bazarbackdoor | 666dcc84d26ea7ba79228f744f9caeac1192a9f274a5e795cc9e9352d41d80f3

Analysis

max time kernel
154s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2023 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iTunesSetup64BitsPorLimonTouchYT.exe
Size

264.9MB
MD5

f50aeff9ee0031bfb28c860ea2c0f3ad
SHA1

7b317da13c3d0e463f73c27123a69379c4dbfd9d
SHA256

666dcc84d26ea7ba79228f744f9caeac1192a9f274a5e795cc9e9352d41d80f3
SHA512

4dddad8a53a09dc97b55c2d091cfc7f743a73398632301d578c53d1d7d32941b79a6f2eea6af5fa260f2e8ff767bc98aa73abda5a5f10964513462e792ce3342
SSDEEP

6291456:rvKMpdD1mWqV32SJu8bkTiV0mIskk1oxic34VY3OyA:rv5q5bvPTk10mO

Score

10^/10

bazarbackdoor backdoor evasion persistence

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

mDNSResponder.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Bazar/Team9 Backdoor payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\iTunes64.msi	BazarBackdoorVar3

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

30 4992 msiexec.exe
32 4992 msiexec.exe
Executes dropped EXE 5 IoCs

Processes:

SetupAdmin.exemDNSResponder.exeAppleMobileDeviceService.exeSoftwareUpdate.exe

pid process

4544 SetupAdmin.exe
2408 mDNSResponder.exe
2616
4324 AppleMobileDeviceService.exe
2820 SoftwareUpdate.exe

flow	pid	process
30	4992	msiexec.exe
32	4992	msiexec.exe

pid	process
4544	SetupAdmin.exe
2408	mDNSResponder.exe
2616
4324	AppleMobileDeviceService.exe
2820	SoftwareUpdate.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeAppleMobileDeviceService.exe

pid	process
3724	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
1264	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
1588	MsiExec.exe
3080	MsiExec.exe
3080	MsiExec.exe
3080	MsiExec.exe
8	MsiExec.exe
8	MsiExec.exe
2152	MsiExec.exe
4048	MsiExec.exe
764	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
64	MsiExec.exe
2296	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
2532	MsiExec.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe
4324	AppleMobileDeviceService.exe

Registers COM server for autorun 1 TTPs 37 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\LocalServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE6AF8E5-3A75-4AF5-BD59-C42E7228B4F4}\LocalServer32\ = "C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\secd.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE6AF8E5-3A75-4AF5-BD59-C42E7228B4F4}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\secd.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82D845BA-38FF-4548-B00E-E88B12C11BFA}\LocalServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CD53C5C8-7B0F-4276-96DA-E6566A8807AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD53C5C8-7B0F-4276-96DA-E6566A8807AE}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CE6AF8E5-3A75-4AF5-BD59-C42E7228B4F4}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32\ = "C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\OutlookChangeNotifierAddIn.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82D845BA-38FF-4548-B00E-E88B12C11BFA}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD53C5C8-7B0F-4276-96DA-E6566A8807AE}\LocalServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{82D845BA-38FF-4548-B00E-E88B12C11BFA}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\""	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 55 IoCs

Processes:

DrvInst.exeDrvInst.exemsiexec.exemsiexec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC781.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1B5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\USBAAPL64.CAT	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\USBAAPL64.CAT	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\netaapl64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netaapl64.inf_amd64_56f23639c9617984\wdfcoinstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\wdfcoinstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netaapl64.inf_amd64_56f23639c9617984\netaapl64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netaapl64.inf_amd64_56f23639c9617984\netaapl64.cat	DrvInst.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1C6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1D7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1D7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaaplrc.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC7B3.tmp	DrvInst.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1C5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaapl64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\usbaaplrc.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaapl64.PNF	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC792.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\netaapl64.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC7A2.tmp	DrvInst.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1B5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\usbaapl64.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaapl64.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC781.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1C6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\usbaapl64.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC792.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\SETC1C5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\netaapl64.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC7A2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\SETC7B3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netaapl64.inf_amd64_56f23639c9617984\netaapl64.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netaapl64.inf_amd64_56f23639c9617984\netaapl64.PNF	MsiExec.exe
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\SettingEditor.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\StorageSidebarPanel.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServices\Schemas\Contacts.syncschema\Contents\Resources\Schema.plist	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\CoreMedia.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\BoxModelDetailsSectionRow.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Test\TestHarness.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\VisualStylePropertyEditorLink.css	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncDiagnostics_main.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\TypeObject.svg	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\TimelineRecordingContentView.css	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\Pencil.svg	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\DetailsSidebarPanel.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\IndexedDatabaseDetailsSidebarPanel.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\Canvas3D.svg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Protocol\DatabaseObserver.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Protocol\Legacy\10.0\InspectorBackendCommands.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Protocol\RemoteObject.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServices\Clients\com.apple.WindowsContacts\com.apple.WindowsContacts.isRegistered.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\NewTabContentView.css	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\StyleRuleInheritedElement.svg	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Models\NetworkInstrument.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\HierarchicalPathComponent.js	msiexec.exe
File created	C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.Resources\de.lproj\SoftwareUpdateLocalized.dll	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\AVFoundationCF.resources\da.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.resources\sv.lproj\Error.strings	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Controllers\CodeMirrorCompletionController.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\PathRect.svg	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Controllers\CodeMirrorTextKillController.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Controllers\LogManager.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\StepInto.svg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\DetailsSectionGroup.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\Foundation.resources\en.lproj\EncodingNames.strings	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Models\SourceCodeLocation.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\HeapSnapshotSummary.svg	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\WorkerScriptLarge.png	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\ScrubberNavigationItem.css	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\MemoryTimelineOverviewGraph.css	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\ThreadTreeElement.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\defaults.exe	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\ColorSync.resources\Profiles\SD 170M.icc	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.resources\CFUniCharPropertyDatabase.data	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\MediaAccessibility.resources\es_419.lproj\ProfileNames.strings	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\[email protected]	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\ShaderProgramTreeElement.css	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\StyleDetailsPanel.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Models\XHRBreakpoint.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\VisualStylePropertyEditor.css	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\AuthKitWin.resources\en_AU.lproj\AuthKitWinLocalized_2015.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\vi.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Proxies\HeapSnapshotNodeProxy.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\OverviewTimelineView.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Proxies\HeapSnapshotProxy.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\AuthKitWin.resources\ro.lproj\AuthKitWinLocalized.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\AVFoundationCF.resources\German.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\CompletionSuggestionsView.css	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\FilterFieldGlyph.svg	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\hu.lproj\mediaControlsLocalizedStrings.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Controllers\SourceMapManager.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\CubicBezier.svg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Views\VisualStyleTabbedPropertiesRow.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\he.lproj\mediaControlsLocalizedStrings.js	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\Path.svg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\AuthKitWin.resources\zh_CN.lproj\AuthKitWinLocalized.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit.resources\WebInspectorUI\Images\Resources.svg	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exeDrvInst.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230310172047278.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI928E.tmp	msiexec.exe
File created	C:\Windows\Installer\{77F8C879-88CD-4145-945A-541C35285285}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C1BBFD2A-BCDD-45B3-8C0B-66BD434970A8}	msiexec.exe
File opened for modification	C:\Windows\Installer\{C1BBFD2A-BCDD-45B3-8C0B-66BD434970A8}\AppleSoftwareUpdateIco.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\vccorlib140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\vcruntime140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABCC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABEC.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230310172023825.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230310172023935.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\concrt140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1BA.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\vccorlib140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB41D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\978C8F77DC88541449A545C153822558	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Installer\SourceHash{543F829B-4591-4B2F-AF63-6E6E6AE59EB2}	msiexec.exe
File opened for modification	C:\Windows\Installer\{543F829B-4591-4B2F-AF63-6E6E6AE59EB2}\WinInstall.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DDF.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\{0ECA3BB5-4410-414B-B226-241FF1C12CD0}\WinInstall.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID45D.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\vccorlib140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB0F.tmp	msiexec.exe
File created	C:\Windows\Installer\e57826c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC759.tmp	msiexec.exe
File created	C:\Windows\Installer\e57825f.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230310172023935.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest	msiexec.exe
File created	C:\Windows\Installer\{543F829B-4591-4B2F-AF63-6E6E6AE59EB2}\WinInstall.ico	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230310172023825.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\e57826b.msi	msiexec.exe
File created	C:\Windows\Installer\e578273.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\vcruntime140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File created	C:\Windows\Installer\e578262.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\vcruntime140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\978C8F77DC88541449A545C153822558\12.0.0\F_CENTRAL_msvcp100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI274A.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230310172047278.0\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA659.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\msvcp140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\concrt140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B928F3451954F2B4FA36E6E6A65EE92B\6.4.0\vccorlib140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3863.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e578267.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57826c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA966.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C1BBFD2A-BCDD-45B3-8C0B-66BD434970A8}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI275B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5BB3ACE00144B4142B6242F11F1CC20D\6.4.0\concrt140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9715.tmp	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 63 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeDrvInst.exeMsiExec.exeDrvInst.exevssvc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a577c74c521b2f150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a577c74c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900a577c74c000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a577c74c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a577c74c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SoftwareUpdate.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	SoftwareUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SoftwareUpdate.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exemsiexec.exeDrvInst.exeAppleMobileDeviceService.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.	AppleMobileDeviceService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames\asl.log = "asl.172118_10Mar23.log"	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exemsiexec.exeSoftwareUpdate.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88F48C4A-46DF-4236-A838-364BF1B3FD1E}\ProxyStubClsid32\ = "{88F48C4A-46DF-4236-A838-364BF1B3FD1E}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91A9E6A9-3935-4A37-AFBA-F0904B166364}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0AF768AC-4FBD-4914-B847-F4E13C984926}\1.0\0\win32\ = "C:\\Program Files (x86)\\Apple Software Update\\SoftwareUpdateAdmin.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E095A809-7CDD-4B6D-A528-5D4AC9420D91}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71529314-E4B7-400B-8FD7-9A5F695AF311}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\978C8F77DC88541449A545C153822558\ProductName = "Apple Mobile Device Support"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService.1\ = "DNSSDService Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0AF768AC-4FBD-4914-B847-F4E13C984926}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0AF768AC-4FBD-4914-B847-F4E13C984926}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.TXTRecord\CLSID\ = "{AFEE063C-05BA-4248-A26E-168477F49734}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A2DFBB1CDDCB3B54C8B066DB3494078A\Version = "33816584"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4756495C-58A8-4D50-BAE5-4AFE9244019A}\TypeLib\ = "{9D8925E0-D73D-44CC-B7D1-C7DE4345AED6}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B928F3451954F2B4FA36E6E6A65EE92B\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppleSoftwareUpdate.ASUInstallHost\CurVer	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B928F3451954F2B4FA36E6E6A65EE92B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BB3ACE00144B4142B6242F11F1CC20D\SourceList\Net\2 = "C:\\ProgramData\\Apple\\Installer Cache\\AppleApplicationSupport64 6.4\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ = "IDNSSDRecord"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\APSDaemon.APSNotificationServer\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\Programmable\	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2a007e005700290043007a0067007a00310040006e007b00710051004b007500320066004a0062004300520054005f00570069006e005300580053003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5312be26-34d9-432d-a03e-1732e463bc4d}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CE6AF8E5-3A75-4AF5-BD59-C42E7228B4F4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppleSoftwareUpdate.ASUInstallHost\CLSID\ = "{91A9E6A9-3935-4A37-AFBA-F0904B166364}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5EFF418-0D49-49AB-A5C3-9E39AFD2B4A0}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppleSoftwareUpdateAdmin.ASUTaskSchedul\CurVer	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7F7E1C5D-4D91-48C9-B09E-3E45D502FFA0}\NumMethods\ = "19"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{995E123A-2A19-4E52-872F-774C5589459C}\TypeLib\Version = "1.0"	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{EE33A36F-59B2-4DBA-B457-F1F83DC045A8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}\ProxyStubClsid32	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C403E73D-D090-490C-BCF9-F4C375094C7F}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\TypeLib\ = "{9D8925E0-D73D-44CC-B7D1-C7DE4345AED6}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APSDaemon.APSNotificationServer\CurVer\ = "APSNotification.APSNotificationServer.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5EFF418-0D49-49AB-A5C3-9E39AFD2B4A0}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}\TypeLib	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ce9691b7-616f-4c69-a74e-b6e701e3fd1b}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD53C5C8-7B0F-4276-96DA-E6566A8807AE}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4756495C-58A8-4D50-BAE5-4AFE9244019A}\TypeLib\ = "{9D8925E0-D73D-44CC-B7D1-C7DE4345AED6}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB46F03E-7CD2-489F-8F95-BB950F395FDB}\VersionIndependentProgID\ = "AppleSoftwareUpdateAdmin.ASUTaskSchedul"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8F613925C106BA84AB6F9D0E99838D3D\B928F3451954F2B4FA36E6E6A65EE92B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService\CLSID\ = "{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0515ACBB-7296-4F73-8958-EB1CCF5EFD83}\TypeLib\ = "{0AF768AC-4FBD-4914-B847-F4E13C984926}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CE6AF8E5-3A75-4AF5-BD59-C42E7228B4F4}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService\CLSID	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MsiExec.exeMsiExec.exemsiexec.exeMsiExec.exeMsiExec.exe

pid	process
3724	MsiExec.exe
3724	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3456	MsiExec.exe
3468	msiexec.exe
3468	msiexec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3008	MsiExec.exe
3468	msiexec.exe
3468	msiexec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

iTunesSetup64BitsPorLimonTouchYT.exemsiexec.exemsiexec.exe

description	pid	process
Token: 33	1984	iTunesSetup64BitsPorLimonTouchYT.exe
Token: SeIncBasePriorityPrivilege	1984	iTunesSetup64BitsPorLimonTouchYT.exe
Token: SeShutdownPrivilege	4992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4992	msiexec.exe
Token: SeSecurityPrivilege	3468	msiexec.exe
Token: SeCreateTokenPrivilege	4992	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4992	msiexec.exe
Token: SeLockMemoryPrivilege	4992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4992	msiexec.exe
Token: SeMachineAccountPrivilege	4992	msiexec.exe
Token: SeTcbPrivilege	4992	msiexec.exe
Token: SeSecurityPrivilege	4992	msiexec.exe
Token: SeTakeOwnershipPrivilege	4992	msiexec.exe
Token: SeLoadDriverPrivilege	4992	msiexec.exe
Token: SeSystemProfilePrivilege	4992	msiexec.exe
Token: SeSystemtimePrivilege	4992	msiexec.exe
Token: SeProfSingleProcessPrivilege	4992	msiexec.exe
Token: SeIncBasePriorityPrivilege	4992	msiexec.exe
Token: SeCreatePagefilePrivilege	4992	msiexec.exe
Token: SeCreatePermanentPrivilege	4992	msiexec.exe
Token: SeBackupPrivilege	4992	msiexec.exe
Token: SeRestorePrivilege	4992	msiexec.exe
Token: SeShutdownPrivilege	4992	msiexec.exe
Token: SeDebugPrivilege	4992	msiexec.exe
Token: SeAuditPrivilege	4992	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4992	msiexec.exe
Token: SeChangeNotifyPrivilege	4992	msiexec.exe
Token: SeRemoteShutdownPrivilege	4992	msiexec.exe
Token: SeUndockPrivilege	4992	msiexec.exe
Token: SeSyncAgentPrivilege	4992	msiexec.exe
Token: SeEnableDelegationPrivilege	4992	msiexec.exe
Token: SeManageVolumePrivilege	4992	msiexec.exe
Token: SeImpersonatePrivilege	4992	msiexec.exe
Token: SeCreateGlobalPrivilege	4992	msiexec.exe
Token: SeCreateTokenPrivilege	4992	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4992	msiexec.exe
Token: SeLockMemoryPrivilege	4992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4992	msiexec.exe
Token: SeMachineAccountPrivilege	4992	msiexec.exe
Token: SeTcbPrivilege	4992	msiexec.exe
Token: SeSecurityPrivilege	4992	msiexec.exe
Token: SeTakeOwnershipPrivilege	4992	msiexec.exe
Token: SeLoadDriverPrivilege	4992	msiexec.exe
Token: SeSystemProfilePrivilege	4992	msiexec.exe
Token: SeSystemtimePrivilege	4992	msiexec.exe
Token: SeProfSingleProcessPrivilege	4992	msiexec.exe
Token: SeIncBasePriorityPrivilege	4992	msiexec.exe
Token: SeCreatePagefilePrivilege	4992	msiexec.exe
Token: SeCreatePermanentPrivilege	4992	msiexec.exe
Token: SeBackupPrivilege	4992	msiexec.exe
Token: SeRestorePrivilege	4992	msiexec.exe
Token: SeShutdownPrivilege	4992	msiexec.exe
Token: SeDebugPrivilege	4992	msiexec.exe
Token: SeAuditPrivilege	4992	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4992	msiexec.exe
Token: SeChangeNotifyPrivilege	4992	msiexec.exe
Token: SeRemoteShutdownPrivilege	4992	msiexec.exe
Token: SeUndockPrivilege	4992	msiexec.exe
Token: SeSyncAgentPrivilege	4992	msiexec.exe
Token: SeEnableDelegationPrivilege	4992	msiexec.exe
Token: SeManageVolumePrivilege	4992	msiexec.exe
Token: SeImpersonatePrivilege	4992	msiexec.exe
Token: SeCreateGlobalPrivilege	4992	msiexec.exe
Token: SeCreateTokenPrivilege	4992	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

4992 msiexec.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SoftwareUpdate.exe

pid process

2820 SoftwareUpdate.exe

pid	process
4992	msiexec.exe

pid	process
2820	SoftwareUpdate.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

iTunesSetup64BitsPorLimonTouchYT.exemsiexec.exeMsiExec.exesvchost.exe

description	pid	process	target process
PID 1984 wrote to memory of 4992	1984	iTunesSetup64BitsPorLimonTouchYT.exe	msiexec.exe
PID 1984 wrote to memory of 4992	1984	iTunesSetup64BitsPorLimonTouchYT.exe	msiexec.exe
PID 3468 wrote to memory of 3724	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3724	3468	msiexec.exe	MsiExec.exe
PID 3724 wrote to memory of 4544	3724	MsiExec.exe	SetupAdmin.exe
PID 3724 wrote to memory of 4544	3724	MsiExec.exe	SetupAdmin.exe
PID 3724 wrote to memory of 4544	3724	MsiExec.exe	SetupAdmin.exe
PID 3468 wrote to memory of 3456	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3456	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3456	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1264	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1264	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1264	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3008	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3008	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1588	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1588	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1588	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3080	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3080	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 8	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 8	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 8	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2152	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2152	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2152	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 4048	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 4048	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 764	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 764	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 764	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2296	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2296	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2296	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 64	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 64	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1508	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1508	3468	msiexec.exe	MsiExec.exe
PID 4772 wrote to memory of 3448	4772	svchost.exe	DrvInst.exe
PID 4772 wrote to memory of 3448	4772	svchost.exe	DrvInst.exe
PID 4772 wrote to memory of 4892	4772	svchost.exe	DrvInst.exe
PID 4772 wrote to memory of 4892	4772	svchost.exe	DrvInst.exe
PID 3468 wrote to memory of 2532	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2532	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2532	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1432	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1432	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 1432	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 820	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 820	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 820	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3160	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3160	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 3160	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 2820	3468	msiexec.exe	SoftwareUpdate.exe
PID 3468 wrote to memory of 2820	3468	msiexec.exe	SoftwareUpdate.exe
PID 3468 wrote to memory of 2820	3468	msiexec.exe	SoftwareUpdate.exe
PID 3468 wrote to memory of 4264	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 4264	3468	msiexec.exe	MsiExec.exe
PID 3468 wrote to memory of 4264	3468	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\iTunesSetup64BitsPorLimonTouchYT.exe
"C:\Users\Admin\AppData\Local\Temp\iTunesSetup64BitsPorLimonTouchYT.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CC16166422929D863E6DBF07BF6B003F C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\SetupAdmin.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\SetupAdmin.exe" /evt E3BD /pid 3724 /mon 788 800
    3⤵
    - Executes dropped EXE
    PID:4544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 421D794E2AE5E7CDCE2C9581112799CA
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B589851A4FC8DCED6449F7E50DBCFF3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1264
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8B6A41BE8A1FD22A9EC5E44183617CB9
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D914B5E6BB627F71A3348A0AE80A326D
  2⤵
  - Loads dropped DLL
  PID:1588
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C10A5C180E4C40E419E346A3B98E5230
  2⤵
  - Loads dropped DLL
  PID:3080
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8DC0F5A5C6DD142FCD663739015393BC
  2⤵
  - Loads dropped DLL
  PID:8
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5AEF7B5E6BFB2F2DC598B8EF9E8CF6B9 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:2152
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:4048
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 34518ED6FD9AE0A17DC8B994893C0F01
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AE70D60E2D109D9CB78653D6E67EE9AD
  2⤵
  - Loads dropped DLL
  PID:64
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 666D5504A39758E400BBD3889455D559 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B8F7A6237EC91C8E8FF25970142118A2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 81F3A011C5AD7530220805F707578700
  2⤵
  PID:1432
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll"
  2⤵
  - Modifies registry class
  PID:820
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll"
  2⤵
  - Modifies registry class
  PID:3160
- C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
  "C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" /RegServer
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2F7CAFC326FC58DB1D2A418B6317F0DC E Global\MSI0000
  2⤵
  PID:4264

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers\usbaapl64.inf" "9" "4d4a61e6f" "00000000000000F4" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3448
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Common Files\Apple\Mobile Device Support\NetDrivers\netaapl64.inf" "9" "4e8e1f40b" "000000000000015C" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Common Files\Apple\Mobile Device Support\NetDrivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4892

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4324

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{16D99191-6280-4B33-A2F5-04805A0FC582}
1⤵
PID:3608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e578261.rbs

Filesize
545KB

MD5
28cce15511c00f0de999ece8375bcba5

SHA1
548e283a98c9f8a43490b051b44b3a25f1b9f9ab

SHA256
daaed9730d688444f8057824ed4ad37d886b653aadb41d257f9a587ef827863d

SHA512
34a81764aec6d770a6dfc4afe6905f200dec535f9038953f92d8e5731cc3ce71d3deb47950509fe33554245e1f67087fd9d885676da2e3d32bffd777769848e2

Download Submit
C:\Config.Msi\e578265.rbs

Filesize
412KB

MD5
ae526fd9d369892c47108a845e225365

SHA1
fd712c9f797995129d3dd8abf2c3f74dc46c5cfe

SHA256
892baefcf82172219ee2b1d0cfdaab2af76c1c8ee0fbe8c4996cd0bb6a34d8c6

SHA512
27e65713fa9e74e05c4645fa7526f14bebbdc5f544314995f3f0bcf72728db36603ca03b52f167f2a787a9a218b091a0b7978b164521e359fd78857c467f43a0

Download Submit
C:\Config.Msi\e578269.rbs

Filesize
126KB

MD5
c5ba929b08e5e82843813945c52e72e3

SHA1
ce5e2b30c74821f4db19dc60d1441d4713f85b8c

SHA256
313cad724c44f9480a51522fc17d5e7b33c5fefc7ba0d890782daef8304a86db

SHA512
d5f6d927bca362bb1375e9e47839b1756363099bc49635ffb6da28d6012a1c258ed5691ccfc622253d6376fabc1c7311e5dd8cd05a8c994dfce92ef34bd42762

Download Submit
C:\Config.Msi\e57826e.rbs

Filesize
1.6MB

MD5
9335bbe70c0185b8d40b2b3b2bb337ad

SHA1
95432d96bd7b5fa408fb2ffcc6e114e41f4ec111

SHA256
868804e08613fe5ef42dd2ff3c8e352f08dafc9da1bb708bf28f492d7251b89d

SHA512
3260bcf712124bfdc09340fa36a810e6a42c9829c6fe0cb778b403103a0f6b6fb80bef6b4f800aa91e6b1e6b3d246fe618459ca7778193bd1c1b46a870734940

Download Submit
C:\Config.Msi\e578272.rbs

Filesize
167KB

MD5
f2bb5c7627293bd800229119e84391da

SHA1
0ba19b0138e36262199a371768722a465d1537e3

SHA256
e1eb69936684492b250ecd6f4f3f6d7a27558642b0db7e833437cf69414b12cf

SHA512
e76956216c3f056b7cc2013cc7aa69e1a299281272eb460703de6ba07a77de72cab23e6f77caefdaae926dbc153937b561116194e841c12abafb4f9ea1769897

Download Submit
C:\Program Files\Java\jre1.8.0_66\lib\ext\dns_sd.jar

Filesize
17KB

MD5
ce9a2f5a7fcfff341d6d901ad919a2ab

SHA1
341f9d9a0b3fd8cfbefe0169b148dcc55688ee93

SHA256
cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7

SHA512
1f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f

Download Submit
C:\ProgramData\Apple\Installer Cache\Apple Mobile Device Support 12.0.0.1039\AppleMobileDeviceSupport64.msi

Filesize
14.4MB

MD5
93bcbf18ec7f034250078e4b5239bda1

SHA1
2b0f8f9e6e1605152312531f1824a1d54ec8ffb4

SHA256
6a594ed90fb4b67e127864d793d15231383eb4b023e00a38ca0171e473efac86

SHA512
f05e09e7a0fb269478df9c35159cf41168eeafc14e1fbdc0849d891ebee1d6e279744086bd9b7a1bae3d3a1e01cc9db92263dc1e1e9b6db77cf4004f0639994f

Download Submit
C:\ProgramData\Apple\Installer Cache\Apple Software Update 2.4.8.1\AppleSoftwareUpdate.msi

Filesize
3.4MB

MD5
5f1fbbf794eeef801a22e2e306115b86

SHA1
8d8e1cfc17c6a8e8f356ef7f142b1e6038a37e2e

SHA256
764b653be2551704acb2f9e84bc239e2d6494fa16e97fc338ac341ae93ee25a3

SHA512
9dd66dcca4f8816ec458a5d254fc0368cf7ff4d431eff7885ce04b32daa6059f164d4bca2261e8b9aeb64cd2c6bffbcd541a7305767e21b4ac024cfd3d971a6d

Download Submit
C:\ProgramData\Apple\Installer Cache\AppleApplicationSupport 6.4\AppleApplicationSupport.msi

Filesize
45.8MB

MD5
56733a7ccd955f7bcd161521c6f03b93

SHA1
f038f322513286bfb18acc2b0964cf8a58e52603

SHA256
0e8170c36bdc5fde3e431d1f0f085829d427a84cfdcfc746bf60c2243c0f7619

SHA512
3a8bd3c94bd0a2d6ff2f3ea89f09de940b36bc54e3a89a7690f88c05999abf32f926c916d2af5e811bee414dcede9196ffeba18d20f153425d0393d0b3ce49ff

Download Submit
C:\ProgramData\Apple\Installer Cache\AppleApplicationSupport64 6.4\AppleApplicationSupport64.msi

Filesize
50.7MB

MD5
fb261c151ecd4fcf50cc16ec15680514

SHA1
1094b660eb3144bb20f70fe597abb13b882d36dd

SHA256
f07e0ba82dedf0771bae970de6775f57b1319e4c0dfbb3dea372d0012cbef461

SHA512
1868a34844a071ed8e3f8e1da7fcdad09cb2abbf2859912207f9ab950986161f9ad0d77051ae216fe245539d5a45fbdd723810f78bd394c1b08567f3a05be7e7

Download Submit
C:\ProgramData\Apple\Installer Cache\Bonjour 3.1.0.1\Bonjour64.msi

Filesize
2.6MB

MD5
86e2b390629665fbc20e06dfbf01a48f

SHA1
d9f4697a6f4eceea24735822cb1df501268ca0b0

SHA256
46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

SHA512
05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\AppleApplicationSupport.msi

Filesize
45.8MB

MD5
56733a7ccd955f7bcd161521c6f03b93

SHA1
f038f322513286bfb18acc2b0964cf8a58e52603

SHA256
0e8170c36bdc5fde3e431d1f0f085829d427a84cfdcfc746bf60c2243c0f7619

SHA512
3a8bd3c94bd0a2d6ff2f3ea89f09de940b36bc54e3a89a7690f88c05999abf32f926c916d2af5e811bee414dcede9196ffeba18d20f153425d0393d0b3ce49ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\AppleApplicationSupport64.msi

Filesize
50.7MB

MD5
fb261c151ecd4fcf50cc16ec15680514

SHA1
1094b660eb3144bb20f70fe597abb13b882d36dd

SHA256
f07e0ba82dedf0771bae970de6775f57b1319e4c0dfbb3dea372d0012cbef461

SHA512
1868a34844a071ed8e3f8e1da7fcdad09cb2abbf2859912207f9ab950986161f9ad0d77051ae216fe245539d5a45fbdd723810f78bd394c1b08567f3a05be7e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\Bonjour64.msi

Filesize
2.6MB

MD5
86e2b390629665fbc20e06dfbf01a48f

SHA1
d9f4697a6f4eceea24735822cb1df501268ca0b0

SHA256
46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

SHA512
05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\SetupAdmin.exe

Filesize
131KB

MD5
5997993c182f9cba203ef150c17d6775

SHA1
6b0965ef4a529f34ddb8c995681843770021f0f4

SHA256
ce5a7eb0f63af694479d9407fab4a8d106c148842e13ddb5491dd55a54fbf759

SHA512
16e16bd22f84c8b403a5261712b152017a763e7d09a4f93c8d4811d969eb91b9b190d83d3b46766d867d1da63867e5a0dbd4087f1c0d585b880bf2f977aa1864

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\SetupAdmin.exe

Filesize
131KB

MD5
5997993c182f9cba203ef150c17d6775

SHA1
6b0965ef4a529f34ddb8c995681843770021f0f4

SHA256
ce5a7eb0f63af694479d9407fab4a8d106c148842e13ddb5491dd55a54fbf759

SHA512
16e16bd22f84c8b403a5261712b152017a763e7d09a4f93c8d4811d969eb91b9b190d83d3b46766d867d1da63867e5a0dbd4087f1c0d585b880bf2f977aa1864

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP693.TMP\iTunes64.msi

Filesize
160.8MB

MD5
aa0bd163477221a93784b35bde2a26ac

SHA1
36fa99c4adb8a178ac4b4578590f36868062d352

SHA256
b3ec234c7be56777f0c1e9314d799715a6645b2008e1c611c66fce0c01429214

SHA512
b01f8720e5e9a2b9f056a56dd8f7f3b4e420754d45adf831bda398be2f37ea22ad361d91c557a22fbf8cb5e392ec5304cbeb34c1cd841aabfa7ab861b716ebd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI52.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI52.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7B32.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7B32.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI91.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI91.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB2.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB2.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFB8B.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFB8B.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC38.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC38.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC49.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC49.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC49.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFD34.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFD34.tmp

Filesize
172KB

MD5
2ffedc2c38b794069849c5bd2f259099

SHA1
5451c84104837cba3e4c1e6c377c66ee8f487d4e

SHA256
f943f413d9fd54c8f2222004835891ca87fd3e6bb6567e9aa5e20fe8b8fffb4d

SHA512
8ebd91d4702afa480a80ba0d43bbc997974ceea55765146849e029d25f238337b91f0147edd89f8a19765d4d8d92b6e121ae6c205e95ea29a642d757f674815a

Download Submit
C:\Windows\Installer\MSI1DDF.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI1DDF.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI2003.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI2003.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI237E.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI237E.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI237E.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI23DD.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI23DD.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI26CC.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI26CC.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI274A.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI274A.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI275B.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI275B.tmp

Filesize
127KB

MD5
389605c1d37a1e02fe999c8b92b44dd3

SHA1
d1a45cb153a1dc2f965c94543c109a3f9b588a07

SHA256
403e166c6895a26b254d11d3645beacb9faa498f238faebb2085962fd867a8c2

SHA512
d431a0adeeca3f652b73502f263466d84ed02f1f91a0879ff139b151d5b108a4a6730a9f3e638f6488ae3b79859b190c0235899a04a2ad486d4fc524d32b3201

Download Submit
C:\Windows\Installer\MSI3863.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI3863.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI8A5E.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI8A5E.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI8C33.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI8C33.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI8D5B.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI8D5B.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI8EA4.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI8EA4.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI8FAF.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI8FAF.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI8FAF.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI91F2.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI91F2.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI9251.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI9251.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI928E.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI928E.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI928E.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI9290.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI9290.tmp

Filesize
115KB

MD5
a952f6f1ce8902fe422ae828f99890da

SHA1
fbd1c8dd795c51a7464c7a4a36e1e325e6ecbc8e

SHA256
d456d574cc47c8f6940caaeecbf550e90c7f234259eef6e200ddc4bf9a1fd1b1

SHA512
da57c99656dee9e51cd31372e096cb6793e7db2b4e7987d3f2a20ec2c1d0d94f6f6dc9a4db9b37f138455211115c8ee463de67fe8ef25a3cbb511d59b6f5dcc8

Download Submit
C:\Windows\Installer\MSI9715.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\MSIA2DD.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSIA2DD.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSIA8DB.tmp

Filesize
88KB

MD5
24cf20d975eeceb14d973069f8474ca7

SHA1
97257d5ab00c0523fad04915863b3eaaf9b28845

SHA256
5ea382270be8ddcab3f855a931663321d64d2573366ad2ca4bf81523b3006f6e

SHA512
0b7c9a80b030a93a4cf23eeaa29d4fef36c905345bba46d86abe2cac20033808f44358b5fcbc36a08d90a146d5186d42a003721483bdbf759f6f3b503bfee5fb

Download Submit
C:\Windows\Installer\MSIA8DB.tmp

Filesize
88KB

MD5
24cf20d975eeceb14d973069f8474ca7

SHA1
97257d5ab00c0523fad04915863b3eaaf9b28845

SHA256
5ea382270be8ddcab3f855a931663321d64d2573366ad2ca4bf81523b3006f6e

SHA512
0b7c9a80b030a93a4cf23eeaa29d4fef36c905345bba46d86abe2cac20033808f44358b5fcbc36a08d90a146d5186d42a003721483bdbf759f6f3b503bfee5fb

Download Submit
C:\Windows\Installer\MSIAA04.tmp

Filesize
96KB

MD5
5aeee2cfad31a2c63ba0bf1d767fbcfa

SHA1
18bd5fd6d3e7fd8f01cc1be0b0e95c7a281d734d

SHA256
4d655a4c21201c5375435aea76daee3aaf518bff0cfb17a1f7b1d2f3671fe35c

SHA512
d4d7a8d969a0392a954b75360cbaf8aa0234774a240f8554a4bdf6a8a3cbab68d67cc1b193c5af7cd9ede22ebc5682ac51714e30850c162ed052a4b05b5d95f7

Download Submit
C:\Windows\Installer\MSIAD31.tmp

Filesize
88KB

MD5
24cf20d975eeceb14d973069f8474ca7

SHA1
97257d5ab00c0523fad04915863b3eaaf9b28845

SHA256
5ea382270be8ddcab3f855a931663321d64d2573366ad2ca4bf81523b3006f6e

SHA512
0b7c9a80b030a93a4cf23eeaa29d4fef36c905345bba46d86abe2cac20033808f44358b5fcbc36a08d90a146d5186d42a003721483bdbf759f6f3b503bfee5fb

Download Submit
C:\Windows\Installer\MSIAD31.tmp

Filesize
88KB

MD5
24cf20d975eeceb14d973069f8474ca7

SHA1
97257d5ab00c0523fad04915863b3eaaf9b28845

SHA256
5ea382270be8ddcab3f855a931663321d64d2573366ad2ca4bf81523b3006f6e

SHA512
0b7c9a80b030a93a4cf23eeaa29d4fef36c905345bba46d86abe2cac20033808f44358b5fcbc36a08d90a146d5186d42a003721483bdbf759f6f3b503bfee5fb

Download Submit
C:\Windows\Installer\MSIDE81.tmp

Filesize
133KB

MD5
3cb819b1aa56e164022e2a29207353c1

SHA1
a5593d18f74dd48105b07566ff2f3888b1a96335

SHA256
297bd3cf414221a376c8946efa6a706f124373a74b8aeb197c6018b885419ee0

SHA512
fe97bfd4b41285944469a3d82bdde258d8648ba27ee38763915dfa3de86e39fd2feba96337189194e44203914a474aca4790eb76bbb0a3dc3b222a8c969c7a89

Download Submit
C:\Windows\Installer\MSIF74B.tmp

Filesize
88KB

MD5
24cf20d975eeceb14d973069f8474ca7

SHA1
97257d5ab00c0523fad04915863b3eaaf9b28845

SHA256
5ea382270be8ddcab3f855a931663321d64d2573366ad2ca4bf81523b3006f6e

SHA512
0b7c9a80b030a93a4cf23eeaa29d4fef36c905345bba46d86abe2cac20033808f44358b5fcbc36a08d90a146d5186d42a003721483bdbf759f6f3b503bfee5fb

Download Submit
C:\Windows\Installer\MSIF74B.tmp

Filesize
88KB

MD5
24cf20d975eeceb14d973069f8474ca7

SHA1
97257d5ab00c0523fad04915863b3eaaf9b28845

SHA256
5ea382270be8ddcab3f855a931663321d64d2573366ad2ca4bf81523b3006f6e

SHA512
0b7c9a80b030a93a4cf23eeaa29d4fef36c905345bba46d86abe2cac20033808f44358b5fcbc36a08d90a146d5186d42a003721483bdbf759f6f3b503bfee5fb

Download Submit
C:\Windows\Installer\MSIF74B.tmp

Filesize
88KB

MD5
24cf20d975eeceb14d973069f8474ca7

SHA1
97257d5ab00c0523fad04915863b3eaaf9b28845

SHA256
5ea382270be8ddcab3f855a931663321d64d2573366ad2ca4bf81523b3006f6e

SHA512
0b7c9a80b030a93a4cf23eeaa29d4fef36c905345bba46d86abe2cac20033808f44358b5fcbc36a08d90a146d5186d42a003721483bdbf759f6f3b503bfee5fb

Download Submit
C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\USBAAPL64.CAT

Filesize
14KB

MD5
26eee7af8aa1ef8c1bd7c9327c602844

SHA1
990a56215aac7000eac9371f489a0fc57d560078

SHA256
946b0a8150213d6a4dd3aef6248ebb923f8167c84c7ff1b10137e5030ec8bf30

SHA512
1cce53edb09f449720005ee9ca013fabb0be498991adf38ce738330a02b336790cb835e235e097c57a7cf983b4bf18664bc113b074cd94f9118901565d83e24d

Download Submit
C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\usbaapl64.inf

Filesize
5KB

MD5
2da3a91b71919d035d8fd17b6b90bbc2

SHA1
c2c6a29f3abc80fd992777a92df30699124d37c5

SHA256
edea577e694efceec5b26d745fff8125e9fc8a78cacd7365e77ef35031ebc49b

SHA512
71b98c884c338902110c83f6c858b906bd8d63e09e5f92d3e019f586d82961fdc71a459e6456a3e9a56b9b109838b4556aee91e0befb68c2ae505c93a41fe56b

Download Submit
C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\usbaapl64.sys

Filesize
53KB

MD5
f957092c63cd71d85903ca0d8370f473

SHA1
9d76d3df84ca8b3b384577cb87b7aba0ee33f08d

SHA256
4dec2fc20329f248135da24cb6694fd972dcce8b1bbea8d872fde41939e96aaf

SHA512
a43ca7f24281f67c63c54037fa9c02220cd0fa34a10b1658bae7e544236b939f26a1972513f392a5555dd97077bba91bbe920d41b19737f9960ef427599622bc

Download Submit
C:\Windows\System32\DriverStore\Temp\{7499f003-8f60-7142-9b92-fe75fd197391}\usbaaplrc.dll

Filesize
5.8MB

MD5
1428a8b3dbf4f73b257c4a461df9b996

SHA1
0fe85ab508bd44dfb2fa9830f98de4714dfce4fa

SHA256
5ed0d8f2066dd19d5aec42c5498fdd1db9cefab4d024a1015c707dfd0cfd5b20

SHA512
916a61feb9a36872a7c1adece8933599e55b46f7d113966ec4ad2af0e2568f1a339629ec48eca10bd1e071c88171fe88292dab27ce509ceea42afbd049599cc7

Download Submit
C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\netaapl64.cat

Filesize
10KB

MD5
168c4256eea6a76983d79d45f191469f

SHA1
2f4e6d8db4bcfeec816d31a70045895a3e6158e3

SHA256
2b8a6ebc3e10d06a6ebbcb4ef89992978836eb52d2ad1c09e19b137b0963c2f9

SHA512
743f28589f4357594c4490c6bdc46b6ca6e3164ab58495d686316ba8effc004e68507b26cb07032f3232ecf21045078a97aae0fad9ac78acff48ec2ae0c26585

Download Submit
C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\netaapl64.inf

Filesize
4KB

MD5
2428e7f81420a9d7e81dfce9fa0613b3

SHA1
96605444de2721d553530179ea96024f29b32827

SHA256
6db20d1374088a64b5a435189e3cbf1c0f30496d4a2c80346bc904605f3d0261

SHA512
fc98a3010d5a71ce4c9ec2ef16914cc6fabf531fdbf1cfc487d42dc352111e47f970565a011cc6ebd18b2632af5bc107e5c0e784127b789b68e6cb3f214aaf5b

Download Submit
C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\netaapl64.sys

Filesize
22KB

MD5
ee00c544c025958af50c7b199f3c8595

SHA1
1a9320ad1ebcaaa21abb5527d9a55ca265deec5d

SHA256
d774db020d9c46d1aa0b2db9fa2c36c4a9c38d904cc6929695321d32aca0d4d1

SHA512
c08cfb84b6bc98a965b5195b06234646e8f500a0c7e167d8c2961dad3c10da47407d339f1fbd2c3af4104932b94ee042872680d968c3c9b086705d374fc9c94e

Download Submit
C:\Windows\System32\DriverStore\Temp\{b3906739-1d8d-8243-a5c2-4d26d247b325}\wdfcoinstaller01009.dll

Filesize
1.6MB

MD5
4da5da193e0e4f86f6f8fd43ef25329a

SHA1
68a44d37ff535a2c454f2440e1429833a1c6d810

SHA256
18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

SHA512
b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

Download Submit
memory/2820-3965-0x0000000002AD0000-0x0000000002B0F000-memory.dmp

Filesize
252KB

Download