9cbaef01a8e2be6f4aa68768484268def7ca71491b71e56b435d4878da3232fd

Analysis

max time kernel
111s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iTunes64Setup.exe
Size

201.5MB
MD5

e4a3fa3ea8f46095b47e99c1c8061e1e
SHA1

baf74bef46c2888245fb4fcfe143a392938a9e72
SHA256

9cbaef01a8e2be6f4aa68768484268def7ca71491b71e56b435d4878da3232fd
SHA512

7a9f687b9888ab2388d8f637dc290b124b9b5f89213f2d671c00e8205372bf45cf5ac2422e032d7f29b7f12dd54f18707a6ea71059a6cef8c2d2470a33c749d6
SSDEEP

6291456:TR7zjHZOvPBz6kRVBHPh7d+ktvxSOeM46:dlOvPQ8VBHPh7cktvxSOeM46

Score

10^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iTunes.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper = "\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""	msiexec.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	2836	msiexec.exe

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	AppleMobileDeviceHelper.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	iTunes.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	iTunes.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	AppleMobileDeviceHelper.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	AppleMobileDeviceHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	iTunes.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\CollectionEntryPreview.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\FlexibleSpaceNavigationItem.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Controllers\HARBuilder.js	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\ar.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nl.lproj\ViewLineItemRatingE_dark.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\PrintingTemplates\06.AlbumList.ListOfAlbums.xml	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\zh_TW.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\uk.lproj\AVCFError.strings	msiexec.exe
File created	C:\Program Files\iTunes\CFNetwork.resources\he.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\nl.lproj\Error.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\PrintingTemplates\12.Insert.MosaicBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\ParentalAdvisory.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\NavigationItemGarbageCollect.svg	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\IndexedDatabaseObjectStoreTreeElement.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr.lproj\RatingCaution.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en.lproj\[email protected]	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\DeviceLink.dll	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt.lproj\PrintingTemplates\05.AlbumList.SongsByAlbum.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\OverviewTimelineView.css	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Protocol\DOMStorageObserver.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ko.lproj\ViewLineItemRatingE_dark.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Proxies\HeapSnapshotNodeProxy.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\he.lproj\[email protected]	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer_main.dll	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\el.lproj\PrintingTemplates\04.Playlist.Custom.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\en.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ResourceCookiesContentView.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\PrintingTemplates\15.Media.PlainPaper.SS.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\AuditTestCaseResult.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CFNetwork.resources\Info.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\AppConfig.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ro.lproj\ViewLineItemRatingE.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\PrintingTemplates\07.Insert.TextOnly.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\da.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\tr.lproj\ViewLineItemRatingC_dark.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\tr.lproj\SortPrefixes.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\AuthKitWin.resources\nl.lproj\AuthKitWinLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\CoreFoundation.dll	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\YSUtilities.dll	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\cs.lproj\PrintingTemplates\15.Media.PlainPaper.SS.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\PrintingTemplates\09.Insert.WhiteMosaic.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ObjectTreeView.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en.lproj\StoreGetButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nb.lproj\StoreGiftButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hi.lproj\DeviceCapacityBox.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\TextEditor.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Base\FileUtilities.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pl.lproj\StorePreOrderButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nb.lproj\PrintingTemplates\08.Insert.Mosaic.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sb-h-track.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\th.lproj\PrintingTemplates\02.Playlist.UserRatings.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\PrintingTemplates\10.Insert.SingleCover.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ko.lproj\StoreRentButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\he.lproj\PrintingTemplates\01.Playlist.Songs.xml	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\uk.lproj\Error.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es.lproj\About iTunes.rtf	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\fr_CA.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\vi.lproj\StorePreOrderButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt.lproj\RatingCaution.png	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC475.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{336D80E8-E773-4B6F-BCAB-D291F34A6685}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIE1D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b287.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC387.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC415.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b28d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC474.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\e57b292.msi	msiexec.exe
File created	C:\Windows\Installer\e57b296.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b297.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{F741FD08-15DA-4153-941C-CB03656C8AAD}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICEA8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB372.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC405.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{F741FD08-15DA-4153-941C-CB03656C8AAD}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b292.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e57b299.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF48.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b287.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB304.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8E08D633377EF6B4CBBA2D193FA46658\17.5.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B292D163-23D2-4523-A699-1ABEC1875609}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE758.tmp	msiexec.exe
File created	C:\Windows\Installer\{F741FD08-15DA-4153-941C-CB03656C8AAD}\iTunes.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\80DF147FAD51351449C1BC3056C6A8DA\12.13.2\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB655.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF26.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFC7.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F741FD08-15DA-4153-941C-CB03656C8AAD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC95.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b297.msi	msiexec.exe

Executes dropped EXE 11 IoCs

pid	Process
1668	SetupAdmin.exe
4460	mDNSResponder.exe
2724	Process not Found
920	AppleMobileDeviceService.exe
3916	SoftwareUpdate.exe
5064	iTunesHelper.exe
2132	iTunes.exe
3536	AppleMobileDeviceHelper.exe
4344	iTunesVisualizerHost.exe
1840	distnoted.exe
1652	distnoted.exe

Loads dropped DLL 64 IoCs

pid	Process
1040	MsiExec.exe
1040	MsiExec.exe
1040	MsiExec.exe
1040	MsiExec.exe
1040	MsiExec.exe
3640	MsiExec.exe
3640	MsiExec.exe
3640	MsiExec.exe
2192	MsiExec.exe
2192	MsiExec.exe
4796	MsiExec.exe
924	MsiExec.exe
1584	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
4188	MsiExec.exe
1140	MsiExec.exe
3636	MsiExec.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
4188	MsiExec.exe
1016	MsiExec.exe
1016	MsiExec.exe
4360	MsiExec.exe
4572	MsiExec.exe
3916	SoftwareUpdate.exe
3916	SoftwareUpdate.exe
3916	SoftwareUpdate.exe
5044	DllHost.exe
3916	SoftwareUpdate.exe
3916	SoftwareUpdate.exe
2828	MsiExec.exe
2424	MsiExec.exe
2424	MsiExec.exe
2424	MsiExec.exe
2424	MsiExec.exe
2424	MsiExec.exe
3152	MsiExec.exe
3152	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
4892	MsiExec.exe
2424	MsiExec.exe
1040	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftwareUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppleMobileDeviceHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	distnoted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	distnoted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupAdmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	SoftwareUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SoftwareUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iTunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	iTunes.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	AppleMobileDeviceService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames\asl.log = "asl.020203_03Aug24.log"	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4p\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.PlaySongsOnCD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9D58BF1-0070-4fcd-B722-A0EE5A3ABCD6}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{788D599D-FE85-4142-9B47-2498C5C6D0CF}\Elevation	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.TXTRecord\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0AF768AC-4FBD-4914-B847-F4E13C984926}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.itdb	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{788D599D-FE85-4142-9B47-2498C5C6D0CF}\TypeLib\ = "{2F93D606-28F9-4B2D-A024-2DDEE124B542}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\PackageCode = "7AB0DAA3B13C57C4BAAE4B5D2287294E"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itals\shell\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.pcast\FriendlyTypeName = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,104"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.itlp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9E93C96F-CF0D-43F6-8BA8-B807A3370712}\1.d\0\win64\ = "C:\\Program Files\\iTunes\\iTunes.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\OpenWithProgIds\iTunes.aifc	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.itls	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{2F93D606-28F9-4B2D-A024-2DDEE124B542}\1.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m3u8\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0AF768AC-4FBD-4914-B847-F4E13C984926}\1.0\HELPDIR	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.wave	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.itls\OpenWithProgIds	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.aif\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.AssocProtocol.daap\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C2589C3-96F8-4863-A511-9C33EB2C7E2A}\AppID = "{5011B6DE-E9FA-4518-B5E5-45DE9DD2CDC6}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC0C2640-1415-4644-875C-6F4D769839BA}\VersionIndependentProgID\ = "iTunes.Application"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\iTunes.exe\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.wav\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.pcast\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppleSoftwareUpdateAdmin.ASUTaskSched.1	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aifc\AppUserModelID = "Apple.iTunes"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.itl\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{995E123A-2A19-4E52-872F-774C5589459C}\TypeLib\ = "{7C1E4FCC-B47E-44AE-8EA7-FA66EBC8BAC4}"	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.cdda\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.itlp\ = "iTunes.itlp"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4a\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.wav\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib\Version = "1.0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E08D633377EF6B4CBBA2D193FA46658\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0515ACBB-7296-4F73-8958-EB1CCF5EFD83}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{20ADDA11-8287-44D0-8C63-27CDA87ACC46}\Elevation	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.aif\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71A1A612-F7B4-4092-8E0F-C79C8FB0391D}\TypeLib\ = "{2F93D606-28F9-4B2D-A024-2DDEE124B542}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipg\ = "iPod Game File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4b\shell\play\ = "&Play"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunesAdmin.iTunesAdminMobileDeviceService	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.itlp\Content Type = "application/x-itunes-itlp"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4r\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4p\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4p\shell\play\ = "&Play"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itvlss\shell\open\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /url \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.italss	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80DF147FAD51351449C1BC3056C6A8DA\SourceList\PackageName = "iTunes64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppleSoftwareUpdate.ASUInstallHost.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itvlss\shell\open\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6C2589C3-96F8-4863-A511-9C33EB2C7E2A}\Elevation	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{788D599D-FE85-4142-9B47-2498C5C6D0CF}\ = "iTunesAdminMigrateApplication Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1CF95A1C-55FE-4F45-A2D3-85AC6C504A73}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mov\shellex\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.wav\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	msiexec.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
1140	MsiExec.exe
920	AppleMobileDeviceService.exe
920	AppleMobileDeviceService.exe
3300	msiexec.exe
3300	msiexec.exe
2424	MsiExec.exe
2424	MsiExec.exe
3536	AppleMobileDeviceHelper.exe
3536	AppleMobileDeviceHelper.exe
2132	iTunes.exe
2132	iTunes.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2596	iTunes64Setup.exe
Token: SeIncBasePriorityPrivilege	2596	iTunes64Setup.exe
Token: SeShutdownPrivilege	2836	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2836	msiexec.exe
Token: SeSecurityPrivilege	3300	msiexec.exe
Token: SeCreateTokenPrivilege	2836	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2836	msiexec.exe
Token: SeLockMemoryPrivilege	2836	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2836	msiexec.exe
Token: SeMachineAccountPrivilege	2836	msiexec.exe
Token: SeTcbPrivilege	2836	msiexec.exe
Token: SeSecurityPrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeLoadDriverPrivilege	2836	msiexec.exe
Token: SeSystemProfilePrivilege	2836	msiexec.exe
Token: SeSystemtimePrivilege	2836	msiexec.exe
Token: SeProfSingleProcessPrivilege	2836	msiexec.exe
Token: SeIncBasePriorityPrivilege	2836	msiexec.exe
Token: SeCreatePagefilePrivilege	2836	msiexec.exe
Token: SeCreatePermanentPrivilege	2836	msiexec.exe
Token: SeBackupPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeShutdownPrivilege	2836	msiexec.exe
Token: SeDebugPrivilege	2836	msiexec.exe
Token: SeAuditPrivilege	2836	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2836	msiexec.exe
Token: SeChangeNotifyPrivilege	2836	msiexec.exe
Token: SeRemoteShutdownPrivilege	2836	msiexec.exe
Token: SeUndockPrivilege	2836	msiexec.exe
Token: SeSyncAgentPrivilege	2836	msiexec.exe
Token: SeEnableDelegationPrivilege	2836	msiexec.exe
Token: SeManageVolumePrivilege	2836	msiexec.exe
Token: SeImpersonatePrivilege	2836	msiexec.exe
Token: SeCreateGlobalPrivilege	2836	msiexec.exe
Token: SeCreateTokenPrivilege	2836	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2836	msiexec.exe
Token: SeLockMemoryPrivilege	2836	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2836	msiexec.exe
Token: SeMachineAccountPrivilege	2836	msiexec.exe
Token: SeTcbPrivilege	2836	msiexec.exe
Token: SeSecurityPrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeLoadDriverPrivilege	2836	msiexec.exe
Token: SeSystemProfilePrivilege	2836	msiexec.exe
Token: SeSystemtimePrivilege	2836	msiexec.exe
Token: SeProfSingleProcessPrivilege	2836	msiexec.exe
Token: SeIncBasePriorityPrivilege	2836	msiexec.exe
Token: SeCreatePagefilePrivilege	2836	msiexec.exe
Token: SeCreatePermanentPrivilege	2836	msiexec.exe
Token: SeBackupPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeShutdownPrivilege	2836	msiexec.exe
Token: SeDebugPrivilege	2836	msiexec.exe
Token: SeAuditPrivilege	2836	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2836	msiexec.exe
Token: SeChangeNotifyPrivilege	2836	msiexec.exe
Token: SeRemoteShutdownPrivilege	2836	msiexec.exe
Token: SeUndockPrivilege	2836	msiexec.exe
Token: SeSyncAgentPrivilege	2836	msiexec.exe
Token: SeEnableDelegationPrivilege	2836	msiexec.exe
Token: SeManageVolumePrivilege	2836	msiexec.exe
Token: SeImpersonatePrivilege	2836	msiexec.exe
Token: SeCreateGlobalPrivilege	2836	msiexec.exe
Token: SeCreateTokenPrivilege	2836	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2836	msiexec.exe
2836	msiexec.exe
2132	iTunes.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3916	SoftwareUpdate.exe
2132	iTunes.exe
2132	iTunes.exe
4344	iTunesVisualizerHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2836	2596	iTunes64Setup.exe	85
PID 2596 wrote to memory of 2836	2596	iTunes64Setup.exe	85
PID 3300 wrote to memory of 1040	3300	msiexec.exe	88
PID 3300 wrote to memory of 1040	3300	msiexec.exe	88
PID 1040 wrote to memory of 1668	1040	MsiExec.exe	91
PID 1040 wrote to memory of 1668	1040	MsiExec.exe	91
PID 1040 wrote to memory of 1668	1040	MsiExec.exe	91
PID 3300 wrote to memory of 3640	3300	msiexec.exe	92
PID 3300 wrote to memory of 3640	3300	msiexec.exe	92
PID 3300 wrote to memory of 2192	3300	msiexec.exe	93
PID 3300 wrote to memory of 2192	3300	msiexec.exe	93
PID 3300 wrote to memory of 2192	3300	msiexec.exe	93
PID 3300 wrote to memory of 4796	3300	msiexec.exe	94
PID 3300 wrote to memory of 4796	3300	msiexec.exe	94
PID 3300 wrote to memory of 4796	3300	msiexec.exe	94
PID 3300 wrote to memory of 924	3300	msiexec.exe	95
PID 3300 wrote to memory of 924	3300	msiexec.exe	95
PID 3300 wrote to memory of 1584	3300	msiexec.exe	96
PID 3300 wrote to memory of 1584	3300	msiexec.exe	96
PID 3300 wrote to memory of 1584	3300	msiexec.exe	96
PID 3300 wrote to memory of 1140	3300	msiexec.exe	99
PID 3300 wrote to memory of 1140	3300	msiexec.exe	99
PID 3300 wrote to memory of 1140	3300	msiexec.exe	99
PID 3300 wrote to memory of 4188	3300	msiexec.exe	100
PID 3300 wrote to memory of 4188	3300	msiexec.exe	100
PID 3300 wrote to memory of 3636	3300	msiexec.exe	101
PID 3300 wrote to memory of 3636	3300	msiexec.exe	101
PID 3300 wrote to memory of 3636	3300	msiexec.exe	101
PID 3300 wrote to memory of 1016	3300	msiexec.exe	103
PID 3300 wrote to memory of 1016	3300	msiexec.exe	103
PID 3300 wrote to memory of 1016	3300	msiexec.exe	103
PID 3300 wrote to memory of 4360	3300	msiexec.exe	104
PID 3300 wrote to memory of 4360	3300	msiexec.exe	104
PID 3300 wrote to memory of 4360	3300	msiexec.exe	104
PID 3300 wrote to memory of 4572	3300	msiexec.exe	105
PID 3300 wrote to memory of 4572	3300	msiexec.exe	105
PID 3300 wrote to memory of 4572	3300	msiexec.exe	105
PID 3300 wrote to memory of 3916	3300	msiexec.exe	106
PID 3300 wrote to memory of 3916	3300	msiexec.exe	106
PID 3300 wrote to memory of 3916	3300	msiexec.exe	106
PID 3300 wrote to memory of 2828	3300	msiexec.exe	108
PID 3300 wrote to memory of 2828	3300	msiexec.exe	108
PID 3300 wrote to memory of 2828	3300	msiexec.exe	108
PID 3300 wrote to memory of 2424	3300	msiexec.exe	112
PID 3300 wrote to memory of 2424	3300	msiexec.exe	112
PID 3300 wrote to memory of 3152	3300	msiexec.exe	113
PID 3300 wrote to memory of 3152	3300	msiexec.exe	113
PID 3300 wrote to memory of 3152	3300	msiexec.exe	113
PID 3300 wrote to memory of 2356	3300	msiexec.exe	115
PID 3300 wrote to memory of 2356	3300	msiexec.exe	115
PID 3300 wrote to memory of 4892	3300	msiexec.exe	116
PID 3300 wrote to memory of 4892	3300	msiexec.exe	116
PID 3300 wrote to memory of 4892	3300	msiexec.exe	116
PID 2836 wrote to memory of 5064	2836	msiexec.exe	118
PID 2836 wrote to memory of 5064	2836	msiexec.exe	118
PID 2836 wrote to memory of 2132	2836	msiexec.exe	119
PID 2836 wrote to memory of 2132	2836	msiexec.exe	119
PID 2132 wrote to memory of 3536	2132	iTunes.exe	121
PID 2132 wrote to memory of 3536	2132	iTunes.exe	121
PID 2132 wrote to memory of 3536	2132	iTunes.exe	121
PID 2132 wrote to memory of 4344	2132	iTunes.exe	123
PID 2132 wrote to memory of 4344	2132	iTunes.exe	123
PID 3536 wrote to memory of 1840	3536	AppleMobileDeviceHelper.exe	124
PID 3536 wrote to memory of 1840	3536	AppleMobileDeviceHelper.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\iTunes64Setup.exe
"C:\Users\Admin\AppData\Local\Temp\iTunes64Setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP521.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files\iTunes\iTunesHelper.exe
    "C:\Program Files\iTunes\iTunesHelper.exe"
    3⤵
    - Executes dropped EXE
    PID:5064
- - C:\Program Files\iTunes\iTunes.exe
    "C:\Program Files\iTunes\iTunes.exe"
    3⤵
    - Checks BIOS information in registry
    - Enumerates connected drives
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
      "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe" --pipe \\.\pipe\311227611437011114121642132 --parentPipe
      4⤵
      Enumerates connected drives
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe
        
        "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1840
    - - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe
        
        "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1652
  - - C:\Program Files\iTunes\iTunesVisualizerHost.exe
      "C:\Program Files\iTunes\iTunesVisualizerHost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7DBB28176605E28B41CA39244B837B3A C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\IXP521.TMP\SetupAdmin.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP521.TMP\SetupAdmin.exe" /evt E323 /pid 1040 /mon 780 796
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1668
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8CE45B3A64493C38A86CBE0AE143CEE5
  2⤵
  - Loads dropped DLL
  PID:3640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EEA6B914A81DD70CF61B44F962B44729
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2192
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F91B64F67B8DFBDCF37D6F0567C0F23A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4796
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:924
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0045793DF53CFD0F80FAB0BCEA379655
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1140
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9A1A43A246C19E26688D619FFACCC0D1
  2⤵
  - Loads dropped DLL
  PID:4188
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4151200334E5FD17213989FAC5DBE194 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0EFA1D01AE1502515B8BB805087B7F7A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1016
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4360
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4572
- C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
  "C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" /RegServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89E5AD067194BA1D2740B9A26B0A8AC2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AAE6DDCA57CEC945A720CBDC42F2851E
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8A1B0EF9D4BEBC11AC8017AE92CAF78C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3152
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 536E33D4884517CD7CFCA3FC21DA4A07 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2356
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 81872C6D28255EF2072E4F9AD76CC005 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4892

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:4460

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:920

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{16D99191-6280-4B33-A2F5-04805A0FC582}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x338
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b28a.rbs

Filesize
126KB

MD5
af280708ac248448e6727b7dbccb0b19

SHA1
4db49bc82c91a7ec31f78a7cbb79191fbd8523b9

SHA256
b208055a598ab0cb538f746827095a8d470c2ee1f46fedb6afb990a606982401

SHA512
b80b3e526009b809eca92fca717d0421adce65c02800b2ac2e456c0f4a1df72c781afcbcec2ab7843c48ed23fd366b12deb2aa9cc814562395ad47a172c28959

Download Submit
C:\Config.Msi\e57b290.rbs

Filesize
332KB

MD5
38adf470f6486640fcd62e259c55acc8

SHA1
a16c98bb4f1e0edd4b90c1f8c346c90e09c27a0c

SHA256
055fca86186d8ec6389b3580cdeb1bdeccadb042e9fbb3136e7b34df497ddbc3

SHA512
4263c9da87f7c3ed1d6e925150601cc2f838d71bbecc1d11bc573263fde2c213833612ddc89ea6fcf251dc3e126f93d75bc6a6e1bda0cf326b7bdaaa1a28b40e

Download Submit
C:\Config.Msi\e57b295.rbs

Filesize
167KB

MD5
31436c588cd2afd3b12b283a3bf85215

SHA1
4950bd95226d6763903e173a8a753a2f0bcc5e4c

SHA256
6a2bbc8f75981083158e844fc18572435d75c737ae1b2b8d09174d1bcf65c42a

SHA512
fef093e163a352f5e77deb69b1dcce087d69c04bcc32a9cd9fc8563616c246ebeb7eaeb8e670b153c1f1114f9e1e04c4903ce4deb384b134a050165ee038ee53

Download Submit
C:\Config.Msi\e57b298.rbs

Filesize
1.3MB

MD5
7a91d379eed90e005556ee64b30d17e2

SHA1
07355ea471a8036b6c9d43adfe8dc1ca0fd6ba50

SHA256
cbc0212aab172617c640dd1da5128b970a6e510919117bbfd0a67128c7547c34

SHA512
f5ecf3759584a71a87e1ad492a33452ee4cf45880b80a7a551fe84d7fe5cd81a889de9923dcf68720e37d093e6d47897aaa7abd90bfab9e2ed580130190f4369

Download Submit
C:\Program Files (x86)\Bonjour\mDNSResponder.exe

Filesize
381KB

MD5
5ea9c80f18cbc393ea7d9a2991ded4b5

SHA1
b8917c5ae45d1ba5ca534058f1386fac92f5da63

SHA256
7e5eb1ce44febe93686174058d51581fa00bdff0ebb84bd74bc08f6386019253

SHA512
7fd949b792a40630ca385dd2bc88db9673f9106975b9f55481e2382f67986dd75b03cdf0fbf59846b513a8def0c506ac6561f6ba658775286f11d761b575513a

Download Submit
C:\Program Files (x86)\Bonjour\mdnsNSP.dll

Filesize
119KB

MD5
f6d02735de16705c1ebe6429592cd355

SHA1
c6ee693de2c01cad34012471b70d87869969a0cb

SHA256
356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4

SHA512
1e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13

Download Submit
C:\Program Files\Bonjour\mDNSResponder.exe

Filesize
451KB

MD5
b5c2f92ee1106dfe7bb1cce4d35b6037

SHA1
31070ef84c5355b082873ffc19ff60659637995f

SHA256
e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50

SHA512
7f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7

Download Submit
C:\Program Files\Bonjour\mdnsNSP.dll

Filesize
130KB

MD5
eaaa2b83c4764fdcfbee4a4d6546de92

SHA1
961a7e7735ee8f07ca54fa7cbfb23399748f8174

SHA256
043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

SHA512
bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\ASL.dll

Filesize
78KB

MD5
4fb181e09e6325ab98149215bf5aa63e

SHA1
7f45abb4e51034c540ef3bb3dde1c4b7b9ba9c48

SHA256
fc244a5316e5af521f6188115090b5ed22d8ca3f3d7f7bfbd53d0cbbf27ab341

SHA512
edd93632e87f9d84f7bdeca6f6e87f911b02113eaa8fd9d5de2c397dc121ef9874ac5630fcb05a7ca7ca07a8186fc267ec67016a5358c77ffd124130de3fc3e8

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

Filesize
101KB

MD5
a35ae6e8eb7515330fc26f175b446899

SHA1
abe0def23d63bb18dc5b31adf5da4262fe7bb184

SHA256
54f818f41afe91b77787731b45776eacfd33a9696e47f2acbb8069224efe9b31

SHA512
1d0f928be1128688edc949429006ff9e099603680f1f179928b62e48bffa2d07168784edd0e52a14db8d5d1d76b9bffa43b1ca38d00228fcb6600133df4a4e74

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleVersions.dll

Filesize
28KB

MD5
888382a6b44006c5b81905944d04a3b2

SHA1
bb5260b3daa737025fecb4ee7c4a56a69329dff7

SHA256
def4e62bdec8ed09b0a6fbe28fd1d9017236a82ae013f850b113e7d9ede295ac

SHA512
e67249c4c22fd80ea508f24bcb03ed72c539ac61a424132a9b08a776edd2cb88c6c70c305a7ec310f22c41cec2c315629055439c8198639acc665c58e4dcd294

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\CoreFoundation.dll

Filesize
2.1MB

MD5
5f4ec9c2c1cfa04d012c1b43d791f029

SHA1
66905957255241f79273c960e7745050eaca15ae

SHA256
5fda9c96ee55d54e9bef2d3ea0c8102a3269b73742388ab07a030a9756145b7e

SHA512
2171f8893a32a67e8f4034ca1c470f6e83fa052a85639c530f27a2e4986553e08306e7305726dd42cf728942c0da4b4565ab197d7e4dac2169f1014f49f4c646

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\YSCrashDump.dll

Filesize
45KB

MD5
60388bb22e35f5b3b080c5126da4b8a3

SHA1
bfc477544ce3b0416644ef2fdaa1e853b0a51a98

SHA256
44e81cf4b0733898441c84ac65c05c3d3c028b42a46abbadd9f899b290f5e922

SHA512
52519bec5f591fb1ecc737d11a8f4ef803f83da516ca5eeccc4f3ab023ce13fa0978439fa7dc115566ae154a0b7c8ee7c3b24a1042226c5b2beddf55ff78e360

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\objc.dll

Filesize
231KB

MD5
277abb137376a7aaad701f2795d64ea9

SHA1
065c9c2371bd9645f02a3c387a78af77c4df25e1

SHA256
82e2a33dd8a44f48a684a87ba8bbd6b5126edb7e87f18ba1279c09a5e12073f2

SHA512
0564d7372beb2b437813726b1b50dff37b2f12dcdef5382cdad8328e2d4d6ada0fc687ce2dfb747fa5e24d2ac52b9bc95a102f597f1c03acd3fc005ade176ec0

Download Submit
C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar

Filesize
17KB

MD5
ce9a2f5a7fcfff341d6d901ad919a2ab

SHA1
341f9d9a0b3fd8cfbefe0169b148dcc55688ee93

SHA256
cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7

SHA512
1f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f

Download Submit
C:\Program Files\iTunes\CFNetwork.resources\en_GB.lproj\Localizable.strings

Filesize
22KB

MD5
11d00b701160c1244899bc1647e3b756

SHA1
866c9acf31291a1459e6719dff2764af41eddde0

SHA256
47be7f1aea7eba3fe98080713b1c4414ed5018aee75ee7f6453ae2ff95aa76c0

SHA512
f1e8727fa33b70bd146d71aa782ef8000b6824c06b936b7584057ca77cd082a001398bc5ef2202e12b50bd86687f3a75ba3a6b028d14c7ae3d1a21d868cb756b

Download Submit
C:\Program Files\iTunes\iTunes.Resources\ar.lproj\genresLoc.plist

Filesize
236B

MD5
093deba2a9db087a0cb01a676bff1c9b

SHA1
9c7d3070d1fef593731dacdde8cf38e7f96962ab

SHA256
2950ef6f4409f89b8513f2bb787f9070c2983b698b35b678088c59cd83246bce

SHA512
dc3860ac3d87ad8f28988b2c7e694721757a43367ce6a1333205cf335de1c29e739a8468a70bc305a60c4d0587aa062fe01f3762d608c9bc4d76867f2d381c1b

Download Submit
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\[email protected]

Filesize
5KB

MD5
236216d5b66e7e9f48715b953b465c56

SHA1
7ad8425770aeb398922005b2649c4764c5b6dc5f

SHA256
ebdb9147c9b509b923fbb4e1e7903c84f67b42542b0055b2f8356a16c456191f

SHA512
6da4821957d52ef729cee2c6436f75b8581b702efeced430e99abc81be11f8cd2f2b2c374a88d68ee177b46b0cf34f723341a78d642dd4c81a8b5f09e8c77bd1

Download Submit
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraGridView.png

Filesize
4KB

MD5
94eae9dc7a205de2ee0a17effa21b60c

SHA1
54f23cb71ac3a62680bd22a3b2b8ed5c6c86d5a4

SHA256
a33f1e4d73943a77e6471143d263aaa53a871f7534e27435beeea19e75c82fbb

SHA512
5601cb432d92697a630dfa9c5403b7ff1210f517c51eb84a4036d7c14192af287eb86782a8036b0da72ff39f827d118d276a43cfdc0019f40b85147948d3d99c

Download Submit
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraListView.png

Filesize
3KB

MD5
5e93c7b6af1f907359091cd0c629b3dd

SHA1
4aba4ecd7b1b5d7937e7c7faaf7ac1629c0394cc

SHA256
b21d24670a44bea7c5c86c2b87d356e66006cfeaebb8e6b7d4ebf07974ac3f66

SHA512
492683e196bceb4f80d2bf07dc9031fd8f1667b0d8e3da877df1666bc419276bde0a6af8a1dd983a0b5594d5e0143eeda09ad2b87378cd221fbdb3e45291772c

Download Submit
C:\Program Files\iTunes\iTunes.Resources\da.lproj\[email protected]

Filesize
1KB

MD5
b8f2462ffc91bd1956cb2607c1c9df31

SHA1
b4d4a46fd481f23268fce6b63496e753ec1c8a25

SHA256
b58b3ac76194b282833d971e2e2379cb25e7149f29f4a585e9405daf810a3d50

SHA512
6814101aaa72a241e4f9d37594c666016a36bd4d5e5ef50623e23590ccf94bac80d2b8c062213b557ebbef5e007fe0400ed9c84422df8f5a5486d2c9bc4516c2

Download Submit
C:\Program Files\iTunes\iTunes.Resources\el.lproj\CleanLyrics.png

Filesize
3KB

MD5
357922d796c4ab56acb274ec1c89ed4b

SHA1
4f29801424d33877426dc21cf02bdbabaa321120

SHA256
66e1fc581446d80a7f64afeae19273cef7d6a10001e3e7d3127ade5842c754ff

SHA512
e0c7b23cec3ba61f83ba3a9675ce078d4fd36fed08f8e1c20be6e9b7891c1d4175e5ceca9ec3797419b22806d82d86fa4fbad314565d000a36fbe92905c9e36a

Download Submit
C:\Program Files\iTunes\iTunes.Resources\en.lproj\[email protected]

Filesize
20KB

MD5
498055b7ec8f362e71a988ff8c79b517

SHA1
4b28c12932e86c68c7acea45303be3900bf987ea

SHA256
065261151f732d9f8391b0bfc00e71d3dd8e47c84331aa94b58e295782d74a30

SHA512
0b7c4dd87fed1ec01b14334e129ac43c598c30a1141bc9831f7b0ad106704072112b36ff4688520d675eb72652ef6a1dc349c95f55f6a59a245c5c151771f0f7

Download Submit
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\[email protected]

Filesize
4KB

MD5
59d4281f0f7f665c809f2a68434999ff

SHA1
1c71204e311646a1b367860c0de11ea5e60e06ed

SHA256
57b642737825507373c0b192e3431f7a15848c1fb061b51b262b8d2438551e43

SHA512
e38edd4b53f950b8c3202552d38a6a56ee726a239527a1aec064b9a3a66f06a3aced67c0b6bc3c240994d006d8dbd5f2e2ec67bdd4e76c181e9331891d1d0154

Download Submit
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhone License.rtf

Filesize
46KB

MD5
cb4f512972b12e3b783e89704cccea3f

SHA1
e64cd7091224e3449e15e4ea664aef256534183c

SHA256
b636c8c51b01fd142af1134448763dc526041f3fbf635e841b0c2882254d64f4

SHA512
8b9abc21f291f53ae89b16f1cd9403bb881f9fa9140cb919e0fd5f4ef8544dca0359b7d5e45f54e3ff74eeccd4d9f0b62494992a58c6e230e4467015a1092988

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE.png

Filesize
538B

MD5
30aa67b32a3542874bcc88e146e17b46

SHA1
6d86b94d2c71ae27504ce8b3ad000fa4ef532a6b

SHA256
2ece6d0b0fc97dd6deacfdbaef44458a4b96e43319c78cb74c55d4f7ea79d9b6

SHA512
dfd082a54a13c5d2fdfa66ee9db8c893bbc6b32108308727665267f0a9e9fa9610c174082c0ca7a34832cbba768a1e2d8f6218b4c5a538a328a6159be05f3cc3

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE_dark.png

Filesize
222B

MD5
ef859a036759f6f29c3dc14928a75c76

SHA1
45f8c4450757f2ec653ee0845f5ce497b6832598

SHA256
c5c8219de48b954849bf19b716dbba8358c66b02836417d8d729dd2a672935c0

SHA512
93aae547f72edf6c466b4f6c1a43f7f0fe0393cc7f7ea87818b462a4938cd86903017a12cf4eb1f3e05492b312e8826c5fea1935388a168e1f0278cbf3fb505d

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\genresLoc.plist

Filesize
218B

MD5
17d011dc9b1de5a0dbcbe11f5dfa4dda

SHA1
22b3182f41bc4a322f162832b4dfa92a46a71859

SHA256
a0f0336ccbb2964f1b6534fc1a59a04896bc104473812ce0f407496648eaa93c

SHA512
99193d05842ff4debac4d1c1ae772d3fa6424f5c097eea557095a9bbbcec044a18c3557afb1d2f474a2b86db7a8ce24d44d2b70d1c5a989258ad9f70d6561452

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\TextStyles.plist

Filesize
41KB

MD5
7f9f90998dbb72a12f12464fffd40997

SHA1
01a41b41e92271eea01f31b208a2c2b47b496b59

SHA256
503b82910c0a98e3509cdf590dfa8f722ef149390b260068675fae09c3cf12ef

SHA512
7c293a39681c386002107aeb852c15ec8b4acea037f8abcef601cc76380f3487f421d267a6ae856df90b10fe8d032852c3650d5feb36f675a524163314e23a98

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\ViewLineItemUnsubscribe.png

Filesize
9KB

MD5
001e313e3be5e546cb50d86cb65dec8c

SHA1
e7feac3aa8b53b2670077ae0254a2900ac579467

SHA256
59a9ffdd81daf97ceb9e66f1e29b292dcf78373eef8df94038df3845d3e6d5a5

SHA512
26329e02aba9b0ed9295dcdc0834a7b2a75aa05843365490ae0d86f787159967943a8040ab425c10266523e15308c6c52673cd2ac5db7073369bd76c0777278f

Download Submit
C:\Program Files\iTunes\iTunes.Resources\he.lproj\ViewLineItemiTunesExtras.png

Filesize
797B

MD5
59ecde9c26c45850d5d42fefd0a2fad5

SHA1
6bca0dc1fb62c293f30bd7880d91cf96835ed4e9

SHA256
2f0e9c34845db2353f8798bbd7ec23ef4fc151cd61b3383b0a3280b7de78309c

SHA512
9b9744414188aacbace2bfa37561266f7aa6426c6e61bece4990601f0a57c7c41302dcefe1757e3da86947baac2ebb06c266f18108448ccee41d205680822994

Download Submit
C:\Program Files\iTunes\iTunes.Resources\he.lproj\[email protected]

Filesize
5KB

MD5
8875b575ec840a83ede84ca27762761b

SHA1
7463b50c8483598dc6ae4889633a11edfcd3a5ad

SHA256
6529e898923292f4163ad09594682cb7fa1c32c6c71baac0e4405d9996dda509

SHA512
9af764d681309781353504d270d78ee59798154c94292e8eb73b07e78f077a52cecc9523ee088d68fc08de353541c6ed34fb2d73eabd1316e638485ceec6a6bd

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hi.lproj\RatingCaution.png

Filesize
3KB

MD5
22b6a916115477a43ce634ea820a6304

SHA1
a34138e73bae3a62d745171d62f9f05a6dc07276

SHA256
138d6ca25775eee1f0ea7001f694a5b286224372aa168a09578a1a9af7eb76bd

SHA512
97502dcec76353fd69ffabf398b53777bde50d08cc998a6213410596fc42eade86f717eef60bea0d5a4f193fbdd18b33f09fe360b043246b9c96d3316c7a0347

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hi.lproj\ViewLineItemSubscribe.png

Filesize
8KB

MD5
d4eda1881d75dbd2b0d9336e9a5108da

SHA1
fa2264a591a47e42b7cd581b9e0a3ada33874746

SHA256
a9ccdc7553e6cf9095d3760e88a3c9f76c0817ea6596337f21ae748828ce3532

SHA512
4a953a46684569c02fa447f46ebc5d8c8445a045703f36cc17df708eb53b2c324bf83c4c71a72f35d96f4655e5159b919f4eb631df598d4888d40a73d675f527

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hi.lproj\[email protected]

Filesize
28KB

MD5
7676be0b698ae5a36b25772f547142bf

SHA1
4f5ab9344fc8cc6de692bce6881878185b96bd4b

SHA256
946361d40f1b68a0cc29004ad4f55522c648023004e6adc9975e90b6e382657c

SHA512
09f77f33a281a5d4ab712b2f43f01da729085cbc27a973c8f34e3fe0cab1fc515f9dbc45ef35ed9d0a04aa76cf26e98d0c78e8b1805f12560e2866239bb9248c

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hr.lproj\[email protected]

Filesize
302B

MD5
5132ff3c2935630e2f54ccc9a360b742

SHA1
58a0b7d8667d625d8e0c9267bfbab88551c6524a

SHA256
5501b7a0c2af99684fb58c1acd227fe53bf07f4028382aca136607ed9459fc8a

SHA512
816d16f9b37c52f97a64a5a1f4c4b6c1bd2705231703416c7713212e1cca2753e3bc5e3352439a0cebc89a5ba0de584edd1183603cd387e7c7fdea1f023b1f85

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\[email protected]

Filesize
3KB

MD5
02185d025965988b87c6b4748cdcd745

SHA1
e110b97b7d669361a0f2a2cc38c4a62f3d5deeab

SHA256
ce8aa4cf4ded795fbf1c10fc881978746ce6c76f13accf566e7ba0e98f5af774

SHA512
f1b6617eff4a584a760c24423226c844e2ceec8df8023bc9a53da69b18f76d2226ad24d0d1b2bf61cb2da9711caf4c23ff7905298edb309cf771cca1797a2c48

Download Submit
C:\Program Files\iTunes\iTunes.Resources\id.lproj\ColumnWidths.plist

Filesize
18KB

MD5
8490f8bf0576147ba7cd139446e6cf20

SHA1
48a557825885bea1a6afcb662b07113e99a20136

SHA256
bf81225b2c30aabab43beb74142693ba800af85f88025446aaed2dcfd5068ffa

SHA512
86f0896fa6ad25a9550cbb3d0746eb413c86832986165e0824eadd917bb902b1f13c9aa60db78d477c3c5921fb7fe1465025765429b6a5a7e638da8063487753

Download Submit
C:\Program Files\iTunes\iTunes.Resources\id.lproj\[email protected]

Filesize
5KB

MD5
11b4d45789544050871f75c0fb3b5e3b

SHA1
3362722a15fdd5a67d0c7e1c643c64a3630e89df

SHA256
f03209b2a8826502acf29e9769c73e1fabb923f4ac11057299cf8fea57a13def

SHA512
51854f9a9961224dac3fab303d2e39e0a30d3f52b9d5e561dc07c69950733e6a9c6f585e001a3f9453fe0a7932a74e9b53fea0e87a691787cd11cb009017a794

Download Submit
C:\Program Files\iTunes\iTunes.Resources\it.lproj\ViewLineItemRatingC.png

Filesize
261B

MD5
71062ebf3a5a9b5c578387aabb2e7fd3

SHA1
410d43bb43f7ddc7ee7cc225963303326485bc0a

SHA256
5c751b7f4b96d07b22971ea4977566ed88c3297ab7d0b2853e7e9baec00be1a7

SHA512
0ad45440a3e77a4ea2d1ebc8531c91fcd663e596a90f5cdf1d0a57384c54d988c0759dff51f5231d973f9886c80c16feecfc16da84579a0cad53ba70b984a865

Download Submit
C:\Program Files\iTunes\iTunes.Resources\ms.lproj\ViewLineItemRatingC_dark.png

Filesize
241B

MD5
b52bc951d0c8f8dae4329368388dbb76

SHA1
ae408ee6f2d946aaddb8be466f7de2b99c7c4c58

SHA256
befb8ccb14ff090ad56345786c9f367a8cb2d14516ccb52dcda123df5e5dfbe4

SHA512
144de7bcef6fc1be493229c84c2038e2c6b6719c5ceba95d7abbc14539c5222a3bd1e65eb00e0c0f3bfbe6e0be4ddbc9d2876dcfdb9f1b3372cd3361d7f58d98

Download Submit
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\[email protected]

Filesize
948B

MD5
c6beffb1568071b2fab6f19bb9c875c2

SHA1
137ada0e83cce6b784a8d4f345430c28d61944a3

SHA256
f1b5cce0aece4f65441bb7cbbf86155ad2d4e90b8bbba8252de985ae02d751a5

SHA512
a1e811646642fbfd11ae794e7c764a3bff39e285f1724deddbf9ed516cfa7929e8ce10611b9d0cc11f6c1944728f4aedca99df5badc72f2878209c3d24b28758

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\SortPrefixes.plist

Filesize
310B

MD5
e4f62c535e191b6d40912f32c60e1eff

SHA1
37203bd8a250fb9b7471e1a4b8b2dd4f727aca2a

SHA256
800cb75b9347c5142edc9094c9c829b10b6a280271f19e8ef3b4673a1cc48484

SHA512
2b64834f62de68efc971bf59e36d7cc0a29c3e7dc4c2c987ae6840488f6fb94e88ca73276fd0968f2f6b68d427a5f87a97faa0821f0cefb533deab38a58f3630

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\[email protected]

Filesize
9KB

MD5
010e5869f100573199acf50905ba17b3

SHA1
da950fbeb52dea27dc393ad4a113422238bd6002

SHA256
f533c5ca2a6bdcd1a9c7f757c0c9a17d894b2717c3493bd7ced8f36a722eecc3

SHA512
83c30c0291ce0540a41f07a6566eab12b784efe5a7a8dabe29dee67fdfdc0e53e89026511476d0abd46a267bda76e179892a249be46619c7b6fd621d1ce753ca

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ParentalAdvisory.png

Filesize
5KB

MD5
d947d2a1018ae12438bc118af0a04215

SHA1
c816253a5341d804712b8fe00967cbc887f99907

SHA256
041204ca5fb90b0d19d0f8b5bae858bf4022d9c794990e8fa4a0bc7eae093ed7

SHA512
bf7192cd4f137311d4696a0dfcb5fec66df5ad45e301fff3f8d4104163b0c64d8abf2b2d3f4100802f75aa55b435cc890005d5836c1350702473b0359add46a8

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemRatingC.png

Filesize
662B

MD5
471584f30a8dbce0f8e4ab7a781d3705

SHA1
1d4ec7b6ad3ae1ccd48056c84d05f2d684db85b5

SHA256
ec0e0c2e51cf0c587bd8cd8842682ed78becd0cdb76ba06cb1c8cc1d98c710c1

SHA512
b6370cdbf9430cccb041c21641409e43bfd2a1b78836ee38fd0a706f26623ea1cc84e645fe6b501fed06b4222173055c101bee5de2cdd012c0cf5451cd3031d5

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemiTunesExtras_dark.png

Filesize
622B

MD5
589bbd384b604e83cadeba1d59f8fd90

SHA1
ee6fe62fb935e9f1007f31eea754e3cdc315d022

SHA256
096343c9ddc34fead4232f182085ceba66907446657257969f3916ba991eb58d

SHA512
369b8d35ee411971f1dfd02fa065ce2badca714a0046cd26d098c15a8f55185178206516a62de59f81bfd285d4a8804a29b64d98f51f4e4a543bdb2eea993736

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\DeviceCapacityBox.png

Filesize
10KB

MD5
8246496c258d58712c0a972bece0d69a

SHA1
65f4a403895354702552e2769cfe7f480a70ea6f

SHA256
f930036e7cae52b4022d979fdd6274d8604ca4c7e6f14495223dd78c17bc19a7

SHA512
b1dc4bfc186762e414ece274b158f10fefaa86ec373c732c804381733a7c17cd56e27331ca7381e7e9fb795c04a4a09ac75642684f36f99d4c2ae2871dd8d447

Download Submit
C:\Program Files\iTunes\iTunes.Resources\ro.lproj\[email protected]

Filesize
1KB

MD5
6cf4cedb6b5148b103fc91a2d057888d

SHA1
23e873c7d60c21248eb9f8381643a295dc4fb12a

SHA256
dae1592358924b99a4363cf20fc4a6dbcaeffb5af2f7a248a0fb687e95336597

SHA512
4847a96925aa568c6d523f84e760b35d0f4abad4b6df70c3ed6003289b776b3327bbc41dda3da96221113e41b0097a2275db5bc562c77117db6c04e4275fc583

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]

Filesize
25KB

MD5
784f871663195e678f524f4aefccc28a

SHA1
ee8a70134370ce17ce49bb31e92cff252958d202

SHA256
efab63103f90135001658bac9c8724da424e81fc05c9385953a7555c6ce1ace3

SHA512
7e1b0f1f74abd674b09443b835da35b9b1855a0d7ac15e60670c6d3ffa1059fb13ccc579f069e444d073be0da76b65b4dc1d517c2ffef654a99ba9143fda6f7b

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\MasteredForiTunes.png

Filesize
2KB

MD5
67f1b4232079935a9998b0395a6b7c10

SHA1
ac4bfc88ed92cb526720f9cc9b4a377ae6a7a787

SHA256
95f0affa39a202e292a5f630a2524c8de31b6478304e040ef06488d9dd1e9f0a

SHA512
410e56ec048d2033e7e05202fc09575758d5c5e441146bd89070106108f1332e3ed3b8868238c78f18c0d641898607ecf1c704f51234d741f0693868966b0219

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]

Filesize
8KB

MD5
d9eb252906d8d98e592ef01034a94c76

SHA1
5fd847136846bba1957e2ace9e1d3ec482de2e5a

SHA256
6f231775671c67eaa458a6a2d1405f3e5c52d56882f5620aa435166f4bfb7529

SHA512
7bd132759532496ca864cfff7ad411ff48e3d2a9ab28e3b50afdabe5782d853da52a09f093b25c0d7c60906ce42ae8a28634df363fc6a435962dfdf3ae9faa71

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]

Filesize
1KB

MD5
e85fcfa0b73018404b29d4fa04f047a8

SHA1
2c7ba150c3fd101231563ffec9a7fd5ec5ae02a0

SHA256
55617519bf037182dc93082300e162933c3771996607aeb605079bb834a182ef

SHA512
141c92030b58dea61e29020b1792cc2a8dafd306af2a9130b105721a026b81a05d0d1621d4a76f6b6e5509dfffd47506885579279b6a098130b542df60b0f884

Download Submit
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\ViewLineItemRatingE.png

Filesize
226B

MD5
18109ed593d861bd659055a5bd9db831

SHA1
3b2596e909633ca509e857650d7d7c9693987a4c

SHA256
1c28554bca95dba35ce291c0a42e0810e2ceebe805d63f916b6b7505e057752e

SHA512
1b8bb8ce363f7b5db7fe6648f518d0d528cb47bc90f5c80e66d8928b79f7912879b1c35ec6944d9ff91cb70c84547b9e46758cdd315e299453016da3cc24bed9

Download Submit
C:\Program Files\iTunes\iTunes.Resources\vi.lproj\StoreBlankBuyButton.png

Filesize
3KB

MD5
ceeb4e2a8deb651b69a973f5d671d92f

SHA1
3fff59aa350cdd2cfea69c08b55540b63122bf26

SHA256
51edab4204721531caab3a704e86d54445db4b4ddca70ef2c4b1012fa6bb3d5f

SHA512
9112040b761b90b93e89249986e6e75d55038fc1537293d7eadd02e181effd601ea15aff7a3100cf2c72de610b8b4cfefb433ae8bd75499e4a3dbbccf8410493

Download Submit
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]

Filesize
386B

MD5
ff602a53d097a0d42fae257d6cd2fcac

SHA1
57ed476c7c88b7c231ec9e4d6acbd5c04808d78c

SHA256
8acad76c6c4eb0c023664b845a7492adc2e418cefa48aba7e99496125a06e5cf

SHA512
a5f0d07314040fdbc614d09e2d38bf87ad0a1286c472f8c7403dd488488124e769d436ec1b01ff1b47825455f03aafadcac5722f4367fcdefb13ec3de0ec8def

Download Submit
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]

Filesize
314B

MD5
755eb418266342b17633f1615a1882b0

SHA1
df51fddb36717426da15d38f4edd48f74c140364

SHA256
f5f639656493f65e4a5462f6c4e280fdd54a7a4e839c2c0f52c8b5b1840fdab2

SHA512
8bd4b9879f1899c2a5e5f9de80897882f262252260c69767365634f9a97e281020176613c58a9d22ffcb510f1cce66dcf26903092c455d7b17f951ba0876f116

Download Submit
C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\[email protected]

Filesize
416B

MD5
e14f8e390a9c489b10eb23306d27824a

SHA1
e33831e12fa5092ca15e7d8af7b01afed996b30c

SHA256
0775705d7637f7173ec31f22e324af8160b43d4cc6a47a2f199b3751963252b5

SHA512
63c3e261ea445de5d7eaab326e0168db054b4d953e81f89f16446a1ef5170a96aa32db5d7cf42181f990a8028e9a67764885a6d94f74d1d1c9910dcebc4f8a4d

Download Submit
C:\Program Files\iTunes\iTunes.exe

Filesize
37.5MB

MD5
3c410935b6a9ca42a4ac55393f16765e

SHA1
0c5a9ee50d8d4ee4f9ed76436392a2b4a374d1c2

SHA256
365bdaf6ec16617b73329b844ade31a758d0685849e98960e5b87e1f345740e4

SHA512
25a27e017afe8ef8a02b4ae9303e459e43210e372c6eb9e2687f5368bcb6e3e063e6aca14993a9ce33b6b5520748d351d827e765113f272c07b98173ff1d541e

Download Submit
C:\ProgramData\Apple Computer\iTunes\adi\adi-A0F89D8E.pb

Filesize
430B

MD5
a5c7e0d6d78e9f11a041930fedacc9ad

SHA1
49782bc61ccdcdaba7fc192641d4f4dbf2d25add

SHA256
8b47def062990c28d5b94791104eb99fdbb4106e44876a9e76732aef7bfc2583

SHA512
8c1bf6843783766eb6f1f888ed9c62bdbc2d4c0cc6686310662769a2fce2fc3decfaa9291341dcfcdab2db85d59571cbdf0cc552843f59b3a2cecd30ef581c5c

Download Submit
C:\ProgramData\Apple Computer\iTunes\adi\adi.pb

Filesize
89B

MD5
37a1140ff02f5de386c7e4e442be1ce7

SHA1
098d680198d778b84d87827b5f5cb6d82cf20318

SHA256
d460da734387509b7437e81a35d89c068beefad4a555d042ac62b5bafce70ee8

SHA512
6c2ed066982afa85310656d8263c661ad4a5e7adb09ecad10afb67ad88d9f25cfe68bc2c685aca75afa65898822787a88d53609afd135edd8954f4fd68a9d7b5

Download Submit
C:\ProgramData\Apple\Installer Cache\Apple Software Update 2.7.0.3\AppleSoftwareUpdate.msi

Filesize
3.4MB

MD5
adf71b16f66b235268c5d894bb7c46a5

SHA1
b44a713560477c1ddc0be33bfff1a21cba714bc7

SHA256
0610ef6e01c2ba53f57035545f2c61e85b1bafa6334a47f6de8a63b060f9a130

SHA512
4564dba8763a165b582e0ab785fbf658f50fe07469716d0b840261a8faa9b1b9ffba54cab14f674b46bb22445128a1f56e36491421c8ca0b7dab1d933e0dcbd4

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk

Filesize
1KB

MD5
ee19df20cc07b5d5f1bd71b6654ad2cf

SHA1
a8725535fa42016dae2aa2c83d25f98278a18dfb

SHA256
c8db6ac47d6f35fb6d9c8558d4f13e0259089c9d4bcce7734bd113c50e34d127

SHA512
f40abc7b5b239d18ce1551f07d61ccf5b7191bb9935bbb9bae13c8df53c4225ce9cd73d40e473bdda54c4d1645c6c1e6c7f74744e520f89bb13daadaf007518d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk~RFe584dec.TMP

Filesize
1KB

MD5
ff694dc9cf66979dc6f086c1d3e07ae8

SHA1
fe7cb01e7c8938dca7cba48a4b34f44b9de45082

SHA256
74f2f8380e9cf3d4df6f240d8c14faf90d4c4348da4a539e31e12744b7a8cf83

SHA512
07526099c12db263fc36299a3a843a695a8c10f886a9a10b8355aad9002637c190d2c3b7a5b279b9cb6a54499237543e08ade27ba7f8fcbf1509ca53f5e81a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP521.TMP\AppleMobileDeviceSupport64.msi

Filesize
38.4MB

MD5
b6f02485dd783256c71bde07820aca1e

SHA1
36dc9ba67d1c83c75363d02bddf6189111cf5c82

SHA256
c2d840be0993624825e67c7ed4671be9c0a40733d5a67a8bb19511273c2a49da

SHA512
8d8f5f5962d061a30e4e6ddc32bf05484bc8f0d6728acb1322ad7253ba6a02520f436a79539f8919ae3c8337f5b327a3d9da571b59c9dbfebe562aa2941eb946

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP521.TMP\Bonjour64.msi

Filesize
2.6MB

MD5
86e2b390629665fbc20e06dfbf01a48f

SHA1
d9f4697a6f4eceea24735822cb1df501268ca0b0

SHA256
46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

SHA512
05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP521.TMP\SetupAdmin.exe

Filesize
141KB

MD5
a59a4596d8177e644bb457439d89bc44

SHA1
d24d13b89f06c0dbd36372937aa6a7ac60c6d028

SHA256
942ab8ea84411674ecb922fb0ac6fb5f3277d05aa391e7e97ca88847980da2f2

SHA512
a013e8e3d4963a5afaab7e8acf1d75f3c7f12009e5c71db40007f3542688e744030b8f4918ae496f0f074b4481bbda8e80ed8cb0828a8e36df3f2913f771f56b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9FE9.tmp

Filesize
203KB

MD5
c55d520c7233d73b05eb6b3a13bfdc1b

SHA1
9aef2e4e49ccc29a82ea21ca5903120b0b606920

SHA256
588e3f8f72121e65501dea90295615c1a01edefdadf03d58a4345a8ca6c709e0

SHA512
93d79b700e0f58e812284b0a52df8d79af1299451436df4b10f15ef04f46d3e37d17155f40e1ebe61885b3d0202c5773f78cc6b32f44bbed717eee527807942c

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\ByHost\com.apple.iTunes.{92831158-510d-11ef-99ef-806e6f6e6963}.plist

Filesize
8KB

MD5
e5130374bf7578d893c1bf194fe0c9f9

SHA1
1d23b8eb1783d69b7c8a1330dd7ecc26aa0a4f62

SHA256
1d1fb494e683b4c14c9adf6541d516437817c6fed3ec0f41ac44cab7a5d11928

SHA512
979b2fe1eb19d86f2e8b4997a991db9e0f0ea96e3cd271b1cdd2ce93cfbe480091a2b83a424276e1a1034614f74ffdf4da478b2f88f5520465405ce398103d1e

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\ByHost\com.apple.iTunes.{92831158-510d-11ef-99ef-806e6f6e6963}.plist.Xa00764

Filesize
8KB

MD5
e401c2c17e5104083a4bccb2d4aac436

SHA1
70d9d2e630b75f2c3246741d6517c558ea40e660

SHA256
043678093c364f7eae18f1c33b442e2513cb4474245649a9a9055e5b993fdccf

SHA512
4b844e84d12220446b08728e45e474f77299c6a5af3683119d2d9e2ddcd30e428d329f0720c9cadce059b31e9f347b82bd85efeaac91b90b6adb5b5ed25d131b

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\com.apple.iTunes.plist

Filesize
101KB

MD5
9b882fa4f56496a8bf480a224e879b54

SHA1
35c28e85be59937ac3ce23b214ecfc0ded07b4e3

SHA256
c3273827333afc68adcfc4efa882a161690841c65a43bb2e53dc7159378be7d8

SHA512
21561b042be837dc80c8ade483b993e97a7398417dc5e54b68b3d8d1349ed475c282fc166a2b0d9082d448fcb6275e728334bc583fbdd88c29bc669b349b93ba

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\com.apple.iTunes.plist.Xa00764

Filesize
102KB

MD5
bdbc22b2696fd66d27ee51ca40f391c8

SHA1
71833083d8d3320a87ab8b5d87263519ed09ccb5

SHA256
2f996b9a77d0f5fd8e535f0a3afbaedf8fa4b7bf184fa5ee24545c74cbb30dab

SHA512
25c58c4a7622c28eadec40c13e29e314e48ad677ac8ecee9000ddeb21bd42aafb7300924bd28f34a446d8fe62014b1503fb236fb2d415132bfb44c0ef335e9e2

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\com.apple.iTunes.plist.Xa02056

Filesize
101KB

MD5
7908e1da8220adad8577526ee05fdaad

SHA1
e70a23c269378f62f41174e6d45e5722547d18b3

SHA256
a5c41d40ae10703eb5e22ddffd3e1acd5dcf7d8421e976e7c99360591d527f33

SHA512
0124c1a5603676e5684eafb3d9f0ce3845f784fcc53dc2246a0c02dc5d708ecf40e199e8d4341d6faaaf78a41b6cefe07e0fb96b599dffa66020fc47d1ef3c47

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\com.apple.iTunes.plist.Xa02400

Filesize
102KB

MD5
8c376d427902c421422abf8c8339eb2f

SHA1
f58515c6b6677683f5c90663e80456ae158c9345

SHA256
b0a5166946247d4d80fd6787511e0bb2677a1d5ce6c582033dc654108b35708c

SHA512
a434db03a5f44f4f1fde7a76e84356c5fbc056032a548c27da8cb83e511bc330a136e489ab9849d9f6e50c610a9a77bbc00c71e2b39c0f43a051494352832dff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4136DAADDE9D4A861A8488957E6704754765AA6D

Filesize
810B

MD5
751201cfeab5d5d9aaf1f28dc89b5e6b

SHA1
384f1e44ed4f0f8781a563960bf963bde09dcbab

SHA256
51039567bce990858d204856aea685cc35f11036a3c96fe1ddb92cf55f6cf1c1

SHA512
a613902eff6e0f63aa49eb8c8272d6a6fb74a15d1418a38829d18b4aace1eb66ded986d62a182c38fa2701e8eeaa8e1e65050a5a34a582e7f81a5c4c70d256e5

Download Submit
C:\Windows\Installer\MSI4D5F.tmp

Filesize
127KB

MD5
93394d2866590fb66759f5f0263453f2

SHA1
2f0903d4b21a0231add1b4cd02e25c7c4974da84

SHA256
5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

SHA512
f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

Download Submit
C:\Windows\Installer\MSIB304.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSIB598.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\MSIC347.tmp

Filesize
136KB

MD5
892f11c2fede26be49acdb67cb9715db

SHA1
4f7fd602fdd30f2ce7e4e7739e0e30f2043e618a

SHA256
343c2f3895b3f8194eb37de38941a4da278f7dd8cdf641d51da00140895dbce4

SHA512
34084e795f5bc0b2372108d761875a39b07fcb759b28bf8e4598806b0fdba756834dc204a958ad54da71d90904461147e88676b46409e330b711990bb1db42b9

Download Submit
C:\Windows\Installer\MSICEA8.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSICF26.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIE758.tmp

Filesize
133KB

MD5
928f5dc7a304a78d8687b16618ae7808

SHA1
b75a22cbcce356cdaf39ad2315ac8974f4ee62d4

SHA256
d1727467b076e59abc58fbc6a4355a9d238fc5b1842644e33a0f920aab449e28

SHA512
c85167a58195261cf71c528e4877618fc7183fe04284abf7cc1b50bb74add5bff81d53371d881771bc96302b0be35c2aad9696a7cb3292c3c3ab3cb8e4712900

Download Submit
memory/2132-5199-0x00007FFA08920000-0x00007FFA0A38B000-memory.dmp

Filesize
26.4MB

Download
memory/2132-5198-0x00007FF674000000-0x00007FF6765E0000-memory.dmp

Filesize
37.9MB

Download
memory/2424-682-0x0000026451A60000-0x0000026451A93000-memory.dmp

Filesize
204KB

Download
memory/3916-658-0x00000000025D0000-0x000000000260F000-memory.dmp

Filesize
252KB

Download