ad7a937b404fbe4869ee34aa8470c62641f3bf7d9de7f2548ffcc9ca1787f49a

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ltanalyzer_32r8.exe
Size 72.1MB
Sample261002-hl165stenh
SHA256 ad7a937b404fbe4869ee34aa8470c62641f3bf7d9de7f2548ffcc9ca1787f49a
MD5 31f6830fc97e48314f77dfb73a846255
SHA1 1e943a900703edbfd7f74c4fee51a29e43502a3d
SHA512 524eb8fa06dba3d9976ca95f6ba09f0104077c0240ba82f13ac27e88c0aaee10af46f9fad2ab27030bd93a8e811728aff18743e2d9d9a3e187190677558448dd
SSDEEP 1572864:PdidNhiQU79TnoaHpGJoFmllArKPGSByTTDatcQpttD7y0/TXXjM1s:PEDkQUJLokpyoFmDArupIKDe0/TXXR
TLSH
T17AF733233245C026C566A5F1992C8ADA563C7E210B7945CB73CC3D1E8B788C6963EF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	ltanalyzer_32r8.exe
File opened (read-only)	\??\K:	ltanalyzer_32r8.exe
File opened (read-only)	\??\M:	ltanalyzer_32r8.exe
File opened (read-only)	\??\P:	ltanalyzer_32r8.exe
File opened (read-only)	\??\S:	ltanalyzer_32r8.exe
File opened (read-only)	\??\Z:	ltanalyzer_32r8.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	ltanalyzer_32r8.exe
File opened (read-only)	\??\X:	ltanalyzer_32r8.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	ltanalyzer_32r8.exe
File opened (read-only)	\??\T:	ltanalyzer_32r8.exe
File opened (read-only)	\??\Q:	ltanalyzer_32r8.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
	\??\F:\	ltanalyzer_32r8.exe
File opened (read-only)	\??\A:	ltanalyzer_32r8.exe
File opened (read-only)	\??\T:	ltanalyzer_32r8.exe
File opened (read-only)	\??\U:	ltanalyzer_32r8.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	ltanalyzer_32r8.exe
File opened (read-only)	\??\L:	ltanalyzer_32r8.exe
File opened (read-only)	\??\I:	ltanalyzer_32r8.exe
File opened (read-only)	\??\O:	ltanalyzer_32r8.exe
File opened (read-only)	\??\G:	ltanalyzer_32r8.exe
File opened (read-only)	\??\Y:	ltanalyzer_32r8.exe
File opened (read-only)	\??\L:	ltanalyzer_32r8.exe
File opened (read-only)	\??\K:	ltanalyzer_32r8.exe
File opened (read-only)	\??\N:	ltanalyzer_32r8.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\H:	ltanalyzer_32r8.exe
File opened (read-only)	\??\R:	ltanalyzer_32r8.exe
File opened (read-only)	\??\V:	ltanalyzer_32r8.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	ltanalyzer_32r8.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	ltanalyzer_32r8.exe
File opened (read-only)	\??\B:	ltanalyzer_32r8.exe
File opened (read-only)	\??\J:	ltanalyzer_32r8.exe
File opened (read-only)	\??\H:	msiexec.exe
	\??\E:\	ltanalyzer_32r8.exe
File opened (read-only)	\??\S:	ltanalyzer_32r8.exe
File opened (read-only)	\??\X:	ltanalyzer_32r8.exe
File opened (read-only)	\??\B:	ltanalyzer_32r8.exe
File opened (read-only)	\??\P:	ltanalyzer_32r8.exe
File opened (read-only)	\??\R:	ltanalyzer_32r8.exe
File opened (read-only)	\??\N:	ltanalyzer_32r8.exe
File opened (read-only)	\??\M:	ltanalyzer_32r8.exe
File opened (read-only)	\??\V:	ltanalyzer_32r8.exe
File opened (read-only)	\??\W:	ltanalyzer_32r8.exe
File opened (read-only)	\??\Y:	ltanalyzer_32r8.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	ltanalyzer_32r8.exe
File opened (read-only)	\??\Z:	ltanalyzer_32r8.exe
File opened (read-only)	\??\W:	ltanalyzer_32r8.exe
File opened (read-only)	\??\A:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\Geo\Nation	ltanalyzer_32r8.exe

Drops file in System32 directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\ftdibus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\amd64\ftdibus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2\amd64\ftcserco.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2\ftdiport.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4AA5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\FTLang.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\SET4AA7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\ftdibus.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\ftdibus.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\SET4E8D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\SET4E7C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2\ftdiport.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4AA5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\SET4E7A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4A83.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\amd64\ftd2xx64.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\SET4E7B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\SET4E8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\SET4AA6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\amd64\ftbusui.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\i386\SET4AB7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\i386\ftd2xx.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\SET4E7B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2\amd64\ftserui2.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\ftd2xx64.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\SET4AA6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\ftbusui.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4A94.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\amd64\FTLang.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\ftcserco.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\ftdiport.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4A94.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\ftser2k.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\ftdiport.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4A93.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4A93.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\SET4AA7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\SET4E8E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2\amd64\ftser2k.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\i386\SET4AB7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64\SET4A83.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\SET4E7A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\ftserui2.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\SET4E8E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\i386\ftd2xx.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\ftdibus.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\i386	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2\ftdiport.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\ftdibus.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\ftdibus.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{454256f3-18dd-e342-9f58-cfcb56d412ea}\amd64	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8475811b-d176-5e46-ad90-189b8462f957}\amd64\SET4E7C.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Update_3pin.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Default\Stylesheets\Components\Images\highlight.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\Policies\Privacy_Policy.html	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Data\Language.js	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Menu_File.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Mouse_Pointer_VerticalResize.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\CPara_Advanced_Alert_Settings.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Dual_channel_file_generation.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Report_MultiChart.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter3-Customising_the_software\Display.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter3-Customising_the_software\File_Name.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Downloading file Mozilla.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Options_FileFolder.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Default\Stylesheets\Images\close.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Pre-start_data_collection.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter3-Customising_the_software\Logging.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter3-Customising_the_software\Time_Zones.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\InstallProfile.profile	MsiExec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\FTD2XX_NET.dll	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Options_Automation_SMTP_error.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Snippets\MiniToc topics only snippet.flsnp	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Default\Stylesheets\Images\printer.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Manual_Scaling.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Saving_LogTag_Data_files.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter3-Customising_the_software\SFTP_settings.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\E-End_Matter\Damaged_calibration.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Calibration_downloading.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Dew_Point_Context.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Import - Success.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter1-Introduction\Installing_the_software.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Calling_up_previous_results.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Integrating_with_LTO.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Data\SearchPhrase_Chunk12.js	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Alarm_bands_USRIC.svg	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Annotation_Arrow.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Anti_Aliasing_On.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Menu_Icon_PageSetup.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Multi-Probe-Certificate_CH2.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Recovery_discovery_334x302.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\tipicon.svg	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Chart_Right-Click_Menu_gradient.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Printing the Results 001.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Theme_Black.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Unsupported_logger.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Favicons\browserconfig.xml	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Fluid\Stylesheets\foundation.6.2.3.css	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter1-Introduction\dotNET_framework.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Combining_charts_onto_a_single_chart.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\AnalyzerDesktop.exe.config	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\ja-JP\LTExportData.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Configuration_USB_Erasing.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Select_start_method.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Default\Stylesheets\Components\Images\login.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Downloading.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\User_interface.htm	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\pt\AnalyzerDesktop.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\GeneratedImages\Equations\Equation5.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Diagnostics_Collection.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Mark-Download.svg	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\Run_LTA_as_Administrator.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\TableStyles\LogTag Lights.css	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Default\Stylesheets\Images\star-full.png	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Default\Stylesheets\TextEffects.micro-content.css	msiexec.exe
File created	C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\System.Net.Http.Formatting.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF1B07B29505233E9F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC932.tmp	msiexec.exe
File created	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\AnalyzerDesktop_2.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIC6DE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20B.tmp	msiexec.exe
File created	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\AnalyzerDesktop_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC536.tmp	msiexec.exe
File created	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\WifiWizard_1.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{84EBD7B9-9573-4C33-9452-B6F028D31A50}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_4.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2833.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2872.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D57.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC680.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A48.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDAB1E1EABEF0273B.TMP	msiexec.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4DC6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB8345F82E2364114.TMP	msiexec.exe
File created	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC6D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5abfb7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5abfbb.msi	msiexec.exe
File created	C:\Windows\Installer\e5abfbf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\AnalyzerDesktop_2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4299.tmp	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC7BA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{469D85DE-4556-406C-AFF0-443D19BD8718}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI316.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_3.exe	msiexec.exe
File created	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_5.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI498F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3955C38C99C23705.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4007.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5171.tmp	msiexec.exe
File created	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_4.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB651ACCF5BF2D475.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC2D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF04CFA762E8985251.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_5.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\WifiWizard_1.exe	msiexec.exe
File created	C:\Windows\Installer\e5abfb9.msi	msiexec.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC5B4.tmp	msiexec.exe
File created	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_3.exe	msiexec.exe
File created	C:\Windows\Installer\e5abfbb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D27.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\AnalyzerDesktop_1.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e5abfb7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DB.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2240	MSIEC6D.tmp

Loads dropped DLL 32 IoCs

pid	Process
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
4588	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
1352	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
2968	MsiExec.exe
4192	MsiExec.exe
4192	MsiExec.exe
2968	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ltanalyzer_32r8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ltanalyzer_32r8.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ltanalyzer_32r8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEC6D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ltanalyzer_32r8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 53 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e3f46304-0000-0000-0000-d08302000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multi\DefaultIcon\ = "C:\\Windows\\Installer\\{469D85DE-4556-406C-AFF0-443D19BD8718}\\ext_1.exe,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltdx\shell\open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multi\shell\open	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multix\shell\open\command\command = 71003d002e0064003d00710073007a00640038004a006d006d006300370049006c002e0074002a006d0075006c007400690078003e0072004c003200780078002e00590027004c0040004f007d0029005a006200470078004b007e004b002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.sltd	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.sltd\shell\open\ = "&Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED58D9646554C604FA0F44D391DB7881\multi = "FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9B7DBE48375933C449256B0F823DA105\ftdibus_1 = "ftdibus"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9B7DBE48375933C449256B0F823DA105\ftdibus = "MainFeature"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multi	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multix\shell\open\command\ = "\"C:\\Program Files (x86)\\LogTag Recorders\\LogTag Analyzer3\\AnalyzerDesktop.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.multix	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltdx\DefaultIcon	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED58D9646554C604FA0F44D391DB7881\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltd\shell\ = "open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ltdx\ = "LogTag.LogTag Analyzer.ltdx"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multix\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sltd	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multix\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED58D9646554C604FA0F44D391DB7881\FileTypeAssociations = "Feature"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltd\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.asxml\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltdx\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.sltd\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ltd\LogTag.LogTag Analyzer.ltd\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ltd\LogTag.LogTag Analyzer.ltd	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multix	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.sltd\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED58D9646554C604FA0F44D391DB7881\USBInterfaceCradle_1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\PackageCode = "CE8478A62800F5543AFDFF215A5A9637"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltdx\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ltdx	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.sltd\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED58D9646554C604FA0F44D391DB7881\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9B7DBE48375933C449256B0F823DA105\ftdiport_1 = "ftdiport"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltdx\shell\open\command\ = "\"C:\\Program Files (x86)\\LogTag Recorders\\LogTag Analyzer3\\AnalyzerDesktop.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multix\ = "Analyzer Enhanced Multi Chart"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED58D9646554C604FA0F44D391DB7881\PackageCode = "4E90B738A3A55BD4182297170B9377BD"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED58D9646554C604FA0F44D391DB7881\Version = "50462728"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\400DDB23D9800364093C6667DCE81641	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multi\shell\open\command\ = "\"C:\\Program Files (x86)\\LogTag Recorders\\LogTag Analyzer3\\AnalyzerDesktop.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sltd\LogTag.LogTag Analyzer.sltd	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED58D9646554C604FA0F44D391DB7881\Feature_1 = "MainFeature"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED58D9646554C604FA0F44D391DB7881\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9B7DBE48375933C449256B0F823DA105\FTDIBus64bit = "ftdibus_1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B7DBE48375933C449256B0F823DA105\SourceList\PackageName = "USB64_2.12.24.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multi\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.multix\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.ltd\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LogTag.LogTag Analyzer.asxml\DefaultIcon\ = "C:\\Windows\\Installer\\{469D85DE-4556-406C-AFF0-443D19BD8718}\\ext_3.exe,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED58D9646554C604FA0F44D391DB7881\ltd = "FileTypeAssociations"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1774640E3F5657F48ACDEFAE3DA2E9C8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ltd\ = "LogTag.LogTag Analyzer.ltd"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sltd\ = "LogTag.LogTag Analyzer.sltd"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3324	MsiExec.exe
3324	MsiExec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe
2556	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2556	msiexec.exe
Token: SeCreateTokenPrivilege	5884	ltanalyzer_32r8.exe
Token: SeAssignPrimaryTokenPrivilege	5884	ltanalyzer_32r8.exe
Token: SeLockMemoryPrivilege	5884	ltanalyzer_32r8.exe
Token: SeIncreaseQuotaPrivilege	5884	ltanalyzer_32r8.exe
Token: SeMachineAccountPrivilege	5884	ltanalyzer_32r8.exe
Token: SeTcbPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSecurityPrivilege	5884	ltanalyzer_32r8.exe
Token: SeTakeOwnershipPrivilege	5884	ltanalyzer_32r8.exe
Token: SeLoadDriverPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSystemProfilePrivilege	5884	ltanalyzer_32r8.exe
Token: SeSystemtimePrivilege	5884	ltanalyzer_32r8.exe
Token: SeProfSingleProcessPrivilege	5884	ltanalyzer_32r8.exe
Token: SeIncBasePriorityPrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreatePagefilePrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreatePermanentPrivilege	5884	ltanalyzer_32r8.exe
Token: SeBackupPrivilege	5884	ltanalyzer_32r8.exe
Token: SeRestorePrivilege	5884	ltanalyzer_32r8.exe
Token: SeShutdownPrivilege	5884	ltanalyzer_32r8.exe
Token: SeDebugPrivilege	5884	ltanalyzer_32r8.exe
Token: SeAuditPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSystemEnvironmentPrivilege	5884	ltanalyzer_32r8.exe
Token: SeChangeNotifyPrivilege	5884	ltanalyzer_32r8.exe
Token: SeRemoteShutdownPrivilege	5884	ltanalyzer_32r8.exe
Token: SeUndockPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSyncAgentPrivilege	5884	ltanalyzer_32r8.exe
Token: SeEnableDelegationPrivilege	5884	ltanalyzer_32r8.exe
Token: SeManageVolumePrivilege	5884	ltanalyzer_32r8.exe
Token: SeImpersonatePrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreateGlobalPrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreateTokenPrivilege	5884	ltanalyzer_32r8.exe
Token: SeAssignPrimaryTokenPrivilege	5884	ltanalyzer_32r8.exe
Token: SeLockMemoryPrivilege	5884	ltanalyzer_32r8.exe
Token: SeIncreaseQuotaPrivilege	5884	ltanalyzer_32r8.exe
Token: SeMachineAccountPrivilege	5884	ltanalyzer_32r8.exe
Token: SeTcbPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSecurityPrivilege	5884	ltanalyzer_32r8.exe
Token: SeTakeOwnershipPrivilege	5884	ltanalyzer_32r8.exe
Token: SeLoadDriverPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSystemProfilePrivilege	5884	ltanalyzer_32r8.exe
Token: SeSystemtimePrivilege	5884	ltanalyzer_32r8.exe
Token: SeProfSingleProcessPrivilege	5884	ltanalyzer_32r8.exe
Token: SeIncBasePriorityPrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreatePagefilePrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreatePermanentPrivilege	5884	ltanalyzer_32r8.exe
Token: SeBackupPrivilege	5884	ltanalyzer_32r8.exe
Token: SeRestorePrivilege	5884	ltanalyzer_32r8.exe
Token: SeShutdownPrivilege	5884	ltanalyzer_32r8.exe
Token: SeDebugPrivilege	5884	ltanalyzer_32r8.exe
Token: SeAuditPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSystemEnvironmentPrivilege	5884	ltanalyzer_32r8.exe
Token: SeChangeNotifyPrivilege	5884	ltanalyzer_32r8.exe
Token: SeRemoteShutdownPrivilege	5884	ltanalyzer_32r8.exe
Token: SeUndockPrivilege	5884	ltanalyzer_32r8.exe
Token: SeSyncAgentPrivilege	5884	ltanalyzer_32r8.exe
Token: SeEnableDelegationPrivilege	5884	ltanalyzer_32r8.exe
Token: SeManageVolumePrivilege	5884	ltanalyzer_32r8.exe
Token: SeImpersonatePrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreateGlobalPrivilege	5884	ltanalyzer_32r8.exe
Token: SeCreateTokenPrivilege	5884	ltanalyzer_32r8.exe
Token: SeAssignPrimaryTokenPrivilege	5884	ltanalyzer_32r8.exe
Token: SeLockMemoryPrivilege	5884	ltanalyzer_32r8.exe
Token: SeIncreaseQuotaPrivilege	5884	ltanalyzer_32r8.exe
Token: SeMachineAccountPrivilege	5884	ltanalyzer_32r8.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5884	ltanalyzer_32r8.exe
5884	ltanalyzer_32r8.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	msiexec.exe
4588	MsiExec.exe
3324	MsiExec.exe
1352	MsiExec.exe
2968	MsiExec.exe
4192	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 4588	2556	msiexec.exe	89
PID 5884 wrote to memory of 5796	5884	ltanalyzer_32r8.exe	91
PID 2556 wrote to memory of 2452	2556	msiexec.exe	96
PID 2556 wrote to memory of 3324	2556	msiexec.exe	98
PID 2556 wrote to memory of 1352	2556	msiexec.exe	99
PID 2556 wrote to memory of 2240	2556	msiexec.exe	101
PID 2556 wrote to memory of 2968	2556	msiexec.exe	102
PID 2556 wrote to memory of 4192	2556	msiexec.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ltanalyzer_32r8.exe
"C:\Users\Admin\AppData\Local\Temp\ltanalyzer_32r8.exe"
1⤵
- Enumerates connected drives
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Users\Admin\AppData\Local\Temp\ltanalyzer_32r8.exe
  "C:\Users\Admin\AppData\Local\Temp\ltanalyzer_32r8.exe" /i "C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\ltanalyzer_3.2.8.68.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3" SECONDSEQUENCE="1" CLIENTPROCESSID="5884" AI_MORE_CMD_LINE=1
  2⤵
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9E0C7E71AEB8E465CA39A951BB24F163 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4588
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A054CC70689AA1AB6CB54B2E2DADA35F
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2DBA3E0D046ACA72410FE81F65EDB43A E Global\MSI0000
  2⤵
  - Drops desktop.ini file(s)
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1352
- C:\Windows\Installer\MSIEC6D.tmp
  "C:\Windows\Installer\MSIEC6D.tmp" 327 {469D85DE-4556-406C-AFF0-443D19BD8718}5IC:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\USB64_2.12.24.msiC:\Users\Admin\AppData\Local\Temp\CHAINERS_LOG\USB64_2.12.24.logNO5884Chainer
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2240
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EA39A703D0E1ADCB9500842EF6485104
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2968
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0EA06DF43778F00B3A36C910C74D8F32 E Global\MSI0000
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2332

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Users\Admin\AppData\Roaming\LogTag Recorders\USB Interface Cradle Drivers 64-bit\ftdibus\ftdibus.inf" "9" "40e1bf323" "0000000000000174" "WinSta0\Default" "000000000000017C" "208" "C:\Users\Admin\AppData\Roaming\LogTag Recorders\USB Interface Cradle Drivers 64-bit\ftdibus"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2620

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Users\Admin\AppData\Roaming\LogTag Recorders\USB Interface Cradle Drivers 64-bit\ftdiport\ftdiport.inf" "9" "4c3a1eeb7" "0000000000000174" "WinSta0\Default" "0000000000000190" "208" "C:\Users\Admin\AppData\Roaming\LogTag Recorders\USB Interface Cradle Drivers 64-bit\ftdiport"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5abfb8.rbs

Path C:\Config.Msi\e5abfb8.rbs
Size 2.0MB
SHA256 82efcbe574a2f717ddbea8c5f9f8ea1c955346c97cd42252271791b47f4d1181
MD5 3cdaa3f89ef87fbb2f8beee13bb99a51
SHA1 c9265079fd59ace59a616e260573843b9e593957
SHA512 cb744c2a6e3df7ca3ce02041af4224de966c4cc3bff3bc17d8d02c1a043d8e8dc136dc163cd3f6fd8cfbebe7e3360ec59f240e9e6b364bf46e85410eb5d5483d
SSDEEP 49152:8IlyX9JdaCHqq5Ap/ddj7hGhvzwGIlyX9JdaCHqq5Ap/ddj7hGBk36k:7CaSqcbiCaSq4kn
TLSH
T1E6A57C213506C036E96E4570263CDFBF217DBA711BB144CB97D89EBE49746C28339A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5abfba.rbs

Path C:\Config.Msi\e5abfba.rbs
Size 550B
SHA256 bee724ab06a6f75d64b4a67c825cb07f341aad96a024252addc471dee7f87bcd
MD5 8cb3d84afb2d7b295f2bb22efef4d153
SHA1 9210c46a9c9dfff3b22b215b3ad29ddb9c663a4d
SHA512 f508c6f2450ff93a304f33c7576e9d9e4efe64ce2764e1124ab32e584ac747b12cbabda7198bf039c9b389fd22b372d8c6ef7c3038cdeb5336a100206cbaca2d
TLSH
T140F059C7D34146E9DA0FC676AAA243C01A175070C3108A42ED0C203D7C902DD9FBE1C4
MD5 SHA1 SHA512 TLSH

Submit Download

e5abfbe.rbs

Path C:\Config.Msi\e5abfbe.rbs
Size 1.3MB
SHA256 2f0eb30c9e90a8bab2767ae4d9e396cbfc7c70da5540d478255bc615858f8380
MD5 96ccf85a7ef3b2e8fe4a325a554922ff
SHA1 1a6b3424849c84199e9404293955cfa72f43753d
SHA512 1e53ce63b9890260ba7599656b36334845631f055d6133e2b7aca64e4c2c017590ec5e0729c6b7f3bb131c4fe00d030a3f96382e95d4c9001689c0e064915196
SSDEEP 12288:V5cceNKt7zRy/zCyas8ROUOVJ5cceNKt7zRy/zCyas8ROUOVn:vxeNKtAzCw8ROjVTxeNKtAzCw8ROjVn
TLSH
T123556614F9B80525E163997FA2A29E5DD17239861731CACF0302DBF61D3B5DA8632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicroContentScopes.js

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Data\MicroContentScopes.js
Size 11B
SHA256 0089aa050b89192e6bb4f33c9ca831d4215f30a24cff294ed17a1a187131e267
MD5 9b623b63a22644fd1a4bf2b3af3481d3
SHA1 4225b4af3114cdd6294dbd908c07fb09cfa5d3a7
SHA512 6d78f20056ae40c637238da48482c4669c3942ccda1af8cb989be6f84830188fa04bec9925d6392ac50984adae583b0ef026cbe60443959f7df614a81d278c60
MD5 SHA1 SHA512

Submit Download

Default.mcwebhelp

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Default.mcwebhelp
Size 1KB
SHA256 801e283334623cd2a64978fbc90ae3f52d1e4fb82a57580d2d5fbeaac5c86397
MD5 86b5fc58eae0c8e6c0100a7d89d9accb
SHA1 6d78c8cc37868836fd484e66533663ed2a2cf7ef
SHA512 b4dd9190e6daece1332c91b9c4ad7d04c8218f54a91d469d631b8b5f7009ef7e70d3fd2d1677f3e41bf423e080a5083cc6bbe985204c56954b1b9ce3b824d9dd
TLSH
T11E417410C0242A0B473B4274ABF4D5EE25F82A9353841624F91ED418FFEEE1D296B79A
MD5 SHA1 SHA512 TLSH

Submit Download

favicon.ico

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Resources\Images\favicon.ico
Size 9KB
SHA256 4e742d143575c7905c8b57982166d3bf730cab4218220f5e75405c3154998c95
MD5 b03ca191a8733e9db04057d67e78b74e
SHA1 3d7e99086c0fc6a1ebad26174597019837c94b96
SHA512 70ae946ca66cc6658d4fee0f3697b3ad31aa35ef04fd670323088ba16f820dee5660e63de0caa8dbcf2373ecdd5012b67c0a1b57011d9359256ef8a13894f729
SSDEEP 96:vs15mUhsQQNNNNNN8EgPsLqm6ReISbFFhMkPUYqm6ReIuZqm6ReIGhFyeGSKug1c:vs6cS0ivhtPUQ0ex0G4VSKugtNfpU
TLSH
T1AD22758930DBA88ADD1C4532CDB2D1F12D786D9D1C918676E2F06E3F68FC1A36E57098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filter.png

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Fluid\Stylesheets\Images\Filter.png
Size 313B
SHA256 af1b4bc383f4ca155aae731b0e2e51241ed6b1ede2405a590d94bd632ce0fb65
MD5 b9b5c7e33a20d7938673a12898164901
SHA1 72b8e2bf017d4193f9ad99f2602fecd718160606
SHA512 40eaad991f8d3d0c6997672d3efe6a74130f93c976e3e05d0834a125e241df6ce25f0bbc8c5ae83996ea3a504accbfe12d8c0a223ce103ee003e73b6e94b52e7
TLSH
T1A4E0EBDB3300EFB9F40F0472120204466C1B281B07914800F0DA9C0DA80A086F880140
MD5 SHA1 SHA512 TLSH

Submit Download

FilterOutline.png

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Skins\Fluid\Stylesheets\Images\FilterOutline.png
Size 301B
SHA256 d4284ad8a43ef43e47678ec5da72d32f073079f62015cc8bdf6b9126eeae79b1
MD5 b8ad5a0b50040722023ed7a59696a536
SHA1 38108b1da5fd78cec9ddffcdc34dac94e18367b0
SHA512 fafc112d596d2c452c8d68c973979ae19265aa537a5662700cda2bb5e7b5aa3739401fa6a832baa242865e339e2be32034c25c7dcd4fa838e35eb1c3a1a44f31
TLSH
T1A5E0E7E03011634DC35A093D01725948FD7B5C710E116C4DB41CE87BB2112C84161723
MD5 SHA1 SHA512 TLSH

Submit Download

LogTag_Online_Menu.htm

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter1-Introduction\LogTag_Online_Menu.htm
Size 32KB
SHA256 1e68478203e924835a3d00076337edce4f4268d6b3b4f3c8fb659c21115e903f
MD5 b2a3a99a381bdeb40e4a75a0dc4773d4
SHA1 a508758b87ce6d144a34e2ec5ca08654059ac687
SHA512 f112c1f219bbf9cfa5dc8968ad95b7e76100346dd441ae8f670f47e1c9015925bfa9c05d7497aa20ee49b2c40b5967b2a2c79358386c82cf8f40c85db1e95f1c
SSDEEP 192:EhPjtv3JfDj56lGV9xIUguiV+TKFRltvsUq4HgslCC3Tgq+j1AZ:Ehhv3JfRkClt3wfdsU3vRfu1a
TLSH
T144E2816164D0352312B382C682969F59FED09197DB44AC8071AD13FF9FF6C50B6AF8E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Saving_a_file_for_use_in_spreadsheets.htm

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter2-Using_Analyzer\Saving_a_file_for_use_in_spreadsheets.htm
Size 24KB
SHA256 77035650590bdf700688ea59ba4d8dd7f0c3ae341a5c815912f40b20effe6d41
MD5 d17d738bd336166fe0ee73fd32f9db0a
SHA1 7c5ac5b548986a28004b826b2511ad3b3d31879f
SHA512 046c4356a12c4c9e220b64fe05ce5194f9eed7e112c77fe2da104b2c70ac6a153449fba0580ed2f383c26771b3ab9de34bd5d97aa883df02835e458ec280929f
SSDEEP 192:E+MjFv3Jf1j56lGV9xIUguiV+TRQcbZwjUPYhcdhAZ:Epv3JfPkClt3WcKi7Pa
TLSH
T1DBB2732168D0223302B382C69395AB58FED0D557CB05BD8471EC17FBAFF6C50B99B991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Only_show_the_latest_set_of_readings_after_download.htm

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\Help5\Topics\UserGuide\Chapter3-Customising_the_software\Only_show_the_latest_set_of_readings_after_download.htm
Size 20KB
SHA256 61a8ad333f5dc15d51d30237c8b74849e04022de80c00cd596e97c4be4c2cb66
MD5 36ac853069a8c75f661ff73bba6b9204
SHA1 6409ad0cc5efbda1397243a631488b44bd2307bd
SHA512 64edbf0cdc41e09080de501b2a5bc3b0f7a11f06503ff0c9ec62c565b7c15ac59ce054f2476e6b27c7509483e4232d6a7849cbac7dbb4423859af54d155c470f
SSDEEP 96:EO6YcSfv3Jfffe2cS56lGVq+P6JSiLrSuGp4tQe43KzuiVqyKOIQMXOLWuSupCza:Eyjfv3Jf1j56lGV9xIUguiV+TnAZ
TLSH
T1E0924E2168D02133427382C5A652AB5CFED0D697CB05BD8471EC17FBAFF7C90A94B981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USB Interface Cradle Driver Installation 1.14.exe

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\USB Interface Cradle Driver Installation 1.14.exe
Size 3.8MB
SHA256 718837fb92a581a61d262690c03a5b698e09561fc8c1eb677532987465f1a615
MD5 ae251786a50607f7728d98fcbf773d5d
SHA1 b0ef36b93b83e75c6b10f50bd485eb33e9ef5f25
SHA512 daebc7ffcda1c033f5e8568da016e890d4261d689eaaebf78db7f786903a7fc22b5700233b4de52284aa146a73889fa0713f47030b513dd293831326680ece3a
SSDEEP 98304:5THc9lZbc1zQmdAoJp0vN8p0fFgt6G+eXAE1ajmn9qTHc9le0y:5kZYdn0ip0fyt6G+4rIjLke9
TLSH
T1B706E001F7E7505EFABF4A38983B27B05ABAFE516E3881AB3784759D1C30E909530716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WifiWizard.exe

Path C:\Program Files (x86)\LogTag Recorders\LogTag Analyzer3\WifiWizard.exe
Size 6.8MB
SHA256 4aec36293919ea43980562a528a4307082570cb53e24fb01ea6eeee47dfeca20
MD5 0e068cfdf330b0083a198472880dfe25
SHA1 724f1c92f8014e3237a70a3c8794c8a0649496ec
SHA512 84319fe8fd92c00e87af1af01f88b45ff637f1cdcdc6e356d7255400c7ff0b094858bcd26afdf5b23f7ce82493f22d0eaaad15671ed345264a058023dc474532
SSDEEP 98304:XHRSAc6IFZO0+40dq4MyVTYCSYSCbmTcgtb0wlswAbcvhULWpkmYfjnW3VL+Cquy:3RjIv+m4MyVTpJ5mcwHls5b0hUsavCqv
TLSH
T1BE76124173E98E2AD1AEB774A0604A6413F1F947F6AAD7CF4A44F8EE0CD2B419D01763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 d475a1b94d137b1e5251dd180cea4a11cc05ab5689b62357ea3905f19609212b
MD5 68d3192d849e174107dd7b52c5b38140
SHA1 3d048c2486fb05d808b0584946f7e4964063c523
SHA512 42c15178a1b92bffc9c95477db87fb127fb29372cb656814cd3d46e5f2c09ad61fa6f76efb37d9cb3e41331c1a26d07964ca6ec81c66622cbb84082b38a41194
TLSH
T1C8F0D4B695F931B3685784BC0FD91C432155A99E0288D03320F80DC647E256F561E219
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_E38E081F0870852670C4F0E8233F2647

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_E38E081F0870852670C4F0E8233F2647
Size 727B
SHA256 507d34637d846dc2448cc324be22249324c95ff8745f570f4dc7811b49e69062
MD5 86a0cbf1327b13d281c63d274879718b
SHA1 941428a4a213e6b6d8c01af452aac6548081969e
SHA512 b0b29bdb8c37abd5277a81db58b9e750c54420c8d96449691061fcc2444003376ae8f7a6b4b03adb4f707cfedb6ed64d5d1d84a401d070494d34a8d7a00c6a90
TLSH
T1000120826D9994162E059E78B78102DE7210B03B5DCD21FFFEB92019D481B571D0C400
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 307db0fb56225eedd300dafb363d7b91db4e02c6c5d308c0b36c7bcb06d67d90
MD5 a945b09f6acdc44d1ea34f30071119d7
SHA1 32b494f5767b7a00ae716f5b62889f8fcd05e4da
SHA512 bb37807220b24bdd5200664b69c4f9bd808e9879d3dd65e309c43dd9ba3856d0a315088e56c8179d069f14008abf6148ce10ad24ed25fa57ce148d59135d2f22
TLSH
T1FE0115430962BF007D514C46B7ADD9F472B1018E10C007B3B679104656DA2F6A6404B9
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 144bb242571d9eb961275e0a12f32d1358ec9795311ef2ae04ab2d65a6681617
MD5 f0158de73cb6fff555a97addf714a6f3
SHA1 503887b09b7b336b5777d7fa1bffb259df58109e
SHA512 5c167e94cf0265a7b535bd1b2925437494663308765cab10fd504f0d8362a07bdc57e6e67a00759273df70228aea175a9a98c434a42c7e36c2b414aa8ae77f70
TLSH
T1FFE0202426FBE12EF1A4977903D590D6AF26F1127C9561FE0D81141D5509A145C52D30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_E38E081F0870852670C4F0E8233F2647

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_E38E081F0870852670C4F0E8233F2647
Size 408B
SHA256 24c7507ce89224e4850d7d48abc2a3592960c573b6732bb08b0aaeb7b02c1c29
MD5 e9535de297689c7a79d782005c8729fe
SHA1 0a4c761c477f83f447a092d9f160571319e1b76d
SHA512 fe1136966e0b6f2838c22c3b565f4a57c88d10de8a9d6844f6165fef201052af8860ee91ebcaa1af9edb5d78f9b511cfe325c608dca5a2857f26fe118d08686e
TLSH
T117E02D3A33F6874EF1F8D53803E1E8221C6CF3264081C6A91290930AFB14B009CE2730
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 b7f1f3f57132f870f6773fa0c6c75fa99c6db58dc1ee6bbb58f9bdea00b8a305
MD5 aa5194184a840396eea89f63ce3ae4ec
SHA1 b151c29b2d57519b05d697beca3634e75822e861
SHA512 8d4578c094b4f14309a32ce0e828eaca05e23b1cf5437dec2355c36d48fe50a7ca7f1e2c6b7b59dcb4d23d12303b37e5bc50fbb9d5aceae5bc41c59c2b482839
TLSH
T1FEE0DF2D26EFA51EF090993586FAA1761D4AE61A244497BA16D04309A70AF049C21AB4
MD5 SHA1 SHA512 TLSH

Submit Download

Advancedinstallerbanner.jpg_1

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5884\Advancedinstallerbanner.jpg_1
Size 3KB
SHA256 947fd7db59b338e9b4c38deea307cc49b0661c1ed8a59f8a19537e8670556928
MD5 808b9ff24b511816158642cd17748f4e
SHA1 8f36cc28aeb91791384143dd56f06c14a0ca0d15
SHA512 3b885fa5701a674e4e21f50ec4c273359bc05187c06c71ede3591adaf60dce879caf6740ff3720f26d91835d82524a36468e928ec0b2d87e1be0c8f0be8c9ada
TLSH
T19D813C8D9282B5C3E5766F7E850482A5A019653DDF0185DEDB6E3BC5C7BC48B6020B08
MD5 SHA1 SHA512 TLSH

Submit Download

DialogImageLogTag.jpg_1

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5884\DialogImageLogTag.jpg_1
Size 38KB
SHA256 6fca8b358010ac2af913aa6f7eafc20b1bd5c50694228fcae4ab2aa1d778d2d9
MD5 2dd1698177059aa9315a6fce8c17bdb7
SHA1 f57227291d09323351b1ebced94259054718e0dd
SHA512 7ec2fa36c64f3988743ea39d4ff4c68da909786ecce4b5bb1801b581b507ea3a8587907394cbf6a4e14f6a7bb21792f5113546dd4f9b835dfc487dfd9952b9e8
SSDEEP 768:DQKsqZ9UhovZVSVsLzFn61FpDGMWWqL+zngAsr0:DQKFvkMVSVg6jDan0
TLSH
T11503AC74FFD7EBA11783492C40BD7D730742A6CD42D19AB3281B0E692A82FB541476BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICDF5.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSICDF5.LOG
Size 127KB
SHA256 5a844dc83d112e3e98fba19a9aef9b5d117b5deddb19c0911c8150d2c3dffc1e
MD5 0f33ec2f66cf49e2cf895ff645be7f11
SHA1 e99c31c16e92d0d8dd930c2e6c7ae44a61c86107
SHA512 ecfbb052f58b43132ef765309356d5968aa1015d9bec01de394f152ffc91ecfbe1e0f94551f75772e2c5fe86c4447a73288e86bba4b4c0d0f35340d18df09861
SSDEEP 1536:d0mXFoQ4mnGpA5PwTToAk/+iylxuj1sU39MlzgFzZ55P5PgaaQIRI/GWIeRfHne1:aaQV5BlsQ
TLSH
T170D317246FF51049B2BB9E4BEFF34522DA77F9295835C80D3086921D05B1E049E6E3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICDF5.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSICDF5.LOG
Size 164KB
SHA256 6ed6b125b622a3c771fbc80f4126445c1f67e97dcc27bace5fbbebaa95e8b521
MD5 e9d05416f7360b045458a6ae601bb44d
SHA1 804252f873da73e260e039f80f2add5af1ab30aa
SHA512 ac4f2288ef5f3850b5a8bd84d7a67338136872dbd22b27e1e5840cfe3201d4fac963f5b9915272b7b1a56aeb181a54968d1461df9191e95d255875aa1072cebf
SSDEEP 1536:d0mXFoQ4mnGpA5PwTToAk/+iylxuj1sU39MlzgFzZ55P5PgaaQIRI/GWIeRfHne2:aaQV5BlskYDf3
TLSH
T11EF349247FF51049B2BB9A47EFF34522DA77F9295935C90D3086821D04B2E049E6E3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID1B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID1B0.tmp
Size 587KB
SHA256 42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0
MD5 cadbcf6f5a0199ecc0220ce23a860d89
SHA1 073c149d68916520aea882e588ab9a5ae083d75a
SHA512 cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc
SSDEEP 12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
TLSH
T1CED44921369AC036D56D05B02DACDBAB516EBE764B3658DBA3D81E3B85F08C25331F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEB0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIEB0C.tmp
Size 709KB
SHA256 1e84a4da22cb64ab037afa6ca184e080463dd870d6db2f42dda2414fd2311caf
MD5 16427fa171bd703839d252c580c42cd0
SHA1 268ec6c390d5fba3af0d3ca55ecfc65d9e232906
SHA512 52e2b47b6f461d85a689243c89c91151cd643952cd64fa0efb00522a4de3d4ffefd09adbeb524ed664b9da0fd141ebcd5a12d780debd79741626183ae837c77c
SSDEEP 12288:OuYFjg26D559YpR0FeANNnJuXtmy6/EJg3LQxPmJPsJZTPt55dkHawNf:OhgzVNngEyOE+3LkuJkJ9155dkHawNf
TLSH
T111F45B21719AC03AE57D41F13A3CDE6BA17D7B720BB214DB6BC45E7A18B48C21631E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIECD4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIECD4.tmp
Size 212KB
SHA256 25d92a4b84e4ce37160e9f10c1a4a17efa35c8b343abad0d92084deb0e999ee9
MD5 626835e7c68cb7fc441f47bbddab62a0
SHA1 e63adc27622cbed850eba9c2aef0dd59fa035e8c
SHA512 abd031563a8b525c13271dd967dfe85e670a617084df26f29d6960c45e179c9193dcf112a973624927c808aa4b92e0d86b3a1545d74ed932f1b7aef659f94a3f
SSDEEP 3072:UTH+3fdH6Aw73Nd/QdYDZ7vojkfGpDeBEfgCp8fOAg0FuDdwly0zi2fS8aTl7:UTH+vlPUWmwjkupDekAO+O2fSr9
TLSH
T1AB248B503592C437DA7E16304928DAAB667D7AA04F718CEF73D89E7A0E307C15631A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop.exe

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\AnalyzerDesktop.exe
Size 7.0MB
SHA256 ce23dddd92464920f5e250573531a303d31572ed7c52548967dda5dc6d349699
MD5 774054114f5cef4c55f087e9cdabcbfb
SHA1 ab0c21aac4a6d2205b0d1d21cd0c82dc91ffd12f
SHA512 ec3f45f58f6b2c14989338545ded7a4c66a3c14ea4dcc144973061db271a3b760c25dbc59c44c808be0b37819d52dc2a2fbbbe87af619307f3a86ab1cf9e00ca
SSDEEP 49152:f5XXnfp4oTxwJUbKya7nYw3jWpHTWNkCUvLs7Akbzvwdzfu5Zb0fmfKONy4ZNPvl:f53xwJsdDw3jaWyCUzs7AkVJCONvr
TLSH
T1AB7607407BE59519E0565F3694B0A2C02730BE6ABF0ACB4F542136BDAC317D39A2DF93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDoc.ico

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\AnalyzerDoc.ico
Size 1KB
SHA256 3ca95982850a09ef5e64bc519fc47fff11102d610d74813fd9784c7d7b9eb4b7
MD5 644c6c28f6db0fdab07db65db7f0adb5
SHA1 d44e85147b9252e13e2ad668be00415ed312b499
SHA512 c311b3c233b3556f85d35664b6438271186df0538f920f19bbbdfe96d0dae692096a83c3f8858add6626f69c06e0b1fe493f6e093aabe7505cbe8705a2b72066
TLSH
T1AB118F7672A46975C89FC230C40FCBFD4D979846A4D6121B97F8CE6FBC767802612C94
MD5 SHA1 SHA512 TLSH

Submit Download

Freezer Monitoring Example.ltdx

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\Examples\Freezer Monitoring Example.ltdx
Size 5KB
SHA256 bb81360e438f8a8f88e3cdd9d63e63842e88f6fc9fc79217eb3ba80c8fea4404
MD5 d5723061b20674a51388efb965b54ed8
SHA1 54270b2dd7fffa2293c0faf5aa356b792542c8d3
SHA512 f5debf6e0cefdf302d31a6e18acd84ca9293241227617f29018a097e766ad3110e61fa6717bbbbb9bcbb26362de2c2f6401270ab37881b60c6da811d0f5405d8
SSDEEP 96:Sx5Vqtu8N1AjsZCvZQHdBOxB6CWNyR53IdKtoWG0c5udGsUIhBimSCOZ44KKD/N:ukU8PKs6Z6BODWusp0g7yEC4FD/N
TLSH
T1BCB19F353AE2729164C9283F4CF31682F7598F6E72673D76BD8B0037035C4ABE24155A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTD2XX_NET.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\FTD2XX_NET.dll
Size 63KB
SHA256 c411ad7b423816fdec51b75b00534fc595e99b6182fa1fca0a0512e95e652cab
MD5 7b51af2a705b6b53d462ccedf548a5e7
SHA1 259addaad6e7a0755f3cdf2aa86bc4c3caadfbaa
SHA512 c3df48dc3ced2708842087680ee841e7bfb80ecde33c1e04fa664441ca64efbd377a2332ca37806856950236ee4575e094054cb2be6d191f77965702923e460a
SSDEEP 1536:yIN9b48IhQhfSjq84YsqPGESbpvbJnRZ76:SAWHPhI1RZe
TLSH
T1F553B692ABEC4A34C0AD637C652B080C2339BA6B5476D72B40C684742F25795D3D37EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\de-DE\AnalyzerDesktop.resources.dll
Size 3.2MB
SHA256 9b6e6c0b75451b10d31f692c0f0f8b599f3e2589ac136ff45d90b82619eb6df8
MD5 54b44749b616a14bb79220947d36aaaf
SHA1 783bed0ed5e01978c9c03f682d25ff8c3e58b905
SHA512 f43d8d71315a55ce3df877c3957134a41932c3541c5303af0519e308108c7e651fcf708da141c0f9d22506c567d19eabce26e1815406f5c1adcb7964b82eacf0
SSDEEP 24576:zouD49te4jjbhvYHdzXDlnuKj1gvtRvYyF:zb0fHbhv0dzXpuKj1gvPvxF
TLSH
T115F5843436AAD24CE4F60E71993491E06676BE75EE06CE5FA0193B8CEE319138711B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LTCustomControls.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\de-DE\LTCustomControls.resources.dll
Size 462KB
SHA256 dcc804101fdf93084dcc77d94be566aa871eb5cf1c2f9886e01de44e90359f1e
MD5 91454e78b2aa966a5bd96b36111c0b21
SHA1 4897dadfc06db985ea1cf68cd035571264c71333
SHA512 3335f243cad2ce5f05bfca71cc31a1056a56041134500e4d3690c79ece9eae847daac45b3d8713964741d58d7a9252f5bffe3739948d800401d140a67d28f955
SSDEEP 6144:kx/i/La9CgC+c39ss5rU3kirMyUTGN45JCjypqB1d:y/i/LqpyK1d
TLSH
T11BA4EB2136EA2248F9BB0F751A3890C16B7A796ABF14C75D2159030D8E72D53CF22F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\es-ES\AnalyzerDesktop.resources.dll
Size 3.2MB
SHA256 0850b3880089c62fccd0638e1e81dcbbe3b476fe4c4f8c6976667bcc6513268e
MD5 c33a37188530b93e4fcc2ca3dcf90609
SHA1 eb568a3ad4a078cb0029052a8cbbca3a65b6cc24
SHA512 8a5ef241369ca768d79b195747e570b2b6cfe247688709bd53c22bdd623c8ced4c84ba7d34a59663730b8adc170fb53fa54c5b198a42b93f69b9a95987d314ef
SSDEEP 24576:1ouD49te4jjbhvYHdzXDlnuWjf+HPPBxvYGa:1b0fHbhv0dzXpuWjGHPPnvla
TLSH
T1D6F5833436EAD24CE4F60E71993491E16276BD75EE06CE5FA0193B8CEE319138712B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LTCustomControls.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\es-ES\LTCustomControls.resources.dll
Size 462KB
SHA256 80b37c910820324e0cbea721618a46498ca4ef5285f0350bb0f82ba67f694e2e
MD5 625cdeeb77478dbb572d25b8f190392b
SHA1 bbb702d6748dcc7d64a07201fa369ab700336e4e
SHA512 f197628b16956d23e72bbea46c65126095d21f1209de8b52eb908822249cb0be8cae3e60f330bbf332f5723d1d1ce245a3e31e502a9a6e64bfe1c9406c81e111
SSDEEP 6144:bIgUY/La9CgC+c39sCDBr9Ww5mLqR8IdHIlFYZy:bVUY/LqOZy
TLSH
T12BA4EB3136EA2248F9B60F752A3890C16B7A796ABF04C75D2159030D9E72D53CF22F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\fr-FR\AnalyzerDesktop.resources.dll
Size 3.2MB
SHA256 c409bb29127df71c74b127dc59e17b8e12ca182c78eb20ee75fc974ab5ff83fe
MD5 85695252d1b1181de9f2246576380354
SHA1 19445a06382b8247c289fae31af72aeb6e55c267
SHA512 903b586305c0236a9af2e6d04f680ce6a40ef84b88caf27963f148b082f1b2bd99cae446050141e017569a144633592866c6f0cd8304fe42613c20e2be7c660a
SSDEEP 24576:pouD49te4jjbhvYHdzXDlnuUaM/7SS7BvYGY:pb0fHbhv0dzXpuUaM/uS1vRY
TLSH
T19FF5833436AAD24CE4F60E71993491E16636BE75EE06CE5FA0193B8CED319138712B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LTCustomControls.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\fr-FR\LTCustomControls.resources.dll
Size 463KB
SHA256 fc42ba1257f7cbb3ccc3d061cc5bb2b7b1236ecfbddfb9a0f1e1639a7bb75ca1
MD5 f07d4d477bbb5c0e9c79fe8717ce43c5
SHA1 4fdacfd59de2392e3ca6c952984cdb077df9ccb7
SHA512 797f5a978a075439ef3580f226b893b0cac6072648a005b4d760f0e7d6e6c76d1a2a364435ab0be5d58d49fbea3518beed3d09cb27e87a1c7ec4b1215df0d305
SSDEEP 6144:hO3AsMP/La9CgC+c39sfa/nsfE8FusbucgB8D5Zj:h8MP/LqNj
TLSH
T17CA4EC2136EA2248F9B70F752A3890C16B7A796ABF14C75D2159030D8E72D53CF22F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\ja-JP\AnalyzerDesktop.resources.dll
Size 3.2MB
SHA256 8f0615efb25c42b5931755772075d97ccbf6a3da94ebea7331528bc55743aafa
MD5 e66ec1c71308198c2894cf1b5216139d
SHA1 2e7e06cd0191686da2754f6bf86755a8d7d5478c
SHA512 09c6c50a1c46de607a8b81604baf0ec7427670a990710794d392d42ce107d0f87656f2b018ad66914e31c7f034822d855a2028743a098c95e9779fe31446bae1
SSDEEP 24576:IouD49te4jjbhvYHdzXDlnu1weoWsmQzvYgtDe:Ib0fHbhv0dzXpu1wLWsmMvdt6
TLSH
T153F5843836EAD24CE4F60E71993491E06676BD76EE06CE5FA0193B8CED319138711B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LTCustomControls.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\ja-JP\LTCustomControls.resources.dll
Size 463KB
SHA256 6b6dc387f06616d135715231b259867ba7f6078e2bd6f75ce06c5781d6e3d7c0
MD5 57c146fb5d98dd5541577c2d420cd0c6
SHA1 5f1694b4f07e4e557c6456376d59a83d1d6cdfb8
SHA512 5bd8348ffb3ea116e76b743a941066025c2cc3bdfdbb5b2a48a24c3e3b458981091427a28d92b7e8f99ae8ef69efa40e9a2c22364f27d04403fdfd4111200549
SSDEEP 6144:MEwv/La9CgC+c39sCXSX/0380de3gB7gyfy+rA:/wv/LqmrA
TLSH
T1CFA4EB3136EA2248F9BA0F751A3890C16B7A7D6ABF14C75D2159030D8E72D53CF22E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ltanalyzer_3.2.8.68.msi

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\ltanalyzer_3.2.8.68.msi
Size 6.2MB
SHA256 b0140d678f60b4f50c0211f5794ed76677db3e93dc66145ad8c9b727ae2d02b0
MD5 f1817233dc4087e0a3b6c795f48f7a88
SHA1 d8789850fc1ee9929c618d17e6492f8ccb31e265
SHA512 457660415d7cbce17f8897744835897ae2d045f72b0c8a8e99da5d06ba5a6a7695af48e60ad8c25f852ea1039dc33dcf05e5565f6255ce3ba693917c9124165e
SSDEEP 98304:rbDCakNCaSq9/nJEYsNoC1VIi+SmowEi+:GaOesojVRpmb
TLSH
T122665A29A3A1C4A7C53E027E9C289F9A747C2D614B3140D7E6D87F6FF9709C0823599E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\ru-RU\AnalyzerDesktop.resources.dll
Size 3.2MB
SHA256 7367710352faf2382203c3ba6873904bea4127d37c90e85100b1eaac337daaf1
MD5 532bc6be574f0a511f6f65886a4cd6e5
SHA1 2d901c4dcf185d3f21ffd0e1bc89ed7a169cae1b
SHA512 64a7c0b017e0e359aa70be26051278cb25a0a78855c9ad3a01531999dd1e0db1756b0a08dbb974b80bbf2e6e5abcbde14b600dac790645396c68cc202cf17e67
SSDEEP 24576:NouD49te4jsbhvYHdzXDlnuDoTnpHllFMFWUvYJy:Nb0fYbhv0dzXpuDoTnpHlHMZvmy
TLSH
T1C6F5833436AAD14CE4F64E71993491E02676BD7AFE06CE5FA0193B8CED319138712B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LTCustomControls.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\ru-RU\LTCustomControls.resources.dll
Size 468KB
SHA256 afae5e95078e571fd651a4f8d37395a112d73708922f72ac3359ab2a2c087b93
MD5 3a71c39d6876b817e7e97781ddc29713
SHA1 6f0859031923ea765ec7540517cde6938ba8ff3e
SHA512 6a2c3bb88af6876adad334250b2e1726c03abdf72345c68f6755c41491d3f96bfe7514cdd6770b312a46c470353b2e92836eea66608f88343c0c268a63aef907
SSDEEP 6144:7kq8/La9CgC+c39s7zHvkHMEtGDM9LP2z6n8Y1tLUNG7CejGv:oq8/Lq4Rps
TLSH
T1C5A4FB2136EA224CF9B60F751E3890C16A7A796ABF04C75E2159030D9E72D53CF22F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop.resources.dll

Path C:\Users\Admin\AppData\Roaming\LogTag\LogTag Analyzer 3.2.8.68\install\9BD8718\zh-Hans\AnalyzerDesktop.resources.dll
Size 3.2MB
SHA256 35fc3534b21e9b4edbccc5be1730d4b28faf16e8b5bba7bf7ca20743677e2f1e
MD5 042bb8b76bbae55a4e7ed11a1df19afc
SHA1 b7f43b343cd1f871bde9733e5599131435755983
SHA512 f8c81a9ffffff8f8b661eed2a35091af6fe242f11b26f573619a0a7a2bc8199113df99a9489c3b487065529cce7183007e9be1ce780492c77043cb6711bd019d
SSDEEP 24576:9ouD49te4jjbhvYHdzXDlnukEgLDs7GGrvYNV:9b0fHbhv0dzXpukEIwGEvGV
TLSH
T19EF5843436AAD24CE4F60E71993491E06676BD76EE06CE5FA0193B8CED319138712B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI20B.tmp

Path C:\Windows\Installer\MSI20B.tmp
Size 301KB
SHA256 ef31d9a6b2986ab38f43cc652bf05ee88168ee063690cbe79d1d125c985b5587
MD5 ab14e0639557925f1c31cd479633474a
SHA1 90456f7082f759c4f6752a2add33333d377262a4
SHA512 307ae114e3a694d18e7c9dd3cfb65adef936d6b237602cf2d2e59a38186adf6d566ee67fcf8474a7b1b0b21c34c9ec3adbc2eefeb1760e5c545dc6f4522cc57e
SSDEEP 6144:MyEEi+lMWuJ/nuQ+TDZCSl3F0P2W9LpAOcF4LXvN:XExMduJ/nF+ToSQqKLXvN
TLSH
T155647C20B582C037D97F05311528DEAA157D7A714BE1C8EB97E81E7E4E736C29331A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3D27.tmp

Path C:\Windows\Installer\MSI3D27.tmp
Size 95KB
SHA256 77abff1b7322eca3dd35cbadf268d06c9ef920cf923ee3a77e97edd050c28a1b
MD5 3056644ace6294c801a8010e99888525
SHA1 bbb622450269b1918e9fe11ed32deecf65e7e0e2
SHA512 853e263e4a921b332cf573b8271759cff5cec569b08af78ed8f022d76567868a66455c12fab728a96babebd3859fc1ed2c8507e7233b45b2811542e2d38e1c3a
SSDEEP 1536:wrFGPrzWvJt+DFEMhkVNXkRebBhox77NjCZBbogFPISt/AhU:mG2BIeMenXkReb/quZBZFAS3
TLSH
T188934B4173E950B9F9A779B06FFAD51DCABAFDD44922C71F4366088B9890700BA25333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4DC6.tmp

Path C:\Windows\Installer\MSI4DC6.tmp
Size 650KB
SHA256 07694439a93f220f5e9f46ac3ceb0b22fe1dadb3ed9bf18a9f2835be7a5c3bc6
MD5 6aa987dbea3f424fa44cd541dbae7368
SHA1 47ba276719f0a3e25e24fb546ecad8b97b6ebe67
SHA512 c5c5901bcdfdb413cb679d39c90a4fa64e96ad10d25476c62e2d2276bdc1cf8a5b4d987f881acb701ffaaa22662b64442e399f1aa8cb6ff5c761e03c474756a2
SSDEEP 6144:R11HMbt9eFVmIGccehSleghteGzRSDWFQ//fo4CyRg5Sy3rRsaCUhsm27QE:w5cceNKt7zRy/zCyas8ROUOVb
TLSH
T185E46514F9B80525E163997FA2A29E5DD17239861731CACF0302DBF61D3B5DA8632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5171.tmp

Path C:\Windows\Installer\MSI5171.tmp
Size 107KB
SHA256 16c4cf37242385f27d2625ee8b660b745342ef8340541e6c7e4673522ed13956
MD5 cf6354b5789cb6b9691b8896e255a378
SHA1 e9429ffa42b00f45073fa1989f92c2c27d7aad86
SHA512 7ba049a5ec80d94763d44c7cdc85d2e94b4edfe5db2ce575d594e4914f321bbb730f60b33f2ff9f58f359ce4f4b35dd5efbaad670c30c31dd836735110776202
SSDEEP 1536:zCDvWcAQcnkygLVSA10DUXqUWqJ76Yjfx6Luy/ViX:DkyASA1CUdRLTy/QX
TLSH
T115B3F915BFBC0029F1716A3E95E25528E1753D822B3187EF2D02A7DA1E37AD58436F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEC2D.tmp

Path C:\Windows\Installer\MSIEC2D.tmp
Size 734KB
SHA256 e4be5a385dae73184e6366a1b97e6d2c5c8daef5fdb1a158b8702ee1a5ce8646
MD5 689bd1c08bd6042fe854ab88a76b52cf
SHA1 d511885bd0709cbb22b618021e7c501b3d94e87e
SHA512 f835e5eab607adef8bbd6fae61a09825d7b7e496982c9a6e7344ce4688f73c67d12c41edb0b0f96e4a5e9b85c266f354d8ffb8b9cc0aa306da68ab6f177f1176
SSDEEP 12288:QIc/iOL96FU56q9JsfsmTE2EaXA7bDLeSEnh03t5MTp/dVPj7hG:QIA9AyX9JsEmgaQ7bDq5h0d5Ap/ddj7c
TLSH
T13CF45A213546C03BE96D01B0253CDEBF617E7A720BB248DB97D49EBA49744C29331E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5abfbb.msi

Path C:\Windows\Installer\e5abfbb.msi
Size 2.0MB
SHA256 361ba5a21820f3f7f890c8a39a0f192c875ffccd75066e9e21ffcb7ab2c0bd5c
MD5 2378606b5d626a6b57ccf6856a6b5c48
SHA1 1e6f893fdb9af8afeaa30b090887cbd24341fd12
SHA512 e65f0936fd70a2531ef1be1a4d0ae0fb538ff5138b4c2589a11b3b5955f19e745b73a3b0013f58232868896d479b8500830e2b78d8e260dcc7743f2a5a56a5b8
SSDEEP 49152:FYKqzCw87pYw0AM1/OFbZHu6nEKfkOosyl:ifzCwUYXAG/6bVJRol
TLSH
T16BA58E15F9B80125E1A3997FA2A2AB1DD57238865731CACF0302D7F61D376D68632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyzerDesktop_2.exe

Path C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\AnalyzerDesktop_2.exe
Size 59KB
SHA256 dfb3ed5791565531c79eff8b130579a694dd382c953fd5a2450d2c1e67d65b9c
MD5 ddb2bb3eda5eaebb3d85ee86150c0dac
SHA1 25c206d505eb2058012e2ae60eccbb6c81cc1aaf
SHA512 7a63ea7dc11be8074db4eda7f86c5e882f97226de103f3a5b31c2c6a2fbf48d57bca5c83a814244a0ef4d2532cb9f6ffa3cc95c8d22cfdbc862f16b3c3228a18
SSDEEP 384:Iy8j6B4pVVVVhg3TVdzo3Kd3pwH3U1VWGukkkkkkkkkkkkkkkkkkkkkkkkkkkkkr:Igog3T7zfVWGyza/Clxy7CmwrkZ5t
TLSH
T1955360172A02F481D40CFDF6E615CBC006BE2D52416D5616248CB7AEEB7EC6DE86E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ext_1.exe

Path C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_1.exe
Size 53KB
SHA256 2670c72e5e7699e231de7f02393675c4493d064eaaa2812c5340c6412b8b9f73
MD5 34b87e035ffa76a6427b4161f79cacec
SHA1 cfd087d443dce6ad1162e192841402451cf4f23d
SHA512 c30538ac69ba31de6fad1981f4a0c9570c4634c6adf5fb8e1f4ae55da0147ad8ed2b1ff79e6177e745fac38e2c884470e72f07e7c2a4b71a3f08e8ee24d0a989
SSDEEP 768:wFAyvZO/M3H4VZZ9ga5WjznlL8mZTIsFlSYC9iCO9z/Z06u8v:wFA6ZB3YvZ/5WXnlLxZsmMYC7Ol/Z0Yv
TLSH
T1EC4381C22B00DF8FCD9585BC88D68DF9A6A1FC7BA05949811980FB6FFB521D1812F45B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ext_5.exe

Path C:\Windows\Installer\{469D85DE-4556-406C-AFF0-443D19BD8718}\ext_5.exe
Size 49KB
SHA256 edab2b15ce308dd3223e6e8aa3d109037bce4f4336641761283c4733f1dd6388
MD5 380a4252bcb28fb0a0432391518aaa31
SHA1 f0c8d455265f98772f2cb01b503dd124d1dacee7
SHA512 66f87607052cb251c953d14b3ff5c4bee498774bb2f18fb96f1174eb0b20103bc8c450cfd9d9e1aaddbb8d3e035d9974ca00f15799d61496bf25a7df1d66b26d
SSDEEP 768:gOJHRYBuWod/qoRT2WU7Jmc7QZH6p0EIbKH+4BHd861:7JH4OMoJ2FFmY0EIk+4BHu61
TLSH
T16B33B4C16B09DECAC84435B48CCE69FD6A60ED77EA943B9610D07A7F0A310E08197D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ftdibus.inf_amd64_fcaca8e732787d0b.ini

Path C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b.ini
Size 902B
SHA256 7a512ae2af2fb59981aec70e92e08860004f79cf7bab8c61cc849b1e5de9bcf9
MD5 c38cd221f0d23b617316d67f61bc8b4d
SHA1 c8e81fe97ce58945985a394d127dbdf6e92c240c
SHA512 1d13ec1c540eb48732fb2637ac22a908b3e2d7735dbce07efea9b94386d7bde79c48bd00b1df2828458049be62f5bd5bdd6348cb52252ba1ebeaec654adb49e7
TLSH
T142117A647250C569A18114097F6A9837C920F3BB7E622AA1B79EC1C08F1DE65E74C3D3
MD5 SHA1 SHA512 TLSH

Submit Download

ftdibus.PNF

Path C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_fcaca8e732787d0b\ftdibus.PNF
Size 11KB
SHA256 224a935184807d5d552a3c92379700d943817e11700786cb4dcba8e74ead58e1
MD5 8806fe0cfcf9a237e33eda5421199616
SHA1 e9c4aebce962bc8e55d0f8341197eb6032fbdeeb
SHA512 457044a74acf8d066f3fee532d1942c1def141fca7e8632a57e837ccc624cbb860599fe86d04b2c3d38d93800c2b0f200ce7048581d06623394da4ba1ec80347
SSDEEP 96:9au7YOMTowc2KqixdiD1Ek1FBIL/JQW1SGI0rGgr1TEBPR2d27ziew0123fCMSlY:9aZE5Q2EZo078Go1U1/RDFGV
TLSH
T1EA32686673D98B18F1B64DB49DF491E95426FC83AC02C70F6164730E2DB2B90DFB0A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ftdiport.inf_amd64_2ad21e7fb260b0d2.ini

Path C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2.ini
Size 666B
SHA256 61f5b9fcfda7431b7bc5984b5f5e3438cc660f660f5a4d952cda0f4cb08de13f
MD5 77b92c453f3c8c38ce4c792d63afaff9
SHA1 8651fc2b3e971e5fe9c1257a79d1924d27c6cfa8
SHA512 b83d707214252e30e2fae5945f3500472fb5a8d6883831ec33fcd2dcaac78350a04377eaab4146d67144693a5a77bb1c3ae2c80ca3ee6791db4948788f63d551
TLSH
T1E5019909A2A2C54850D1080E2E059C36C92477BB74A2B9E5362CE3C04F0CE19E7883F7
MD5 SHA1 SHA512 TLSH

Submit Download

ftdiport.PNF

Path C:\Windows\System32\DriverStore\FileRepository\ftdiport.inf_amd64_2ad21e7fb260b0d2\ftdiport.PNF
Size 11KB
SHA256 5651e407189c0f0f858a207f12cb84e8808b7f8ec8fe51fbb7e0383595da0292
MD5 84dc813c852bcb5e966c7708d18fd217
SHA1 89c32ab18eec931ba495949074309834584ea282
SHA512 492e9790de08387c1cd191c218300f5c4f1c298c00421c15c0e9427282c904e5644cc63750ba83ce64c2f7f532439b2f2b5015040e50c5149e9a3ef46499db1c
SSDEEP 96:xIP06TY9RUSuV96us2En10IILcYW1SGe0ZcRfGwHyTEdQI0t2Ex73QGOJFJ7zofe:I09EESbaESDQnJQMqCkJG
TLSH
T1A4326C9977DA8F08F0F28D745DB852E60865FC82AD17CB1F61A0730E1D72E94DEB0A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 72KB
SHA256 38bc15c8688eaa457baa08a382dc9dab8fd11f4c09406839c4655eabf3a948da
MD5 b999627b5137234f36a7d1adc3e720ce
SHA1 6e4f7cc343605baca3e40cd914e72768f2bdca4b
SHA512 aca7825519f14212a33a0dd5e58bb07b227eb46cde65049f8eccd6051832e49d96b2883b1cc274e0cfba5fc5be4b7e347350cd3fd041523401b7bcb495e6d4ea
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7FqpA:HGAA
TLSH
T19D732B0580D8C609C9B609A27277EEB2D57A76EE771F0DA730AD5300D9C2F053FBA469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 255d682eb296205350b58593b60c655643670f1e1790842229202c8e601ae160
MD5 54028c5dfa43027e7da000197937f6bd
SHA1 571e343233f4427f03d08acb21a02bda540ada73
SHA512 2c8adfd27f37f308dd20464de6569866145a8ed9ba73c25a17c9b5e6b7da02c1617f7f8810b22aafcd7d094e8a9fd846dd3cce62e0a626f1966465e3b01903a2
SSDEEP 24576:qFo3DMPNdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+n:WHI
TLSH
T1AF57022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7c03ca91-3b65-4b18-9bff-921df3347263}_OnDiskSnapshotProp

Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7c03ca91-3b65-4b18-9bff-921df3347263}_OnDiskSnapshotProp
Size 6KB
SHA256 ac4cee00b514f43d65f48c7f74cc87088fa5a9317a35d994e07a7b8c55dbb111
MD5 fd533c591a84206d6c730a4f0f297c5c
SHA1 1a91f8136680b08a782c5193632c84921b78dcee
SHA512 76e90e6b67a8d63a4a06f4b08879a9f092d7682b9efca937a38f719be873b8f39c06bc7fb81f24a57294a0662879590f895a9aef0d3eac5d3bc3ec36abc96e6a
SSDEEP 96:FHkP9jjvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:aPBb++uVm
TLSH
T1BBD18A185AF54711E2F3AB3129F18557A877B812EF33CB8E0198238E6671910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download