7130f3f8728c85e90f938681e379b82d5c77de97d4f56

SHA512
4f657e1062b35660c9b8586d08c217a393e28835e947dd9b03199c313e0b9ead8619612b5981636b3593094a1c22c6a38fc3133304730e8c6af772692fc92360

Download Submit
C:\Program Files\Logitech Gaming Software\SDK\Updates\SteeringWheel\x86\LogitechSteeringWheel.dll

Filesize
241KB

MD5
9d658a374a0d2f2f0a4a97ed57890dbe

SHA1
884cd0e37a714af6b359950eced83986c59c48a2

SHA256
1a4eb064f8d44380962abc3a0bbd1e7d3968e6541f81b9a1d8e4ec12cd4ea7d3

SHA512
74b98c433eac8c8ce646b01dc3972b7f19713ed70a2eb74f388ac17152ace835594cd1dd2ef205fa0423427c43a16ef863b9d592a5ce56250de70b84fccddf4a

Download Submit
C:\Program Files\Logitech Gaming Software\strings\enu\Strings.ini

Filesize
600B

MD5
174d0444c69d6117f342221a79e58c55

SHA1
54aa4232188c8bcf4d0ead1b97bf2424c4af6e02

SHA256
ef58c5698e8ba498bdfa4af746afc262164f28b14eb3a7447733aa624f06c2df

SHA512
e488ad0629dd3d27388a3697bea6745a916a5074669f1137d90d73c281becd831763a699734f31d4f46720dac34e4412cb24f35ea32f5722fb4b72f3bb899397

Download Submit
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm

Filesize
704B

MD5
4333c4bc5d8f60ae8b5d35a1f63d18c3

SHA1
7866b27eebc1f2484a1262363cd1266940d6a1bf

SHA256
a1020ce24b4bc9685da47230d49a36c818b03fb292cc403af9e63baa6f434826

SHA512
49242ff05752b1c740e72e9ea09dfe008b3cb3074d1cca14127e3f6163d60a74d0832907a627d4612ed38f4b7d9124a56976bf2ea47603c8922464eabb206a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\LGS-9.04.49.exe

Filesize
18.9MB

MD5
6946cb4a0a8f9b0230566f7ccb5036ab

SHA1
98df0344e9f8843388037947e166ca84179166fc

SHA256
0880e16009ec7920fb15d32f34ad2515434cead93affc259ed2981f664cc77fd

SHA512
68b1b48c1e2cb74d7ca7310ca5f529cd95805cf614015f5240cbde97711e884af38c911fddadcca5b0f42d6525fc503ac4d6752dda46682dfdba72142c3cdbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\LGS-9.04.49.exe

Filesize
17.2MB

MD5
e623daf3a27b1c05677063771ca9bce3

SHA1
e29d91fb5d2b8774f6ce0849799a1d50d32e318e

SHA256
c64be4efebe22642b4a09828e24292ceb799339cd526fb2149cd21539ab6c8a9

SHA512
bb5469f061038330f4a1ab1d44916ec6c80f216553002d5a96a30a9a0259af74198126355a3843bf7b4b843bb4f1fb538449c89f8c1e832debf93dfb3d0e1ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\LGSHlpr.dll

Filesize
221KB

MD5
4674fb08e0c776ca3c775f8d24241b01

SHA1
5228b5dad44ffb3d50def452092b6959ec07f27c

SHA256
f0dee887ab253039c7b946baf65823b479ba3896f684b5cdf60c8b8594d3c66e

SHA512
795e627e83f018d9922a9fbabf12fa882fabe13ed1e9a7adebf63666de0935ddaecd89711b43467bb6191f6ed26c176d9b5a834a13df992c316c22c811592fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist.exe

Filesize
6.9MB

MD5
96b61b8e069832e6b809f24ea74567ba

SHA1
8bf41ba9eef02d30635a10433817dbb6886da5a2

SHA256
e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8

SHA512
3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12

Download Submit
C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist.exe

Filesize
2.4MB

MD5
8438178b1b897541be18ed59a2222e14

SHA1
f9f1d5b5fee6dbdd7f85a9e91aa6de2bc998fb7e

SHA256
32211013d7c7e0762899be0fdd095abaa2a15cd0716fac0d6ba87bd1d70ba4f4

SHA512
2da901ed0c44ae7f7d4e300b40be1108647adcdd308318bd79e65a6e2e1df1d3d6e34f93df306a319794fc1e10975fb6e52a12f91a2de566c17d6711fe087e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\LGS-9.04.49\vcredist32.exe

Filesize
6.2MB

MD5
0fc525b6b7b96a87523daa7a0013c69d

SHA1
df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3

SHA256
a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048

SHA512
729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu43DC.tmp\System.dll

Filesize
11KB

MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1
10c51496d37cecd0e8a503a5a9bb2329d9b38116

SHA256
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

SHA512
cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu43DC.tmp\nsExec.dll

Filesize
6KB

MD5
01e76fe9d2033606a48d4816bd9c2d9d

SHA1
e46d8a9ed4d5da220c81baf5f1fdb94708e9aba2

SHA256
ee052fd5141bf769b841846170aabf0d7c2bb922c74c623c3f109344534f7a70

SHA512
62ef7095d1bf53354c20329c2ce8546c277aa0e791839c8a24108a01f9483a953979259e0ad04dbcab966444ee7cdd340f8c9557bc8f98e9400794f2751dc7e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe

Filesize
450KB

MD5
e16e6d68ce1949c9721656390f47ce07

SHA1
9009cca5dc05e22f4cf0d8529a473f19b363103b

SHA256
18e6d3d96fcd39ba069c0e6ebc108881ec5bb07e29a24b0177688ce391dac526

SHA512
63a179e4db0cb7954ddc9aee9e3c7aecae9e160154243b248b94647eb8defafb7041ee291f6f880dc3ca7f298dd548e4b3cf0b650e9a7e34f34d2d2f0dd36127

Download Submit
C:\Users\Admin\AppData\Local\Temp\{64260~1\LogiHeadsetRenderAPO.dll

Filesize
2.5MB

MD5
05eb84d3467c55a04dc61a53fb65b529

SHA1
22b5ba6c457e1890f6f1b84219ae4a682c3224d7

SHA256
b47008d1a7a1b03e8e0faf6664fcc39908c0d548be5060ccb9daa6b483fc3ef7

SHA512
05db5991c22ede4899982461a05976e2404fafc4278430b09f2f5c63588ed096441322d2992b150e5bd24eb5fec0870ea920ff2b72992244f094792a78e09598

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.be\vcredist_x86.exe

Filesize
450KB

MD5
2335ab0c0e19c0ef416d07df66fee649

SHA1
1e8794aff453f7647a6c149f3d38f7a3ff4ccd1b

SHA256
f0e46c0f9b2991fa6d187c6b2bed28139c67804cc58cc45c77f06a6f217cb21a

SHA512
518580d7a0d8f9610c8ec0204ae879a91a24325fb5e45348e6f0769aa25a69525992bc0f722df113993aa29a1a917de8fbecfb39d547d6f25354c3488bf06a62

Download Submit
C:\Users\Admin\AppData\Roaming\Logishrd\LGS8_setup\LGS8_setup.log

Filesize
2KB

MD5
88b9316a71e5b6828903900365a33b0a

SHA1
fc22fe31b5cbc26621315e2d04f1f27fc8b06f5e

SHA256
2f01c6f12d9a952f45c106300ff98a6a44ef80f8828b502ac3aaf6958c53ef91

SHA512
d57bfeee42e0693a1508ad5cf9a2fcbc33a338c63930dac9a577d27a4d5dbe9272b838bf1338dff33abfdba4f36611c5bfb3361f725e6ef92b388454839447d0

Download Submit
C:\Users\Admin\AppData\Roaming\Logishrd\LGS8_setup\LGS8_setup.log

Filesize
2KB

MD5
6a7f46d0158e0ea543cc5da027880a2a

SHA1
2d3f189772562a1628bb105ad1a8303f91b2956d

SHA256
fee517be83b0cc9710158071d6542da95972121f0999d2bfb701e396a4b32227

SHA512
df8b56bb23e4affa011296df8e5da41325037cdf6a2c8d96cccb372a768c050ed999bdb7b37bb71c27c5c048a22ac1c9e8b358454125f5f610a4daadf2c7cc1c

Download Submit
C:\Users\Admin\AppData\Roaming\Logishrd\LGS8_setup\LGS8_setup.log

Filesize
4KB

MD5
9fca28db0697b5e93f125f10abfe8a55

SHA1
99527df3bc32e299ff48d8ef157ada9f16fdccd6

SHA256
d661c8309fdcd6772fdd6482beb146b2e000baa320339f75512e6dc18231c517

SHA512
afc589286ae05f4e754600d2a4d77c2c51863be94014437d7b7fad8d7cc3af3e84285b9ae1187c5dbe1760be01828f01b24e0bdd0604070e25bdcc38a5c87708

Download Submit
C:\Users\Admin\AppData\Roaming\Logishrd\LGS8_setup\LGS8_setup.log

Filesize
239B

MD5
933cde9a9587efcef222a9a26b589504

SHA1
74b39007e4bdbffe305cac6ce5be95bbadcbcf8e

SHA256
5d0bdf67e4dc62c165a77c4db6f8ce2ce65702c351377769cb596114f1af4257

SHA512
4557ae7cff87889e5d03b30b0dfdc089451a7a251554b5ddf8df6c15420cc75b897e8fff1cce27a48a3b9f3b282b7b7d6d162dfd6272c5b79782669754c6c204

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
151KB

MD5
666cd03d1237e0e86427db1764aa17f9

SHA1
3406d039aa9e1b4ca2d4b5b9c7b71f0b5ba5c26c

SHA256
47195d1202f00c253ba8f047d5027d82c4eec4c5a478901f00387c4103e16059

SHA512
f7bd5efc186a2c915543e7dadedb56129d8bc06b90c9e4809acc4337b309142649ca39cd048864bf6cda0fcce52fcf0e14a6f605fe73f1f0ec33c83e36d349d0

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
151KB

MD5
c3f176b42fef53ade066c7844ac53626

SHA1
31944e25e245d473d6c7dbba00e4c6e51c80bf27

SHA256
2a972a3ade9c5fc2ebb6f42a2305adcf542c264bd6b78b768d04728f6f2210ce

SHA512
836946a427f84acaedb09e242873da930e2e9b9c7bbb0ac272b1ea810b702fd0f22ccbf71bc00bb287eb92661a8eaa57e1a81f422c84800d1eadb5b31e9dbfff

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
151KB

MD5
aa499be2903f64255c8daf5e73eb1fbb

SHA1
f99b11a5bce14f8d6cf7317cea6c25687bbff369

SHA256
abe5d933127900a814980fc6b1a56621cbfcc609ecf8abb6503c88b2ddabe166

SHA512
3ab366e9b3ded92242cac09339bf11cba49f64c29fa02e738a283a2a1dfc6cb707cd55c3618b0be2b1e8da9f8352d933cb03ad246d8e425e7403ac8e042da4b0

Download Submit
C:\Windows\System32\DriverStore\Temp\{5d5b200e-cd07-414d-aec0-583c22d79c6b}\SETA837.tmp

Filesize
320KB

MD5
fbd3ffa1fb5ca472c0dfb74d04fa0e9b

SHA1
eccf3f6440bf447ad5e42789fdeebb70851b2926

SHA256
6d37d425fc974054cde1f5e31b04184ee4b695e964977cc80aa560cbabd45256

SHA512
21a93d34e9e31a55f08300ba014b2c561d0ca251e25b043386508198209c4d31260a2fc7791970d726a715a7d010902eb93dc9d005eb18e10f4f523ffdbeede5

Download Submit
C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\SETBEC7.tmp

Filesize
74KB

MD5
2fa705e218a6a9e3e33d3eac1034966d

SHA1
0954d6409a2051446d160a4b1bfed7949288ba6e

SHA256
677fb2dbd66f7914ab89bba90c01cb0114e3939c37dffc3480a5081bfbb8eafb

SHA512
88233b3afa1be5a38d3622b87025ce2d1d3c2c23d89fb7ab415bea39646a73a7327e1cb67b481a4f752ff0f4aa654156c726ca549204f92599168555ad1e1391

Download Submit
C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\SETBEC8.tmp

Filesize
13KB

MD5
2fb04b09f4093ba3bf9c92be574229ef

SHA1
88ce7618e3c02ffc8375ee379afaa90310ca1ef9

SHA256
4440f04a8a6501748ff4aca127e4ba4d4d40b300c26c2f9932879ea8b5fb6b12

SHA512
14946376790fca120b22773f5458a64d266deb6b90aef71594b231d1be52a5084b20ab6c11dcaaad60e4604d8b17907b786aed09050a28c0bfc92eab3f5bd1b1

Download Submit
C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\SETBED8.tmp

Filesize
3KB

MD5
fd15ad3866362bafd8cfa03697f01924

SHA1
95cfea70d6f3c07a1cdc8e62845fb9d8a91b531a

SHA256
98416a68224d27bba133984a83267ebf4ca4bbc72c931199bd1b41d1230b5803

SHA512
561781865c09bf72ead08de298fdd2a0fd935f34c22872f46d9588756c67249280ebece27f34badc73bc88c144aa385c2933105f4988c2ed36639546a64c5fb1

Download Submit
C:\Windows\System32\DriverStore\Temp\{7811a7ba-04f3-9e44-88f2-fc9489e192a7}\SETBED9.tmp

Filesize
45KB

MD5
f7dff1a73786b865a4b05eb15f5a38c7

SHA1
730515dbb37b6e789128d940ac8b5fdd2cd7304d

SHA256
779281a8f6f97afdaab9cca5d673bffc56cd75460c46528c0e05ddef77c08803

SHA512
42663c516dc89ee584ac80cd74db29f39f0d0e311f71da92726bee3266abb12174b709eadc8c53d477eea128b236d2a78a0e89a4fa5fa3a5f5bfd963b1d482a1

Download Submit
C:\Windows\System32\DriverStore\Temp\{8b8e02af-3f3e-8644-9c9c-f37184898c2b}\SETCFAF.tmp

Filesize
10KB

MD5
13355156e5f18331fe8a21fa14f4340d

SHA1
7697bc2b8c4ea1978db928c39b6ce878d400dbb4

SHA256
0701b1c5647c6d2e47551b0cb8024262b5dec12f39801c395068b35e3618b953

SHA512
d38be3c416990bfc14667fd4a019b7ede8661cc9c8a84f672593fb5a9dcbff58c4b0a66be585a6137d2279e88103f023f7483dc9553689dc1e15db3f3dc9de39

Download Submit
C:\Windows\System32\DriverStore\Temp\{8b8e02af-3f3e-8644-9c9c-f37184898c2b}\SETCFC0.tmp

Filesize
4KB

MD5
54417d13e4c2aef4754bb7fb4d3c4a4d

SHA1
1f24bd6083b5838523089398788a045945c0baa6

SHA256
8bda4cfb82eadc2b83c9740d05b55111e066ab345b05b3fce1b646583cb700df

SHA512
04128f1acac1fe6c9e0618f666e9072f92f3ff71f0d8eba8a03767e1217b17d55800a66f20a72d48a9f8fdb748036a015d34be26f7976f6020145bdf624b3395

Download Submit
C:\Windows\System32\DriverStore\Temp\{8b8e02af-3f3e-8644-9c9c-f37184898c2b}\SETCFD0.tmp

Filesize
1.7MB

MD5
2499c0d5dfa91ffe8b0946692229ac5d

SHA1
a83845ccf067ea97adbf823a23aa9e2dd085a1b6

SHA256
57c004b91c2b65a4742b00ccad1e199afeef6aef55bc66a90f2acd6684393ed3

SHA512
a88e72a449e8299eb9272adf8682a6e9f26ea548d64c0e93559672a5bbb11591bc3c6cec6dcea499cf9ed77c9dd88ef4554d3d11f94bee71fcdc271f95401605

Download Submit
C:\Windows\System32\DriverStore\Temp\{8b8e02af-3f3e-8644-9c9c-f37184898c2b}\SETCFE1.tmp

Filesize
701KB

MD5
bee9e471cb954de11b0562c4d13f7d15

SHA1
9931d445a233ae5f4fef4d914d131b4f72553dd2

SHA256
37e05a2122fea35da22171f03bb94ffc13634fba4d21cdcd06b0f3f707b175f7

SHA512
4808a633a7636822e9701362bff2c2caf13f9bfb7dea9fdddaa6b74126edc2908511a99e8750df436e5b68fc20a555598275de30d1f23ffc233ae98d2114561f

Download Submit
C:\Windows\System32\DriverStore\Temp\{a603a368-2b82-c644-af0a-0f0eb17729df}\SETC4A3.tmp

Filesize
12KB

MD5
5c36741b3183ae8c0bf446d3f1763854

SHA1
014389618d20fe2e22cfcffefa4dc2ab3a1e0896

SHA256
bba1b49f865b22225173b7651497a2d149db67ca46bfb19d5dd19baef26552cf

SHA512
4da5df48e38856b2960a5e9821e99c8391f978ce6e05be9067c7e88f4b999c705731359557c04f3a4f6360b54dbf702e1185059b69219051b827d457e05fa17f

Download Submit
C:\Windows\System32\DriverStore\Temp\{a603a368-2b82-c644-af0a-0f0eb17729df}\SETC4B3.tmp

Filesize
3KB

MD5
3f5f3b2f35445ef7282a708aa13c9957

SHA1
1a4b7c6044f8f4647e6aa5f6364780d34c63790d

SHA256
2c854f5c48303fcf5ab4d1a699016b9791f23afc5c099c26b950f87c54fb9bf1

SHA512
fae97f972def38f5347ed33b82ed3b1c0e766c56ebb55d548dd323487e014ea1824329fc7cea4db86f32f5f43fe3a4ccec183db05a5a23a8e35a8f511c14d172

Download Submit
C:\Windows\System32\DriverStore\Temp\{a603a368-2b82-c644-af0a-0f0eb17729df}\SETC4B4.tmp

Filesize
33KB

MD5
e1ead7206ff4b3c9260db89e5a8c713a

SHA1
faa3a42b004fdb125e3de3f212c364fb22f841d2

SHA256
95643af92d343074d736b33a5846f2cdb7eebf2aeb5fa5bd664c51d072fc2249

SHA512
97019bbf5bf8473f741bf2d0665c03769833ceb31aa58e0f79ea0c267d0ad432cbb5a4b3f408c85186f4988e0f6547c9b6ebff0b232e7a7c7c965960635308d1

Download Submit
C:\Windows\System32\DriverStore\Temp\{f05faf93-943e-3249-b1a7-48ea5400f1ef}\SETB90B.tmp

Filesize
4KB

MD5
405fa1d86e52b52e8d5c1951e4763775

SHA1
b1640e5c3c7a0653554b85a062b4d6d7c08b9fbd

SHA256
a0e4c1038d4c02cc05fdb6276e6ab1283847fe85d121ab516ce9efc3db326dfa

SHA512
599503d1c2b3b41bd3590683613d4848e9983a5145f60f844ebdf651ac620e60ebc8fc30dd8fabf5f9db839c0fbf4f0a01507ab0cfc6bea771f786d817ff1af5

Download Submit
C:\Windows\System32\DriverStore\Temp\{f05faf93-943e-3249-b1a7-48ea5400f1ef}\SETB91C.tmp

Filesize
10KB

MD5
8e1d8b3e77a03f533ed0aef504034f14

SHA1
3674f07ba69d7556e1d7f363c7a58a97179fcbf3

SHA256
7d462d9d3a9d4596b90b4b6eeedbdc62f66eff536635f7cc9bff6a23ad3e11ca

SHA512
79bfdbfa4feb72045a538fdcae2699de0f4e188f9177bbd4eb5f05b15aa427c2e2c217aa8a060768e5ed2e15126777f19eb2f9e6fdc53ec18401d30909f58ace

Download Submit
C:\Windows\System32\DriverStore\Temp\{f05faf93-943e-3249-b1a7-48ea5400f1ef}\SETB93C.tmp

Filesize
40KB

MD5
8f4da100274cf85d94fba8ca76125255

SHA1
fbba54371989e051190b5664839a890ccf61eb56

SHA256
1ada7c36c915cb9bd41cf291f8e6990746a83f4d2abcc5caf765a3ce388be5e5

SHA512
1589dccf79299b8c385e67a158101a7a6654ecf9675c3afae5d18c2a6ff1b22ca7ed4aa11c3d0243f7c4dc66a9f680e2e96255662b51fc52aa509632e954ede9

Download Submit
C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETC9A4.tmp

Filesize
53KB

MD5
e4287d64d740a5e56bc91da07a63e4e6

SHA1
4db51c78a0619378bfb88caa9ab1176a744455ca

SHA256
f880606358af9aad28386f57fa5bac1a9f507d44de7374cb82fdc6906895b7e0

SHA512
f663bcc08a753d9506c1d71549762ddaa959c211146622bb70f3e1423e11885c065a89f7ea511bea2e1d065a4e317aa473b962af08440ff4dfc677ad6565350c

Download Submit
C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETC9C4.tmp

Filesize
14KB

MD5
84a489db42bdb9684292315abd42c399

SHA1
e862a8ac0ad3e3276e3c8ad203c76b7f452a9c84

SHA256
8d7302907620c74e9fb0e68e78aa05287ab48b85cb8131224a278f34ca8afd7b

SHA512
c669051bcec62e6033756fc262c4b92351143577d8fac3e0296267d2b8d963404f4c2b47de02e82128412cb1fa7bb8049b85f5f2f3bc4272861eb2c5cb2b2da7

Download Submit
C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA33.tmp

Filesize
18KB

MD5
3ec1f7676298a6f7837064cda151756b

SHA1
6f7e20a69e56b0257ba4564832b31121cf8aff70

SHA256
e1d9d3f6dec089d1962fa2f5fdef14385dc646cde34b897a3ac74c01f8cde32a

SHA512
78ff25c859ce62d101736e4a6b0ee64ded10c251b1d004fb770e83673a60d75c2e2791c206a8b501ebefb173481b7e10a1d00be91a26b86ef7d8f7b9ec77b530

Download Submit
C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA43.tmp

Filesize
31KB

MD5
2c9264fe81346b64e9b87faaf344af9d

SHA1
6e42ac9b453d7d512662307fe074b1e17adc3a0b

SHA256
b13b493c38b9e4190823873c2577dd71745ebf1ce3c3059006c6aaccf698a299

SHA512
767472a25977988277f7dc8a78c05be61b3bdca8be4a9ee5a9d66629f187fd2b743570c0605f2ecc194110ad870b125cd5a3a6c9ee522649ac81d01207cb5a43

Download Submit
C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA44.tmp

Filesize
34KB

MD5
74fa4a0530a5c91bfac068464d31c29b

SHA1
8c7f5b0864373c5d75ad62252b36c31de56ca0c2

SHA256
2cd53a2c277d58b117479bd0f725e6ddd523b64b13482c1d3bfdddc890837550

SHA512
a38eb616dd2b9b77a62a87706b1b34056a1ce846aca3b10be4f951f83f77e995bd0ef27fe04dfcf0a0f6884a1d3bcc17fd0965f7f4c96bf1a5b9a7a3efa43106

Download Submit
C:\Windows\System32\DriverStore\Temp\{fe18a52c-a1d7-9448-8cf7-c42bd9c2cd0e}\SETCA55.tmp

Filesize
66KB

MD5
5b4ec9f982dbd1b800111c725521fb9a

SHA1
8eedbf7151ba997d9cd607410cbea55421d1c5fb

SHA256
e9f63fe5a2b7841a7b42baa6ca683ec3becd9ed0393f51813803883edcb984c5

SHA512
a7ad77e1a536a18d27db6994251559cd6ed4556d11c7b4af756e88cd39b1343c7007ac9f22fa5bf485ef2a27aa83059db06f8c9e26757ef1d655d880a6b20d18

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
151KB

MD5
a97e23a08461baf401a76f00362060d4

SHA1
68abe90a61104732ab06ecef07ebe50b5491a0f8

SHA256
187f33236b3ce0e83d02630a7d38136c5a027d56d0793e38a2e827a60152fd17

SHA512
07b65ddea56367fbb5bee69b4292d45b7ed80c8e5ad0be1f123efc3a22be03b76a237fd715244f04c1da27c734be642ed49a492de2f501dd050c28c6b2091e39

Download Submit
memory/4112-112-0x0000000003320000-0x000000000335C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads