12a0e9edc888f98e9faee998e74414503b20dd1cf16f9b8c08326f67474207ef

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

itunes47.exe
Size

20.8MB
MD5

2695b6ed2ba81b96e42f014f635d8110
SHA1

baceea19b435d2a6f7bd4506822e30deddaa331d
SHA256

12a0e9edc888f98e9faee998e74414503b20dd1cf16f9b8c08326f67474207ef
SHA512

b0d74d3dd525c2870106c755d3bf22009430aa26063371f75e064d6a6f68ecb0d43bb08ab1b80e0e1f56b69c7ceb90c3c06c00cd5d02f6adc869a15e3b555820
SSDEEP

393216:RhhSMUiqDOi712u9GKkRQ6Y08AcyzyguPdehlO18bcyWBI1FCT0e4/iQNv:RSMUdDOi7NtkRY088zhQdSlq8gy5cmNv

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\GEARAspiWDM.sys	msiexec.exe

Executes dropped EXE 11 IoCs

pid	Process
1080	IDriver.exe
1052	MSI4747.tmp
1784	QuickTimeFullInstaller.exe
836	QuickTimePlayer.exe
2456	QTPluginInstaller.exe
2616	QuickTimeUpdateHelper.exe
2416	QuickTimeUpdateHelper.exe
932	qttask.exe
2592	iTunes.exe
2864	iTunesHelper.exe
1752	iPodService.exe

Loads dropped DLL 64 IoCs

pid	Process
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
2908	MsiExec.exe
2908	MsiExec.exe
2908	MsiExec.exe
2908	MsiExec.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
2340	MsiExec.exe
2340	MsiExec.exe
812	MsiExec.exe
2340	MsiExec.exe
2340	MsiExec.exe
1052	MSI4747.tmp
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
836	QuickTimePlayer.exe
836	QuickTimePlayer.exe
836	QuickTimePlayer.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe
1784	QuickTimeFullInstaller.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QuickTime Update Completion 0 = "\"C:\\Windows\\SysWOW64\\QuickTime\\QuickTimeUpdateHelper.exe\" -uninstallwithapps -destfullpath \"C:\\Program Files (x86)\\QuickTime\\QuickTimeUpdater.exe\" -sourcefullpath \"C:\\Program Files (x86)\\QuickTime\\TempUpdater.exe\" -atboottime \"QuickTime Update Completion 0\""	QuickTimeUpdateHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iTunesHelper = "C:\\Program Files (x86)\\iTunes\\iTunesHelper.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QuickTime Task = "\"C:\\Program Files (x86)\\QuickTime\\qttask.exe\" -atboottime"	qttask.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2800	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	IDriver.exe
File opened (read-only)	\??\Z:	IDriver.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	IDriver.exe
File opened (read-only)	\??\N:	IDriver.exe
File opened (read-only)	\??\V:	IDriver.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	IDriver.exe
File opened (read-only)	\??\P:	IDriver.exe
File opened (read-only)	\??\W:	IDriver.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	IDriver.exe
File opened (read-only)	\??\M:	IDriver.exe
File opened (read-only)	\??\B:	QuickTimeFullInstaller.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	IDriver.exe
File opened (read-only)	\??\Q:	IDriver.exe
File opened (read-only)	\??\X:	IDriver.exe
File opened (read-only)	\??\A:	QuickTimeFullInstaller.exe
File opened (read-only)	\??\B:	IDriver.exe
File opened (read-only)	\??\G:	IDriver.exe
File opened (read-only)	\??\J:	IDriver.exe
File opened (read-only)	\??\L:	IDriver.exe
File opened (read-only)	\??\R:	IDriver.exe
File opened (read-only)	\??\T:	IDriver.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	IDriver.exe
File opened (read-only)	\??\H:	IDriver.exe
File opened (read-only)	\??\S:	IDriver.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	IDriver.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeUpdateHelper.exe	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeInternetExtras.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QTPluginInstaller.exe	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTimeCheck.ocx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG4Authoring.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QTUninst.dll	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\IR41_QCX.dll	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\IR41_QCX.dll	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeAuthoring.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeCapture.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeStreamingAuthoring.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeVRAuthoring.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\GEARAspi.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QTUninst.dll	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeCapture.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeMusic.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeStreaming.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTime3GPP.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeVRAuthoring.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime.cpl	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeImage.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTimeMusicalInstruments.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTimeVR.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeEffects.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeEssentials.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\CFCharacterSetBitmaps.bitmap	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimePlayerExtras.qpx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG4Authoring.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QTPluginInstaller.exe	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTimeCheck.ocx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime.qts	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime.qts	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeAuthoring.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeEssentials.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeStreamingExtras.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG4.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\CFUniCharPropertyDatabase.data	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeUpdateHelper.exe	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeImage.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeStreamingAuthoring.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG4.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTime3GPP.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\CFUniCharPropertyDatabase.data	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\IR41_QC.dll	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTimeMusicalInstruments.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\Uninstall.log	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\CFCharacterSetBitmaps.bitmap	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\CFUnicodeData-L.mapping	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeEffects.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\CFUnicodeData-B.mapping	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeInternetExtras.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeStreamingExtras.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTimeVR.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\Indeo4.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\Indeo4.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime.cpl	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeMusic.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeStreaming.qtx	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\CFUnicodeData-L.mapping	QuickTimeFullInstaller.exe
File created	C:\Windows\SysWOW64\QuickTime\QuickTimeWebHelper.qtx	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\QuickTimeChannels.qtr	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\SysWOW64\QuickTime\CFUnicodeData-B.mapping	QuickTimeFullInstaller.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\QuickTime\Application Files	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Sample Files	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Delete QT 6.4 or earlier Files	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\TempUpdater.exe	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\QTInfo.exe	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\Sample.qtif	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\_ISRES1033.dll	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunes.exe	msiexec.exe
File created	C:\Program Files (x86)\iTunes\ITDetector.ocx	msiexec.exe
File created	C:\Program Files (x86)\iTunes\CD Configuration\gcdroem.cfg	msiexec.exe
File created	C:\Program Files (x86)\QuickTime\Sample.mov	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IUser8.dll	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunes.Resources\en.lproj\iTunesLocalized.qtr	msiexec.exe
File opened for modification	C:\Program Files (x86)\QuickTime\TempUpdater.exe	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\QTInfo.exe	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.dll	msiexec.exe
File created	C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Plugin	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\Plugins\QuickTimePlugin.class	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\Plugins\npqtplugin2.dll	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\Plugins\nsIQTScriptablePlugin.xpt	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\QTPlugin.ocx	QTPluginInstaller.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\objps8.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IDriver2.exe	msiexec.exe
File created	C:\Program Files (x86)\iTunes\CDDBControlApple.dll	msiexec.exe
File created	C:\Program Files (x86)\iPod\bin\iPodService.Resources\en.lproj\iPodServiceLocalized.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\QuickTime\QuickTime Read Me.htm	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\setud74c.rra	IDriver.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunes.Resources\iTunesRegistry.dll	msiexec.exe
File created	C:\Program Files (x86)\iPod\bin\iPodService.Resources\iPodService.dll	msiexec.exe
File created	C:\Program Files (x86)\QuickTime\QuickTime Read Me.htm	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Plugin Installer	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\iTunes\iTunes.Resources\en.lproj\iTunes Help.chm	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunes.Resources\en.lproj\iTunesLocalized.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Sample.mov	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\QuickTimeInstallCache.qdat	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\iTunes\Acknowledgements.rtf	msiexec.exe
File opened for modification	C:\Program Files (x86)\QuickTime\CheckLocked	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\qttask.exe	QTPluginInstaller.exe
File opened for modification	C:\Program Files\Internet Explorer\Plugins\QuickTimePlugin.class	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\iPod\bin\iPodService.exe	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunesHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\QuickTime\PictureViewer.exe	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\ISRT.dll	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunes.Resources\iTunes.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Delete Pre-6 Files	QuickTimeFullInstaller.exe
File created	C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\iTunes\About iTunes.rtf	msiexec.exe
File opened for modification	C:\Program Files (x86)\QuickTime\PictureViewer.exe	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\QuickTimeUpdater.exe	QuickTimeUpdateHelper.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\setup.inx	IDriver.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Delete Pre-4 Files	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Core Files	QuickTimeFullInstaller.exe
File created	C:\Program Files\Internet Explorer\Plugins\QuickTimePlugin.class	QuickTimeFullInstaller.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IScript8.dll	msiexec.exe
File created	C:\Program Files (x86)\iTunes\CD Configuration\gcdrdll.cfg	msiexec.exe
File created	C:\Program Files (x86)\iTunes\CD Configuration\gcdrtype.cfg	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunesHelper.Resources\iTunesHelper.dll	msiexec.exe
File created	C:\Program Files (x86)\iTunes\iTunes.Resources\iTunes.qtr	msiexec.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Sample.qtif	QuickTimeFullInstaller.exe
File opened for modification	C:\Program Files (x86)\QuickTime\Desktop	QuickTimeFullInstaller.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f78ae3d.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut5_8C3BCD70236347B8A53EEE8A82FD5C78.rtf	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f78ae3d.ipi	msiexec.exe
File created	C:\Windows\Installer\f78ae40.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4407.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut3_35AFD495EC2E4B2BB9DB30EEBC74049D.exe	msiexec.exe
File created	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut5_8C3BCD70236347B8A53EEE8A82FD5C78.rtf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C31.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI404B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4388.tmp	msiexec.exe
File created	C:\Windows\Installer\f78ae3a.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4475.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4522.tmp	msiexec.exe
File opened for modification	C:\Windows\QTFont.qfn	QTPluginInstaller.exe
File opened for modification	C:\Windows\Installer\MSICDBD.tmp	msiexec.exe
File created	C:\Windows\Installer\f78ae39.msi	msiexec.exe
File created	C:\Windows\Installer\f78ae3f.msi	msiexec.exe
File created	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut3_35AFD495EC2E4B2BB9DB30EEBC74049D.exe	msiexec.exe
File created	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut4_8C3BCD70236347B8A53EEE8A82FD5C78.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f78ae3f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI407B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4747.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut4_8C3BCD70236347B8A53EEE8A82FD5C78.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4580.tmp	msiexec.exe
File created	C:\Windows\QTFont.for	QuickTimeFullInstaller.exe
File created	C:\Windows\unvise32qt.exe	QuickTimeFullInstaller.exe
File created	C:\Windows\Installer\f78ae42.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBC6.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3CEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7569.tmp	msiexec.exe
File created	C:\Windows\QTFont.for	QTPluginInstaller.exe
File opened for modification	C:\Windows\Installer\f78ae40.ipi	msiexec.exe
File opened for modification	C:\Windows\QTFont.qfn	iTunes.exe
File created	C:\Windows\QTFont.for	iTunes.exe
File opened for modification	C:\Windows\Installer\MSI39C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E76.tmp	msiexec.exe
File opened for modification	C:\Windows\QTFont.qfn	QuickTimeFullInstaller.exe
File opened for modification	C:\Windows\Downloaded Installations\{8A232810-B5F1-48DD-A63D-B439D7680D94}\iTunes.msi	itunes47.exe
File opened for modification	C:\Windows\Installer\MSICCB2.tmp	msiexec.exe
File created	C:\Windows\Downloaded Installations\{8A232810-B5F1-48DD-A63D-B439D7680D94}\iTunes.msi	itunes47.exe
File opened for modification	C:\Windows\Installer\MSI3C61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut6_35AFD495EC2E4B2BB9DB30EEBC74049D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f78ae39.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78ae3a.mst	msiexec.exe
File created	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut6_35AFD495EC2E4B2BB9DB30EEBC74049D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC83.tmp	msiexec.exe
File created	C:\Windows\Downloaded Installations\{8A232810-B5F1-48DD-A63D-B439D7680D94}\0x0409.ini	itunes47.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB60C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iPodService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuickTimePlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QTPluginInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	itunes47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI4747.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iTunesHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuickTimeFullInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qttask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iTunes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuickTimeUpdateHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuickTimeUpdateHelper.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\video/quicktime = 00	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m4v\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\image/x-macpaint = 00	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pnt	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pntg	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qti\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	qttask.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gp2	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.amc\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pic	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pct\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mov\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes	qttask.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\image/x-macpaint = 00	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pntg\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	qttask.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.sdv	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qt	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qtif\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\video/quicktime = 00	qttask.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mov	qttask.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\image/x-quicktime = 00	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qt\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\audio/3gpp2 = 00	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\video/x-m4v = 00	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.sdv\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pnt\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qtif	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mov\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	qttask.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mac	qttask.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3g2	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gp2\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.amc	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mac	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pic\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qti	qttask.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pnt	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3g2\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qti	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qtif	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qtif\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	qttask.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qt	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\image/x-quicktime = 00	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qti\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\AutoplayPrompt = 01	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mov	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mac\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pct	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.qt\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pict\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\video/3gpp2 = 00	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m4v	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pntg	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pntg\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\image/pict = 00	QTPluginInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\video/sd-video = 00	QTPluginInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pict	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\application/x-mpeg = 00	QTPluginInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Media\MimeTypes\image/x-pict = 00	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.pnt\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	qttask.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mac\ = "clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"	qttask.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.aifc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8DE381-6C0E-481F-A865-E2385F59FA43}\TypeLib\Version = "1.2"	iTunes.exe
Key created	\REGISTRY\MACHINE\Software\Classes\QuickTime.qup\shell\open\command	QuickTimeFullInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5BDB98CC-B3F5-4D33-9A91-CBC986BEA087}\ProgID\ = "CDDBControlApple.CDDBAppleControl.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.cdda\shell\open\command\ = "\"C:\\Program Files (x86)\\iTunes\\iTunes.exe\" /open \"%L\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{84A21E2C-89EE-43EE-B8A7-867AAC3D821D}\ = "ISetupCopyFiles"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0E60DA5C-4175-4BD1-89C5-577032A931A0}\TypeLib\ = "{9795D310-2B39-4E89-B714-C363293FCC6C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\QuickTime.qt\shell\open	QuickTimeFullInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7312C0A0-A397-4A19-B432-9AC90C4466AF}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49C1B167-C294-4C76-91C0-88EBF91E88EE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickTime.mov\EditFlags = 00000100	QuickTimeFullInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{A4FAB52E-45B1-4A62-A85F-9E20567F5CC6}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7B3B6B6D-9FC7-4CFA-8020-C3AD61B27F55}\ = "ISetupUserInterface"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21}\ProgID\ = "QuickTimeCheckObject.QuickTimeCheck.1"	QuickTimeFullInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4a\ = "MPEG-4 Audio File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECEF9E1E-33C3-4AC5-B898-D446A94E6AB4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45D2C838-0137-4E6A-AA3B-D39B4A1A1A28}\ = "IiTunesDetector"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{72B62824-6273-458C-BA83-C90061D3F764}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BE75F4F-68FA-4212-ACB7-BE44EA569759}\TypeLib	iTunes.exe
Key created	\REGISTRY\MACHINE\Software\Classes\QuickTime.qti\shell\open	QuickTimeFullInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697DEABA-809C-49FC-ADD1-E9902D88360D}\ = "InstallShield InstallDriver"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.itl\ = "Apple Computer, Inc."	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5BDB98CC-B3F5-4D33-9A91-CBC986BEA087}\Programmable\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A504DED-A0B5-465A-8A94-50E20D7DF692}\TypeLib\ = "{9E93C96F-CF0D-43F6-8BA8-B807A3370712}"	iTunes.exe
Key created	\REGISTRY\MACHINE\Software\Classes\QuickTime.3g2\shell	QuickTimeFullInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickTime.pnt\shell\open\command\ = "C:\\PROGRA~2\\QUICKT~1\\PictureViewer.exe \"%1\""	QuickTimeFullInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6F8CDC9E-DB60-4935-A7ED-A7BE8EB2941B}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickTimeSystem\ = "QuickTime"	QuickTimeFullInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{72B62824-6273-458C-BA83-C90061D3F764}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdda	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D58FBBF8-3EC3-477C-8706-5C6C9AC8B3D4}\ = "ISetupBasicFeature"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{F092021C-6233-447A-8BAB-D15C370B162B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C18F0E02-E02F-4402-A8D7-70CABCC01738}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D6995525-B33A-4980-A106-9DF58570CC66}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7312C0A0-A397-4A19-B432-9AC90C4466AF}\ProgID\ = "CDDBControlApple.CddbURLManager.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80EE9910-D470-4AED-AC5D-987046FDB574}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{4D67F0D9-B58C-4E7A-ADF7-CBE625EE76FB}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlApple.CDDBControl2\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8DE381-6C0E-481F-A865-E2385F59FA43}\TypeLib\ = "{9E93C96F-CF0D-43F6-8BA8-B807A3370712}"	iTunes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CBF70AF9-A780-4527-93FA-0E98699D1415}\TypeLib\ = "{9795D310-2B39-4E89-B714-C363293FCC6C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{18889DE5-3E21-4675-8520-64702DB349C1}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF4D111-3331-48DA-B0C2-B468D5D61D08}\ProxyStubClsid32	iTunes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE4AF3AF-F4D4-11D3-B41A-0050DA2E6C21}\TypeLib	QuickTimeFullInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISInstallDriver.InstallDriver.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/sd-video\CLSID = "{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}"	QTPluginInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.pls\shell\play\command\ = "\"C:\\Program Files (x86)\\iTunes\\iTunes.exe\" /play \"%L\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{42A63984-1154-4995-A75E-2E92F75ED902}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{F3555F81-C076-4394-89F0-A0DA656CF932}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickTimeExtension\DefaultIcon\ = "C:\\Windows\\SysWow64\\QuickTime.qts,-101"	QuickTimeFullInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5BDB98CC-B3F5-4D33-9A91-CBC986BEA087}\Insertable\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{2CA491F2-DB7D-4A35-88B2-A00961598BB5}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlApple.CddbWMATag.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5bdb98cc-b3f5-4d33-9a91-cbc986bea087}\Insertable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{915DA835-02FE-4953-92FA-624BDF5D85AB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC0C2640-1415-4644-875C-6F4D769839BA}\VersionIndependentProgID\ = "iTunes.Application"	iTunes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A504DED-A0B5-465A-8A94-50E20D7DF692}	iTunes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{04FAC07A-AD76-4AB8-B993-B597AFC3D947}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21}\Implemented Categories	QuickTimeFullInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{352F743D-092B-4FC5-BABF-BCF5443EBCEA}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.wave\CurVer	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wave\OpenWithProgids\iTunes.wave	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF4D111-3331-48DA-B0C2-B468D5D61D08}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	iTunes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0A6C1F8-BF3D-4CD8-AC47-FE32BDD17257}\TypeLib\ = "{9E93C96F-CF0D-43F6-8BA8-B807A3370712}"	iTunes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlApple.CddbURL	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2800	msiexec.exe
2800	msiexec.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
1080	IDriver.exe
2800	msiexec.exe
2800	msiexec.exe
1752	iPodService.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2260	itunes47.exe
Token: SeIncreaseQuotaPrivilege	2260	itunes47.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeSecurityPrivilege	2800	msiexec.exe
Token: SeCreateTokenPrivilege	2260	itunes47.exe
Token: SeAssignPrimaryTokenPrivilege	2260	itunes47.exe
Token: SeLockMemoryPrivilege	2260	itunes47.exe
Token: SeIncreaseQuotaPrivilege	2260	itunes47.exe
Token: SeMachineAccountPrivilege	2260	itunes47.exe
Token: SeTcbPrivilege	2260	itunes47.exe
Token: SeSecurityPrivilege	2260	itunes47.exe
Token: SeTakeOwnershipPrivilege	2260	itunes47.exe
Token: SeLoadDriverPrivilege	2260	itunes47.exe
Token: SeSystemProfilePrivilege	2260	itunes47.exe
Token: SeSystemtimePrivilege	2260	itunes47.exe
Token: SeProfSingleProcessPrivilege	2260	itunes47.exe
Token: SeIncBasePriorityPrivilege	2260	itunes47.exe
Token: SeCreatePagefilePrivilege	2260	itunes47.exe
Token: SeCreatePermanentPrivilege	2260	itunes47.exe
Token: SeBackupPrivilege	2260	itunes47.exe
Token: SeRestorePrivilege	2260	itunes47.exe
Token: SeShutdownPrivilege	2260	itunes47.exe
Token: SeDebugPrivilege	2260	itunes47.exe
Token: SeAuditPrivilege	2260	itunes47.exe
Token: SeSystemEnvironmentPrivilege	2260	itunes47.exe
Token: SeChangeNotifyPrivilege	2260	itunes47.exe
Token: SeRemoteShutdownPrivilege	2260	itunes47.exe
Token: SeUndockPrivilege	2260	itunes47.exe
Token: SeSyncAgentPrivilege	2260	itunes47.exe
Token: SeEnableDelegationPrivilege	2260	itunes47.exe
Token: SeManageVolumePrivilege	2260	itunes47.exe
Token: SeImpersonatePrivilege	2260	itunes47.exe
Token: SeCreateGlobalPrivilege	2260	itunes47.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeCreateTokenPrivilege	1080	IDriver.exe
Token: SeAssignPrimaryTokenPrivilege	1080	IDriver.exe
Token: SeLockMemoryPrivilege	1080	IDriver.exe
Token: SeIncreaseQuotaPrivilege	1080	IDriver.exe
Token: SeMachineAccountPrivilege	1080	IDriver.exe
Token: SeTcbPrivilege	1080	IDriver.exe
Token: SeSecurityPrivilege	1080	IDriver.exe
Token: SeTakeOwnershipPrivilege	1080	IDriver.exe
Token: SeLoadDriverPrivilege	1080	IDriver.exe
Token: SeSystemProfilePrivilege	1080	IDriver.exe
Token: SeSystemtimePrivilege	1080	IDriver.exe
Token: SeProfSingleProcessPrivilege	1080	IDriver.exe
Token: SeIncBasePriorityPrivilege	1080	IDriver.exe
Token: SeCreatePagefilePrivilege	1080	IDriver.exe
Token: SeCreatePermanentPrivilege	1080	IDriver.exe
Token: SeBackupPrivilege	1080	IDriver.exe
Token: SeRestorePrivilege	1080	IDriver.exe
Token: SeShutdownPrivilege	1080	IDriver.exe
Token: SeDebugPrivilege	1080	IDriver.exe
Token: SeAuditPrivilege	1080	IDriver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
932	qttask.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
932	qttask.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1052	MSI4747.tmp
1052	MSI4747.tmp
1784	QuickTimeFullInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2908	2800	msiexec.exe	31
PID 2800 wrote to memory of 2908	2800	msiexec.exe	31
PID 2800 wrote to memory of 2908	2800	msiexec.exe	31
PID 2800 wrote to memory of 2908	2800	msiexec.exe	31
PID 2800 wrote to memory of 2908	2800	msiexec.exe	31
PID 2800 wrote to memory of 2908	2800	msiexec.exe	31
PID 2800 wrote to memory of 2908	2800	msiexec.exe	31
PID 2800 wrote to memory of 812	2800	msiexec.exe	36
PID 2800 wrote to memory of 812	2800	msiexec.exe	36
PID 2800 wrote to memory of 812	2800	msiexec.exe	36
PID 2800 wrote to memory of 812	2800	msiexec.exe	36
PID 2800 wrote to memory of 812	2800	msiexec.exe	36
PID 2800 wrote to memory of 812	2800	msiexec.exe	36
PID 2800 wrote to memory of 812	2800	msiexec.exe	36
PID 2800 wrote to memory of 2340	2800	msiexec.exe	37
PID 2800 wrote to memory of 2340	2800	msiexec.exe	37
PID 2800 wrote to memory of 2340	2800	msiexec.exe	37
PID 2800 wrote to memory of 2340	2800	msiexec.exe	37
PID 2800 wrote to memory of 2340	2800	msiexec.exe	37
PID 2800 wrote to memory of 2340	2800	msiexec.exe	37
PID 2800 wrote to memory of 2340	2800	msiexec.exe	37
PID 2800 wrote to memory of 1052	2800	msiexec.exe	38
PID 2800 wrote to memory of 1052	2800	msiexec.exe	38
PID 2800 wrote to memory of 1052	2800	msiexec.exe	38
PID 2800 wrote to memory of 1052	2800	msiexec.exe	38
PID 2800 wrote to memory of 1052	2800	msiexec.exe	38
PID 2800 wrote to memory of 1052	2800	msiexec.exe	38
PID 2800 wrote to memory of 1052	2800	msiexec.exe	38
PID 1052 wrote to memory of 1784	1052	MSI4747.tmp	39
PID 1052 wrote to memory of 1784	1052	MSI4747.tmp	39
PID 1052 wrote to memory of 1784	1052	MSI4747.tmp	39
PID 1052 wrote to memory of 1784	1052	MSI4747.tmp	39
PID 1052 wrote to memory of 1784	1052	MSI4747.tmp	39
PID 1052 wrote to memory of 1784	1052	MSI4747.tmp	39
PID 1052 wrote to memory of 1784	1052	MSI4747.tmp	39
PID 1784 wrote to memory of 836	1784	QuickTimeFullInstaller.exe	40
PID 1784 wrote to memory of 836	1784	QuickTimeFullInstaller.exe	40
PID 1784 wrote to memory of 836	1784	QuickTimeFullInstaller.exe	40
PID 1784 wrote to memory of 836	1784	QuickTimeFullInstaller.exe	40
PID 1784 wrote to memory of 836	1784	QuickTimeFullInstaller.exe	40
PID 1784 wrote to memory of 836	1784	QuickTimeFullInstaller.exe	40
PID 1784 wrote to memory of 836	1784	QuickTimeFullInstaller.exe	40
PID 1784 wrote to memory of 2456	1784	QuickTimeFullInstaller.exe	43
PID 1784 wrote to memory of 2456	1784	QuickTimeFullInstaller.exe	43
PID 1784 wrote to memory of 2456	1784	QuickTimeFullInstaller.exe	43
PID 1784 wrote to memory of 2456	1784	QuickTimeFullInstaller.exe	43
PID 1784 wrote to memory of 2456	1784	QuickTimeFullInstaller.exe	43
PID 1784 wrote to memory of 2456	1784	QuickTimeFullInstaller.exe	43
PID 1784 wrote to memory of 2456	1784	QuickTimeFullInstaller.exe	43
PID 1784 wrote to memory of 2616	1784	QuickTimeFullInstaller.exe	44
PID 1784 wrote to memory of 2616	1784	QuickTimeFullInstaller.exe	44
PID 1784 wrote to memory of 2616	1784	QuickTimeFullInstaller.exe	44
PID 1784 wrote to memory of 2616	1784	QuickTimeFullInstaller.exe	44
PID 1784 wrote to memory of 2616	1784	QuickTimeFullInstaller.exe	44
PID 1784 wrote to memory of 2616	1784	QuickTimeFullInstaller.exe	44
PID 1784 wrote to memory of 2616	1784	QuickTimeFullInstaller.exe	44
PID 1784 wrote to memory of 2416	1784	QuickTimeFullInstaller.exe	45
PID 1784 wrote to memory of 2416	1784	QuickTimeFullInstaller.exe	45
PID 1784 wrote to memory of 2416	1784	QuickTimeFullInstaller.exe	45
PID 1784 wrote to memory of 2416	1784	QuickTimeFullInstaller.exe	45
PID 1784 wrote to memory of 2416	1784	QuickTimeFullInstaller.exe	45
PID 1784 wrote to memory of 2416	1784	QuickTimeFullInstaller.exe	45
PID 1784 wrote to memory of 2416	1784	QuickTimeFullInstaller.exe	45
PID 2456 wrote to memory of 932	2456	QTPluginInstaller.exe	46

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\itunes47.exe
"C:\Users\Admin\AppData\Local\Temp\itunes47.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6DFFCB25763293391DE24DC5EB700D4 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 354E8CB2AD039027189F03275F23CF46
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:812
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2EFCDBD0A0F1197109D739516EB61C3D M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2340
- C:\Windows\Installer\MSI4747.tmp
  "C:\Windows\Installer\MSI4747.tmp" -SuppressRegistrationDialogs C:\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\Quicktime.ini
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\QuickTimeFullInstaller.exe
    C:\Users\Admin\AppData\Local\Temp\QuickTimeFullInstaller.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe
      "C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe" -QTPostInstallProc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:836
  - - C:\Windows\SysWOW64\QuickTime\QTPluginInstaller.exe
      C:\Windows\system32\QuickTime\QTPluginInstaller.exe -QTPostInstallProc
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Program Files (x86)\QuickTime\qttask.exe
        
        "C:\Program Files (x86)\QuickTime\qttask.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:932
  - - C:\Windows\SysWOW64\QuickTime\QuickTimeUpdateHelper.exe
      "C:\Windows\system32\QuickTime\QuickTimeUpdateHelper.exe" -waitfor 4b8 -uninstallwithapps -destfullpath "C:\Program Files (x86)\QuickTime\QuickTimeUpdater.exe" -sourcefullpath "C:\Program Files (x86)\QuickTime\TempUpdater.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:2616
  - - C:\Windows\SysWOW64\QuickTime\QuickTimeUpdateHelper.exe
      "C:\Windows\system32\QuickTime\QuickTimeUpdateHelper.exe" -QTInitDefaultMediaPlayerSetting
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2416

C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe
"C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080
- C:\Program Files (x86)\iTunes\iTunes.exe
  "C:\Program Files (x86)\iTunes\iTunes.exe" /regserver
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2592
- - C:\Windows\System32\pcaui.exe
    "C:\Windows\System32\pcaui.exe" /g {11111111-1111-1111-1111-111111111111} /x {3a6823b2-7ce1-42ec-8ca3-24c48d8d811f} /a "iTunes" /v "Apple Computer" /s "iTunes installs drivers that are valid, but incompatible with this 64bit version of Windows. <P/>For more information, contact Apple Computer." /b 1 /e "C:\Program Files (x86)\iTunes\iTunes.exe"
    3⤵
    PID:2364
- C:\Program Files (x86)\iTunes\iTunesHelper.exe
  "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1288

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004C4" "000000000000005C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1684

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x530
1⤵
PID:2372

C:\Program Files (x86)\iPod\bin\iPodService.exe
"C:\Program Files (x86)\iPod\bin\iPodService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f78ae3e.rbs

Filesize
64KB

MD5
950fd00798d7d9831468c496e217afbe

SHA1
7de7fdf72f74692fef5dc837dee10a6def564537

SHA256
c3fd9407295fdec1f2613946e2d3bc5f761d69028184c97386179678db3be418

SHA512
1f80a3e96f86014b45dd47cf6065e61ed24bb698d556f42bdc1824b8d48560e71eb8055609b9419784bbf92d4284fd3e113c58e14fc3f38c17a6c3c784d5aafb

Download Submit
C:\Config.Msi\f78ae41.rbs

Filesize
92KB

MD5
9da2ecf71cbd42b5ddec9517a686fc9f

SHA1
3be2ad0bc9a60e22731829993c95fc5debd979ed

SHA256
21f9ba51850bc4bd652d85be4f67cac1daeb834a8968f909e02c7161fc0db1f2

SHA512
38a8c651692f6843dcf81215e595777631826391407211dde9669fba8a2ab2d3a76ad0368a7549901270683d9b7e698f47173966534abccb241a70503798208f

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe

Filesize
632KB

MD5
3d236e66593be77b16a2a3dfec9032aa

SHA1
03a688f7e135188f05fe2259e2c01204f8481936

SHA256
3c0d4b452627532a9d223686c0e0bdc285042da9f8cad4009048988fe705cfde

SHA512
5cb9e5696a1bf87c391946a0ef20ed81720ef52455fa8864d9ecd371077c5f04a94f210a2f98fe3ae3f8668ce611130975fc298559724e4b24faf859c4a94269

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\ISRT.DLL

Filesize
320KB

MD5
5f3bd82d1c302b073e8f6b82eef7ba85

SHA1
48ce1a57516443f28dc6a919be7d3e0f2bce5a9c

SHA256
83a57cd6c2ef6c8baf9b9783f8bcb166a02e80a96cb648148dd99a23ccdd7203

SHA512
fbf7e6981b25c94cdbd350577b79bcfc45d977b3e1fdda8181caffc93905bf5cab9540c5378e3fd92b764031327d68cba361a226352c8b749a3bfec5d0deb6e3

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\_ISRES1033.DLL

Filesize
284KB

MD5
010d9fa7c669eb1637c10c4aa7eca475

SHA1
df89fafbfab0471bea37a7a094216af1a4d1de29

SHA256
67d31223a5af57c533a0063c3873fce74c13fd7fc986b70bbeb6a585b68946e3

SHA512
1e6a1182b167496ec162905fd7b650011e44ed9f0a45d8f9d3a19d863852027c4169ccb005f17455df3a22f956089dc12cf976f0d9ade648b994505f863cf1f0

Download Submit
C:\Program Files (x86)\InstallShield Installation Information\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\setup.inx

Filesize
237KB

MD5
158635d98f3b4210a67f152a21c835d6

SHA1
d95907764450a7425cf94529347b29b063bc0671

SHA256
afffca11aa028eeab5196615fc6934ac6827a10b0c7f07735ec9f34819d85efc

SHA512
2eeaad8ceddb537c61756cf81a415c14908c679d4beb28cd888bb61e9ac1eb749557c0030ab14eeb709f4527c0bd0cb5795c74701c955a2324752cde78b2d06e

Download Submit
C:\Program Files (x86)\QuickTime\PictureViewer.exe

Filesize
291KB

MD5
fddcc6c0d3c7901ad59d46f7282e2198

SHA1
ee8f25dbb8d19269e6be2f2337433f6a46c77ad6

SHA256
b35ca97925d582ff1d08c47e30059e9ec3c95a25b80fd0b8f459aff52f434b23

SHA512
83a73934fde5a70508036379e711dbce010b501b20c720ee828800cf403250772ccdfef4d24d62e2c79b834efd509f82784ee9318f61df29c56b8682bfe8c7e7

Download Submit
C:\Program Files (x86)\QuickTime\Plugins\npqtplugin2.dll

Filesize
104KB

MD5
f1841a70e7763ccba81693861d0b3f58

SHA1
da5d242f096d702b2e0e4e44316ce3edc3c68508

SHA256
67da46e16503af7ec90ffa6bbdf8a5a2a71adf537b6bd772c5d79037e8ee0dff

SHA512
f71050bce1e1f65a846ebd3d012e1d7629726493f0c1ec05ced008fd914fc06e4008b21db6c9a5e28bf3fdcab135996c854373d8dd10954085ea88eb013ce79a

Download Submit
C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe

Filesize
1.0MB

MD5
4ceffd44568fef1d45fea65341511619

SHA1
3b30c80c4d52814f9d42d8952b2308f64409f082

SHA256
eb5318025d80f6844cc2d89a926692772925e8a78cbc0db1325205a72c6cf747

SHA512
d3ded9a02af5e36c509f90369b8a714efc61f584b21f86ff048a9e05396b7f642b2e83cae3539b76762c2fb5d554ff71e33aa6befdfc0139808da105ca7862ab

Download Submit
C:\Program Files (x86)\QuickTime\qttask.exe

Filesize
96KB

MD5
76a3a30b58405c2c6d833895253a51a9

SHA1
81899013e13eaffef1b812e628297e2032c19db2

SHA256
9ec13191f3938e0e63a5594687a7d93e0c5a77fb54bcfebd3855719ea62262f8

SHA512
b4b5e07e54c09fed1723d0853e80dafef316344a9bd3ea68f685b69a92c9f8a77758420a1c44cc250fb6d0f2f5d891452b3b0ac40b808d5ea00a9baa581e50a8

Download Submit
C:\Program Files (x86)\iTunes\iTunes.exe

Filesize
8.4MB

MD5
5226728bb1623bc0f383f12d71169b59

SHA1
ffbfffb37cc438fc0164f3628357a9a7157b305b

SHA256
87268ec5aae29c1537030aecaaca56f12fba4942e7eda4aa4add95ba0a919c62

SHA512
ce38a2c4847f2f16c0156ffa64192bc4078609ef533ce403539ca9e304920bfc2d1bbbec65ca7f97266f0ab969d6576544c96169008340476a07f361d50fd827

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
361B

MD5
312ea0d7d648dd557788f66327a945d7

SHA1
4365732f6807591921d21c67b84fdf5fac8233a9

SHA256
12de0bc7ff2795a37fdf1ff3c20f0138542510bb2f30762020843763e6a4d948

SHA512
17bf177001a25005fca27f2ca942f58bf80427f6719ec42cdd571e7a2583d5a5890dce6dfa795d38daa65272ed5f3bf2d7782684c65ea6bcceda10166fec9664

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
385B

MD5
cbd84dd677f407249fe220e80c775970

SHA1
75f22e0bb5da8057c4591b35f4f916e6e16223c7

SHA256
e1757bf5e7422406a50e86a2a00fdcc32da19c6a1afe53cb7dbb4ede9d9e0ec4

SHA512
c4ba440fae69c0f6c481216f60dae3110a355625bcd25e4d171aaf047d44aa09e83af8dcad9fc80849e67a262e578ee52d6d20e2ad5b7ed7f1560cdba2573eff

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
713B

MD5
c911ec7d50d34890e072e497cf93875c

SHA1
f027700bab3cade4a164c73dd870f06f46e82fbb

SHA256
53af7f02fe9d64396a1a71f935180b8895ce0c36391018a9aa042f66fa79a856

SHA512
55e35a9cbe4b4afb71ff76d383101bb5c90c2a9c5c0eaada7a6f35dfe06f668b42761270e44de4838982ff6d165742afacdd62d5c9348d1813a50ff70614533e

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
1001B

MD5
264a81d5f5c24b7c4df754634482b774

SHA1
3cc145c4468ad85f14c382d39009cd7f805a33d1

SHA256
36daf939e09b7da1db3e69df363faa357a3cd6560426acfab9f99f2cb5ead228

SHA512
f1f1c9415bf8544488c69efd148c006023da24083e4b9b92cee78ffe543e197f09d3334c4e3ec56aa88b1ef20b5d55a3e0c981fc2ad38c496fd9c7650531c361

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
1KB

MD5
381a23fac80cb2dca165ffd18c20a14c

SHA1
f9b2f4621966dfc0d8f58b326b96473c998f0f9d

SHA256
991b085dbb13ef2dc3cfddc7a031b37f4d3f81a1ff07c01ed8bcc20b80277001

SHA512
1462c080c9c3be11ef405b2007fc7b380af67daddba1230d5e79dd1a421b32df60c506f696134c18e4b1b8f8655c25bee04c6259478523aa921c02083939a910

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
1KB

MD5
bdcc0817c19ea8ab14498a1f8469c408

SHA1
6ab60a9d2368877cd51b62df26b0e47875c059e8

SHA256
cf3ce55702c1142d63a1416ddc8d591bf4480285a32fd8b9c9bcda627e7f47fb

SHA512
4249e379140085a8913e7e9afb0c9b6e8b4daf4f20ad6b6060f2887b8e9944cee5c029781c93126468edb0af471052c3f2303575a9f9a134e26e891ca0fcaed0

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
1KB

MD5
dc933f05c00f1b296f3f8703c44c65cd

SHA1
f4fef696a2311b3d6c4001b7839e08c517c8a003

SHA256
d60587014b4318afb5bcddb6c1e2a33643a06048ea5e0aa45fd42b5da379d71f

SHA512
7b8f8650b3b5eb476447094031b1630db034d6d667356dda2ebdd65ddc7f79361e777020ef468f77060d19f60f836fa0d1ab64af88adb1ececaeb145ee0dfc2f

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
1KB

MD5
95b10d539e97f94bd1e4cfc957295cdc

SHA1
3c0bd8051f91528fd3a8c8b4b6bec177a5a12561

SHA256
9413913625539a5fc56385173f62ca8aea9ade5d1ee37ce583ad21bf24c2d567

SHA512
7ecdff0a9eb4feb3ce3d083c6a8e0de8e3730aba429c18491b6cbeff70ef74e0a5bbf71e78044275a90fcda352ab194129c9339cb7e35f76d2ef2138ccec5f40

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
9KB

MD5
c2bc6195ee5746b2c3d7bbb6c5935f35

SHA1
e375a1404317ffc16cc7abc367d2799dcfaaa14c

SHA256
416b95204f9c1f5f6e732c0debbb08db761f030016800227be149b6aa8f35b84

SHA512
b9c8384c1fb83c4f688d3967797117ade1b2b1fbadef261882e6e14e70541e1c150b579c802981488dcd226bc22752bae3959b458928c4ce606d867a8faf9cdd

Download Submit
C:\ProgramData\QuickTime\QuickTime.qtp

Filesize
9KB

MD5
6d1957fb9a8ebbbca304733e61ae095b

SHA1
3c214e1caf836de2b8016724b120f352f092aad9

SHA256
9bdb01e032f36f967e97666e30bff81e1190d3420e6f9c27525a65a92cf38c41

SHA512
a069930d51f74f6fb0dd230bb779b3e6fd28297a289b6a2bd9a347f67f23aeeef8cc246e203938c0f630ade6a77444705703741dc2e9f0f0ab9222759f075313

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFE1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC5A1.tmp

Filesize
48KB

MD5
8055a7a8444f6088957c01e54b2d94c1

SHA1
7fc5f33c4f6f89e6088c4305db94aff55e30e290

SHA256
bec93eab72916acf1a650be51d661ebb0b83f7edf61b495d58c5f2bf231edb9d

SHA512
912fca6bd24bcb6a5bb26f10e420cb8b88a62461149801cf8698d8b470e45942804aa6aff4994b00b5bd6272c67cc2c30558b92fb36e221b5f175de899bfcaa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB022.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_is9982\0x0409.ini

Filesize
4KB

MD5
7a858ca524beb223533a2ac6138c4b73

SHA1
aa7a7e8e7c6c2324d2906a78c243b187a072aa59

SHA256
97eca8e6d33a2761f94831f3f82e030a8e79b5cbc12dcbed4eb1de9c4edf4d1a

SHA512
d3861daf5e0754388f1719450cbfebe629090e41249ef2a206a86dc3fc5f68b3a98c29ddc159d44348080e48bc84a8e0815aa39d535187eb4737cdf4d486bf88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_is9982\ISScript8.Msi

Filesize
696KB

MD5
548c56242ddfe76469595a5ebc40a3b9

SHA1
95f270d3ad86310df1d3041a71a6727c49cdb1f2

SHA256
b8e0f598ffe8b4b136c5238da0ff275fa197526ae6ebc1d135abe208be3e747d

SHA512
26bc8d1afbe46796a3b5e97f81a63ea9a7be5b4fb05b67677ec19d053ba7abebced8233399f4f2ef2129294cbaf5a76ee29beca4d42cb542511e11bb2d230c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_is9982\Setup.INI

Filesize
1004B

MD5
eaee23ef903163833a3da4514774217e

SHA1
cfe509f093b6daf09c30f41ccbbb857cb003df7e

SHA256
6fc8d120400b3e18d03950019fa499e737d822fa305e423d8d944a528042a0c1

SHA512
6eb0262bdc73d5e1966288084360a56279d576bdc6ba0743c9b77e179a5616c01f6379db4afb449d015a63c1bf4f07f5d162d08492fba5307666b3ec41e69eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_is9982\iTunes.msi

Filesize
19.8MB

MD5
d4ea7f464b3b2d6f77abd51a6c71e881

SHA1
fa84a50a8fb01e406e7ea9c96e5127de58f5cb8c

SHA256
037c166c82ee9a661b07187a049c9246f1d9d3e785da3e6a8ab152a581237c18

SHA512
945fe5771a3f65101392365993a52fbc485d0948fcbd7681992ee5f198379b622aace585f1400216a9abc1095e787857d7112c82defa5dc8f31a3e7ab88c222e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\Banner.bmp

Filesize
374KB

MD5
d91b34fde999ea5561c3821d83fd6c2b

SHA1
a25620115927d15d8c8aff9090c1bdc0a5c9bd83

SHA256
0311f06ceb6c130a9443ae5b67c9a33a3ad40ff5054ed42702b563136a6d18c8

SHA512
97d4948d3b649729164f431a8b4dd1f1c5a26f465dba1692ed24ff142e1cc271a748874bdc9c9384d85159f3cda57efb0113d6df50bf89a764a270c8d8b70e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\IsConfig.INI

Filesize
114B

MD5
9a37cd6d7eb1680930e001e7caf14e68

SHA1
4a2d1d2edc35fbe195f4e9720c318ad05f45614d

SHA256
45b4e31a761f4015e72e84d3dcefe3844c4c6603f81a4bf532e3ef2046c2f3e7

SHA512
350ce8308de5675850bd95c2e4d3ee935cb6a3cac7ba061df9dc3a88f19e2ea2274f06c9d0a95582a11e97854702c59c9de233e121bcdaf186bc754d5b29a788

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\_ISUser.dll

Filesize
1KB

MD5
d194465d492ad0aff55ec4de4eb4627b

SHA1
81be9fb272178d7902665f02324015cf9253cf16

SHA256
ebb5396860f470e6033da546cfa6858382661fa0fbbbd60f9485f94a932afc0b

SHA512
5b7c9ad220ab578b5d8e532affe669fdce7d6160109ed7641e9f9c89b719d00c4938446cb3998b082d7d9cb0df6c8bf765054d0e53f056c04a9ec25adbfa0f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\license.txt

Filesize
23KB

MD5
15d51cc78d96ff5895b50a668f29366a

SHA1
3889c42d9eea28d6403056aefa7971bb1cbfabba

SHA256
69e0960869d85984d7bd3e8a9bafcdc522c28372821348b0a677a5d65c19a5ea

SHA512
787978a2153d7bc415ec543f316f1c5f42bc2aec5f60c0e944d845c9f148d332dc52a6514499d4ad5c6e56790661e382c212b3bce810a92c5ae92ad3dbdcea83

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\readme.txt

Filesize
3KB

MD5
58be56ae1448f0e85ec9d2dd928676cb

SHA1
faafe86c033e97d8cd492bd5fc9a5f5dcb089758

SHA256
6bceed49d732324d936a345d42fd183e05af54ccf77910ad8e88c0f2e89dc47c

SHA512
8dfa1cd2720394566f80f9b91c4217c080f0ce1ddfe719b63c8d1fd0f76f06f3fc7ab2c0e67788d867c9b907601c57ebb5346c1faf6cf7ea2151ecd3b1048985

Download Submit
C:\Users\Admin\AppData\Local\Temp\~4089.tmp

Filesize
475B

MD5
246c6664df98e636659c3e4da59094b1

SHA1
3d118d89db6f97765768f5225d5c322d661ec273

SHA256
fa0d6b3abbcf91743cf80642cb35bab76c0f9b989e4729d7934f06d51450285d

SHA512
2ee9365ef4105d39dc6486ffa0cf9fa4fd711276160664a2d44c7972681826ee0336f1250e2aa88563b2b392ebfb41d0a4a5a6cc233490e18f64a35319247258

Download Submit
C:\Users\Admin\AppData\Local\Temp\~4089.tmp

Filesize
349B

MD5
572f8554d79b0bf678e37ed5e286bdf6

SHA1
7131296e5f9a3a933f043842a36755ee1afa7c1c

SHA256
ba54463488b14149d21905fe7d06b5c3cdd57e79a8a88591a7e53f70c783dcbb

SHA512
02ea18dbf25a3cd865b4cec1bb88fed123375d06ee83bd72bc548b9cb59a175ce3e20160da9ca50c8f1d6b98be7f756ae097e60a77e0fff70e26af94546a4cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\~4089.tmp

Filesize
476B

MD5
9d822dec799d63b3f215176a691caf56

SHA1
0f667e398d8e698d6231351b920726dc3c077535

SHA256
8411566550b2e8223f43dee0e21cec7793be11834a9358d1a8dcf8ac3bfddb58

SHA512
e529355032ebfebad93e9cc1accc8b3765d568307d3f1643fa6c5176480d68be33e9f7f5b7a791c6099f1fd6c50a73dfff2afd5c8a95eb6a6b7fa1f12ee6691a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~4089.tmp

Filesize
464B

MD5
95b49e48917e7563543178926d242825

SHA1
a06ed5d4ae39b2c46b4317d7cf95cb50ec57960d

SHA256
712fa0de5f674d1e2ed23d84c899e93e549e59ae1a6ceaa6d41ee15cd7a6441b

SHA512
dd4ab5787529537f899856824edfff8597509820be1db26e4cfe9c1883b9d98e43d0244e5906e5f977f466e00d4d3bfcc0f52769638dda323e51eddeedf353c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg

Filesize
13KB

MD5
ca880082f1db3fbc48f988c20e611e90

SHA1
335c34d245d746899e50c648da422265268adc9b

SHA256
ce1da30eeabcfab9cf270c055dc91dedfd993e026e91c4cc815c22c25da5f162

SHA512
a160de92a7be41f03283e039fed5160ae72f13ccaad725c10373924436e489656c0b98b17d6df89ebb02fb11c14e0795a71c768ee99a67fc24a39f4638ec24f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\QTEXTC~1.DLL

Filesize
184KB

MD5
bddcdefdba721ba718d11cbadfba19e6

SHA1
ea11b4b511efcdcfd739fa943f4e0dd4bdcc2ce0

SHA256
7176f92faa47589a58142a46a6b61478d7e4b24fbe62163de6c4565ee78276a4

SHA512
30e6551ba676cb419c86d92fbbebf516666c5c47bc07bc2608eb6623b91aec9b44a134704c06ef12a3f63b391d0970873dc8e071a30383019a831fa6ed4a0c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\QTSetup.ini

Filesize
618B

MD5
8f565e940cfc85899f3db8a7b40acf8b

SHA1
eb6b89981593faf22622329cf18b4745a3c33b44

SHA256
9954f28d929531efff3fbe00b87cd551f1f46cdb09d015394b097c462091a7e7

SHA512
a97622ed7948fbfb7786c992b88458a0074470a686d8415013f07ae8b36d8485639b380447ade27fa2fc5cb5876bd1fb0cf7d275ad47d558e20308a53b5b3bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\QTSetup.ini

Filesize
248B

MD5
035f7ae62fbfb43f8f0d8a9edc56ce32

SHA1
c48d2eff93ebacfaac654e1a01f209be23ee21f5

SHA256
9e2bf8d4e7cbbad820c38556af146e39c6371ae2d7f852d8eff681de08277e6a

SHA512
41b553007dd49e8fa842842d605519d0f468aaf5bead0f680d7fea0d9e2fec6458d96c078f0dab32497ee59022269d7257506c3a3b383e2547651ecf4fe54aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\QTSetup.ini

Filesize
337B

MD5
07f79ed4e4b4a4c4f240ec1372cb08e1

SHA1
615656847f2b310628bffc837eb9bf4a85effd0b

SHA256
802645a5906973df48b18ba48a6adde899d8c31f33725489e7312a43dc8a4b2a

SHA512
ee0bf20c9e9e28ad294c97fa06e0b6dcea7634056c48d3d96d03f6ccb69c10545a4c480f2dd94e3fcface781bee2c4a388a606350e6e82e6b6fcf9b83d221957

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\QTSetup.ini

Filesize
551B

MD5
5e2eac9656691380a6e8cfeac7cd9742

SHA1
4993dbb0247829a99869354a27288fde71b57a9e

SHA256
79d2cc7bfa874696f7a4289e3336f0329afa6f1eb27b3e488d687f04b2b29a45

SHA512
83f26b5fa0d06b8b295057b1180afd45abd264460d4c61156bfe98ea8e4dec0a57267f459e8e73defbaa8bc682ad998cc4119aa9c8ae1152b7c33aa6eb1a2d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
2KB

MD5
5cb39a244c716375c8fbbc5da484fdc8

SHA1
e8cfb7f4a57c002f40c9832ab43f629689e378df

SHA256
a5c90c480457ae5e52857566162c40fe808ad0fc2225f606174554f756c58198

SHA512
c173f95acf9917c46c89474778b963754f2c82443b97327fc3035258929c41d64ed80731e3f5412b52d20a9bcd1fedb1588fde5ede11cc016ca5f1e926ea1e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
3KB

MD5
7da76fb26acd7e264900fcbb82487f6a

SHA1
59dc2bf9c8c7a5dcaf30de3f08943219c2c11528

SHA256
b9fde459e268ad716b1c35782e4fe364d23510477942a7596999f1ee45d94406

SHA512
f8b81aef8234ea2c2468e9caee25ea06eb340cf169737b66fc75cb5a94c3330f929bfe2d125f3ec4e5b74136d864f681d10600052a2666aa148e1d42396d6a78

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
3KB

MD5
6791240a2aa4ca17d8e6ff484da2b069

SHA1
c9f3c0c7df4556a749dbbd3f5840274927ab76e2

SHA256
467517cd1c1a708e637fee9e941dc7643964f55944a3a147e55b96c52b326b76

SHA512
95b31b48efa1ca411645589b8d8103909f03675f10855c20276070b0c03fdf3324fc66982b691014835a52d563060199406eead6c4f582130b31a69aaaef2e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
4KB

MD5
b5e9d3f6bf5e40de8d01ab32b5b3dbe6

SHA1
75fac2f6b76cd6cd97ec3806d0081b74936a28df

SHA256
cde39db004363adbef01b575fbef99962908270364c0b93f6301ed6142aaab8f

SHA512
9842a6e48d02f84695333b462e0db1f6af6f1dbabfa475451ae8f1bb1dae37ba8fd81068a99c02bad54e792c9d6d3d50c3b94c195e8d2f7f807aa2490d1fd868

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
4KB

MD5
1f05657f19caa40f757c42ce9ae2c6c0

SHA1
6686a707b558c69aa7476be81a51aa8f8b351608

SHA256
da638233acc93730ab3f080368f6222b1d49136dee2a7944b4dbf84264be2199

SHA512
125dfd5c8acdf7875c2169313765d67c5abe94d0d808443feddeef7c44a0619ce585dbad4ce2f56b7b1a45fa8e0a88e188d3411997ffa45560a2ac54fa754cfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
4KB

MD5
2ff53e86537776fd234f0f17f888eb90

SHA1
d05af823fd2c496dc2e3066f3183268d7083312b

SHA256
93e885372d893d9c019a4fd4b623527ccc836c0b7d74f1062895c40f7f12bf61

SHA512
0e0fd9e318b6d45a3523e08d0e8d16fcce8a2e145fe293f8a108767033ebb74e1f124a77894a326130d8537a96c01a73bb20617cb8ace733ca7c2ee1ae9863cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
4KB

MD5
67c009892195babbabc44d31bef48f37

SHA1
1a1112fcdf8e278264b8eb8850192b626a03c45f

SHA256
82bd8ae2688d706962df017f793efb6cd76bb5135c6d1e0b9de895a9022ffb2a

SHA512
ea30327594344c761984d2d524c38023579a406092e12ed47309625c9e5737582ecf5fffabaae2d6e0d1965eefe72e8713e18a481601cf78cbb0518663eac6a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
4KB

MD5
53cc7664a00e7a0a2441740213bd3543

SHA1
da96d74f6d8127ae317de51bef3b7d7052dc9145

SHA256
c178ded715ee318ae4eaadbb4b00d6abae303428ac978d6462aa7a2bfca4ae87

SHA512
1d526f999d30ff447b96dccea3b0323fd236cf78d5f4d9c6101259ce588137865dfcf4b7d04ada6423a734b688425e5a109b8b6a3e3861516bf6f6fc0b3dcbf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
5KB

MD5
85f09c2e8a0634b7a018ee5ad055bc20

SHA1
694dc613fbc728e6a4f4c06f2204b99dac44170e

SHA256
3d139c2faa4282eb77e707b440cfc8133302c2ee4575afca768a14811d9cc416

SHA512
99c02d4f5148b35128c2fb47d7a4c0f0cd62dcbce33a5cb447c2ea3db8d10e23b90bcf66608cc1d157c6b9448e95d4ccb597b66aeb7150074b1c148608891a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
5KB

MD5
dc7dd5a36e0fe9ff6d974a9ff246550e

SHA1
96407f32dca5cd5140284680342b531cc1cabe3f

SHA256
bc5e369e1ff946b6acf3f1a52847e6c6a60c8cd4131fab402ae7e19f6e0d2bcd

SHA512
8234c86f3c769feab1b9dcd6ae47ec9b03d139fa6a868cacd0a43ed10c4d7e28fbb445d9cf0aa3eaf0f3743096c5d5df56d2677377e93ac6c2511f91accb651a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
5KB

MD5
e4bb0557d77c56943d1f1c42bc89201c

SHA1
3fc8b7dc7f6d24dad93d3a217a64be9804c666df

SHA256
a8edf8e375c33f4eac8c62cbcfd930cceda37fe364a6fe0cc60e270261b29b70

SHA512
4cdd042de80eb18a4461f54252864d06dadbf4e92cc0e031ea959dd4dc1c228c16b93fe79485b5cbddb54b06d2f3a1afa619b2a292658efbdc7a0b5181478ae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
5KB

MD5
4df316cbb3f392e4c5788f7554d2556f

SHA1
af38d75226986a1ac287893c61c9cd12a476f095

SHA256
3019c0b7589ae3e3b01a4038091737e5aafc1740d343b30cfbc696bd3df9c59b

SHA512
5b9e3130cd7bf1140f3e67ba38c401bf95d3933fc80a852d30546c4d94b24069721d4c0930f61d8f43408407816a7fc48ae931ba9c5da5785cfb939c0f0a4eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
5KB

MD5
16d16f9eda4bb5991f7df66afa57ec02

SHA1
6a6824f42aa5d16366d64578aabda607de0e4f07

SHA256
a720e82e2274d1933b5091df4c70fd157c6a512faacc8f8b7e3f69574568d720

SHA512
40cda062ff2dbc11a9c341879f577bccbc035404ea9e0c77be9e65c1c5d8e53ea742e22958e2717f6ee6e4a98501996d7357ddd47ad9a2103c69360de1218cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
6b415203e128a6fb54c1fda51baf915c

SHA1
bd0808de1d13cff3f088fcfe922b2e4ca22d40df

SHA256
74f441bcba32700721f35c011232594daaefdadc1e338ab221bb42797651af52

SHA512
7f616d35d1ed3d6996786f8cd5be61aa4b28ca076875b12402190b7777dae636935bb1b5fa3ed6f586b97197901032e7046f96fa8540c1b70d6576cca12091b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
bd0f2cab1056b7afcd42acb991054c8a

SHA1
0ef7c87c76e8ff2ccb6e43325e04b741d94d466f

SHA256
90410611208d3afd856ba715b5ccf5bb888c7d4910c48b91fb15367ba238f43f

SHA512
34bd846bce80a93175622b918e645ac1a83eb74504b7f31d74ee33f8ac837df3bea2469dc844d9209ecef312b9943f500acde92f06f90ec2df36f7e4f92e2650

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
5b4c17318b75ceb4dbfe3a1e5d40a541

SHA1
aca7fab911a3f21c5bf84031521d1c526c96104c

SHA256
d6df9dc0e72d741b96dd202bb1c4687176441e18513fb58d81fa786ca2a99ded

SHA512
03aff8d4b64142c9125049a696f660ccc5ab4c17a27174f2a4b83b5f66f7c0a97f7429fb3a8ca559ee81830822815d7a6dd39d3ab45c89c81732ae00890af329

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
3bd81deaf3579e4e6d6720e972e6c1e0

SHA1
5dadaf3090091695a1607c5f8c03949d71cfb427

SHA256
b1daee78c0104e171f65c33b1d4ad5b5beeffa498fa9d0040db9787aaf1b4110

SHA512
a216c4cabd59f1f737760a94f39a19e53f984b3c2fe3766fc69d23a51e74deef8e747f5ad24ef334240195f6c0d5726198ccccc5962335b3b2e5a9a1bd51a23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
7472f46a9dde1e5bb8c26d89b536ca58

SHA1
d86318c61bfa0ce740f460e85f503a19221eddf9

SHA256
fdc5b8c410badb5ff955d32b6ce99aa73890ef3ec3009d05aca8600fde5eab34

SHA512
a1fb2ffa84aed80d24d7cfb5a36cbe738aa50e77849c52bdaec805f280376cf3970c8b103df29fc2cba15729ecfe8b85b0461f0d074de70b8d77b7b2b6691733

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
8aaa9bd0fda411cfc6f9914e83e23819

SHA1
b405694d89966d475497383fc7ff0100d939c8af

SHA256
61470569845f3aa6a439b5da32cd5573d0313b2b594bd7874059c36f8329be9f

SHA512
dd54a2cf846f1b56f75448aba3ad9cc638b9d66405a3c3d799aefe4940637a810c9aab3d356f4376c29d4ea0c214c17fe5835fa16e5bc94293348dda29c82bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
6a3f7c5972efa97fc138a764af86b5cc

SHA1
3fd35954209cf5e5e2456b4f24036dc658dd82ad

SHA256
88446fa8bd08bcdc284fa974966922cedfc592f58bad76a89eea0c22f562f49a

SHA512
d8735c6fc06e3e802b97aec06d750cf75ab28668946a0723b3735fcf02250c3b01e3d79199292bea9edb3ee4d8ce2bb8329a0f7514a81d5fc7c12a0b66be1b4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
6KB

MD5
da3e44bdd87368be7c49d1527aebe565

SHA1
b52789e54589f7772b4132f0b8b4610888605291

SHA256
7426db44de9a6538a969d0d9c2a2a84c4296f70c6419853bf59af5dbd5976d9b

SHA512
6d4d7cdc09598d0e57543bda075d04f83884aa7fc7465363f81733e15b9dd0cc4420a942be01ea75d81107815e70a2a4a5f23ac6d0f16245f60840602e5a9ca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
7KB

MD5
54fee375d53b2d5c43bf514322db1662

SHA1
4f8ccfdcd28a11a419de90608fc2b04dfcf78c3b

SHA256
8023748ed6ac59e45041ae8fe0bfbbc57fb44b4e431c5076ea960f12ce27317c

SHA512
31cb858fa066c37e2a0366a8819426a0403782c1f26afabc184a5a50d956c236da121f6eb25360d1ca41ebe76e2d4c4147122c94cb98e6eefab21c33e63247e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
232B

MD5
1a6a10dc938914457c8e8d49267f75ad

SHA1
2b3030212e1e80b791917c4f452e2e4ab4840415

SHA256
90b1995841ccf9fbe6242395e9b0302427c214e52a5523261571bdc38f183344

SHA512
3160c4671d23758cf6de63f578da3de20452ba3f438ee48bd908ccabb7d4b3891786b766920ef9c14ccdf76d75dc5d61200876df777f83465b20773b0aafd9b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
268B

MD5
03656304407aabb2ec93c68e9211d3a0

SHA1
23a41378292f90654f14d9a57d07d162b476b57b

SHA256
ebf9fe68724154a9f11dc2ed9cec89c2b1a47022bc9c8ad843414af59041bed7

SHA512
d46e3494a184aa6e2d18df3b34ac3b40dbd343812fbf63a2eb967a92b49f5d8785d374e8109fdec3dd228d169f930858bf22e9f257fa81d18d6d6b663bc28d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
282B

MD5
1899fc733a7b2e91802fddabc83df124

SHA1
971acde3d3c6cc0f74cabd088271073af853bb66

SHA256
90132f086073f62edd63720364c94a2555948588d5779e57ffa6337b2145bcf5

SHA512
e503491a7e8c177f0c414a50128baeff2c0c8ec917263819dfc6e3843ac7647ec2e07bc4f36d684042c0b23f8f1dab9343ddbb9bc3e10d682e622c22537e5023

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
305B

MD5
199e1a4b48f1f6c0e951271d21e51eb7

SHA1
157d3be2ddde3804780647fc8c31f45dd69d6408

SHA256
8b17ddb415f4da6edac2f027b375478bae82bd0c576adb5aff9fbf5a035af989

SHA512
0fd5ca93ee897204e2654fb1e299caa5ac64ed372dd4d13a3eb7f38f1a021aa58ec412cd391770066643936687d271ce36028438c42712ca2e2bdee29ae965d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
305B

MD5
af8ab66fc06044a91cb9c27fe3d91dea

SHA1
aa5d16be17cf1c6f75da0b1132f27aa8c5ad6421

SHA256
e323ebffbb3ed951c6fdcd1f9f2cb9d992169001b3223e1ba6b126fd6a2d595f

SHA512
36bac23716ecf8368e13e1307441f3d521bde2c8c3ca11b83d944a1ba99b84083a4ecfa13a760c54c769f052e63b0bd80db9ab588c7f363c3a6f6ecb28ec62a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
338B

MD5
17ae607d4d931eda01286e2e3a58a70d

SHA1
810984ac674467dba42e1ccbb7934d35da58bcd5

SHA256
1cc8a317fa29489731a34e84f603baee97e475746dc13cf0a4950e0f3284ba9f

SHA512
a2f0a84b713ff56281b8b338e7743604940fc36fa509751d72f5e75a7581f9f5bb5538cc5b53361360ece5ce0e68ff7636f64df7f549097a3f39c83c4c4b40e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
2KB

MD5
c35facb9d658f6edd3f410a17f72b8e2

SHA1
512ccafc873270a7b1b3be6a1c89d2a3cff85d7e

SHA256
778b8eb027951d7b0aa7fcb58ee776510ac24a499d891f8d6fc3d2937710a493

SHA512
f6753c2ea9729fd3601c9ebcdb5f83ccd10452b860de9f6974d2ef975309e411393b3853962d2cd666449f1ecea3beeac57449226e37cd20b79dcf3011cd67b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
2KB

MD5
eb2abbc41d901443400c1845a9705b7a

SHA1
485ab2bacb3e6f275462725ed9900d98dd6d683e

SHA256
f09597ff48d274621d8d6882b53d2578e297877032c9d4dcfbf0b4b46f115f9d

SHA512
c979c602c6819774765d4ded7221fbb7f58227c672406775e437284bcb80d1e21bb8408bdb8559b82637ef02afd4cd8a3e265cf97dfd6f55855131f2d883e039

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vis0000\Uninstall.log

Filesize
2KB

MD5
3c7eabde00d8eb43481319abba37c3f2

SHA1
9736bd893c674b808f0870f724115ed46267244a

SHA256
d31c247ac1e30fd30c6e9206ebc7d3e08013c2097d3b9e00fa3f6fbb1d4e2440

SHA512
d8ee6eafed23d1606971752841db81285ad2982fc59409d2cfd2f5c7f859eaf9a1ce560ca99f9be44a81bfe4e4882dc286dadd4bba03c706180d445a767822f3

Download Submit
C:\Windows\Installer\MSI407B.tmp

Filesize
76KB

MD5
aca45d29a6d4b8b6f5bec262f10bbfd5

SHA1
adedad9ecfda50861c5f426442d12413a2392c64

SHA256
3ebb755cb7cc4e4f6d62b0bfc0656300941f4ec255fb3128378dd1453f943b06

SHA512
6bf7c048b41479a5521f88926ea3c6048423ab42b950a220f44c79d3d4ae4a3244581a2a666cb6d6d977425f8efbbbb1c9d2ae69c11e59a3bfabb15a9e2d7c59

Download Submit
C:\Windows\Installer\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\NewShortcut4_8C3BCD70236347B8A53EEE8A82FD5C78.exe

Filesize
128KB

MD5
1d0c499a90aec20fd83737e5f6607bf3

SHA1
4221622ae6a777277a17132d245d4f35bce8017d

SHA256
1c9a5792e5a2a4cbcceb2b603f596df310ddff25ed057057d254ed4d04f8008a

SHA512
84d3cdef9c407216a241e8116d8439566ef4659f1ab93e68483814bda52256a4e9f74551c1bb5edad024ec0a22b6b1399e01f98e1b696ef0d88dbaa48f125466

Download Submit
C:\Windows\QTFont.for

Filesize
1KB

MD5
bb846c45c09d179801cc7ebb6dd5c516

SHA1
b6fb489f5bbbc2b8d2e19a5f42b430135ec9c9b7

SHA256
cc123516530c4955919b0b6a10e527086d71c852f87c8f9666be4fe15ce1ac22

SHA512
1dd93479d6c3fe32588f724729c6a0894c0a1d3f4a6aa754179580341267410ab7a3044fef7273c2c31195382598a140a8ed3b5da1f159f31ebb365968f378f3

Download Submit
C:\Windows\QTFont.for

Filesize
1KB

MD5
f2d2899850cfd1124a455288a70116c8

SHA1
64a48ae7f4563a633de23ec0aa376652745e0cf1

SHA256
e4c492ad3f29882e8f7e0352a59c5b1c28c88324c2c71ec9fc16eb9c109d3b7a

SHA512
56071e625ad6b5595d1ebf6c2cd6e4c4b5c2da62c39291969627e403301b67dcc6f59bcc438474668d4bd515496d216c392a7eeabfcb776b8b193ecbf17fafc0

Download Submit
C:\Windows\QTFont.qfn

Filesize
52KB

MD5
dba91cd5a3a68302967c03213e52bde8

SHA1
8188a5832590c810b08ee3a2f1567afcdd094108

SHA256
1a355634a47a01ce03e05328c2835a86926818bacdcb663db2136d691319dd18

SHA512
c1afd1304fca65d1bd39a43fad5dc7a6c8528c225a019012163dde2948b82455c2616e27db2c03c03ac85e5c7dff77286688aea75b2355e5dce3c71c78526f94

Download Submit
C:\Windows\SysWOW64\Indeo4.qtx

Filesize
729KB

MD5
555aa17a9d829b149585dd9f0862d7ee

SHA1
21f3f7a3d1d4156cf994fe6f0ddae439f42459ed

SHA256
9b7893e976089496958a5472e4eabaa93118c3b2f66b53e7d0886756f8e4483c

SHA512
2f42b45c5231507d774fbf2fdc7ed1fe86209030e90b2e46c188a23edb48cdbd0611304cd23fa81868bd2ca2b1ee58847466d88985f099bfebe421f83c96b16b

Download Submit
C:\Windows\SysWOW64\QuickTime.cpl

Filesize
315KB

MD5
7c3cdab15a6d6b8627e835852bbd2ed3

SHA1
2b7cdb854f6050ec4f476653f199c78b6169bb1f

SHA256
6bdedd070f03d8b14f2065d743acb4d9b8a21b92b1e6cd94330127ddcf4e6402

SHA512
cbb8fa157baefb582c94ca871e92c65216e810c3a3d2a684e55cceedfec78df6b5e503c4d595c97e62e3959bf5418640785c899c8221508bbdfc091ced12f2c6

Download Submit
C:\Windows\SysWOW64\QuickTime.qts

Filesize
6.4MB

MD5
e99d9f9124bc1bab89be9d3992c17d7b

SHA1
dd31fc4c7de386543fb77c01e05f9bef019a380a

SHA256
d1cd0df10e83ce1b10c482f3f1cb28dd6a2f7e5cf631e3e9946168a8652626b5

SHA512
91a3f29a07c7caaef384a521fc298a3d1fe702c2dc516700958d08dd85b33c5aa391768bf37cd844f13ff72bcbbeff5aee50ea116dc1c16ceed59f87f4caf4dc

Download Submit
C:\Windows\SysWOW64\QuickTimeCheck.ocx

Filesize
68KB

MD5
401c3cf9cc1b8c4edc61fa007283c7a2

SHA1
199ec50550e6cf554455833c016872526fa5516c

SHA256
13ff6b94cf247e26c52e9d13226b2411c0e122387d2052cf3df93da44468f6ce

SHA512
18d824c4d3d7ea9a99f430c5704ce59ad64ce796ee6edc1a1269022780dc2821fdb6e8bbfe9b9c29b0c1b6fd6fe01539e96e08f6abce4cddda358aa826ec07f5

Download Submit
C:\Windows\SysWOW64\QuickTimeMusicalInstruments.qtx

Filesize
1.9MB

MD5
7a09c9c7612cad995f3b2d521e766669

SHA1
1b4600c01d1e52f3a4cd14ff8233e45511ae879d

SHA256
f267b0e53051f8817ef54b582efabb088f30e9ee308e9fde95c150230823ac0f

SHA512
7818d98ed5e6ec965402861a9735dcef1529632aa2f9f0a05a560780d580538439572d485afca6c438a53b4b968874205cc897a4cd1d5e9cf7f393e5b8c52925

Download Submit
C:\Windows\SysWOW64\QuickTimeVR.qtx

Filesize
420KB

MD5
09c315fc43a18ad2f66fbcc228f7e529

SHA1
37073f1e9a287c130aa5973b0e8d51d2cfe6410e

SHA256
632d9faf86c30d7958b454f9cdf3bfcf5b3e229a4d09c6f689414d3de9771d87

SHA512
a67448655f49b41ca0bb2294376b11e63cef58e8421cfc14b8ee76dfd1b2f77892272f70d40befc14692ae044d1ff2464a35b535218226c8951159213dbeef09

Download Submit
C:\Windows\SysWOW64\QuickTime\QTPluginInstaller.exe

Filesize
412KB

MD5
df35a8275edb84b88481615fcd97d0c4

SHA1
f2bfe9493f11e3d8285350a8bb5a4ccb410d2afa

SHA256
c1f4ce9fc1bc8614ac37e48e38863ff46ad52a2ad5aa10d0dd1e379afafa472d

SHA512
cc0023261fd4fba9155a25fcc45cbae2bf053b3e184785ccfafe9a2dcd2ab5d480dbe104c169a3bb0143a447675148e46eb2efd52fd3acbe7c7a1885638ddff1

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTime3GPP.qtx

Filesize
597KB

MD5
a66c07dd0bca58d820da3a6712c97288

SHA1
e80812c4d95e37840890c65cff86fc57ea7e0031

SHA256
6c5f2b0fb780479fc8432ea5162c78a81314e14b809c4d07590a2f947ef1c6b4

SHA512
63d126ce9a3d38d3cd3d8e2e5cb27b16340089d414a103c5ea9cdc0fcd79824392292dc9baebdb4a95891595ad50809bc78e1c38ce5c47433f508fba387f2d5c

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeAuthoring.qtx

Filesize
1.8MB

MD5
b68be9c8760f6033135dbd5b55a6e463

SHA1
98ae89abbf60b44697bf08420beb0ba33d653ac1

SHA256
8abe8bdf7d12fa16754145564be0984a50b274eb7bca8214da7dbd08dbce6286

SHA512
76897fab01e6d82378ac7497ed64800b3d6649073ecbb6b88f782bf5ca1ad224b92df009fffdaf167bf9fc1ff35822a62a8a53a5a279f4ee32ea22d911cacbc5

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeCapture.qtx

Filesize
298KB

MD5
8c7742a57e4587f72504d90f54ac78af

SHA1
8a8a0ec6be224cd0b7379c8886a979dbf7cf2eeb

SHA256
0256a868a2757b680e38bc2f911b92817705688160276cbf8400a308846b0950

SHA512
4ef6fc2366099aa3ec3561a555267018d7ff8d1dbd1096ce3584017aa6cff5f8a399512fcc4776a5494c34a75f2329b2fac221ace38f97051a92f83ed4a037cd

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeEffects.qtx

Filesize
618KB

MD5
2ffbe67d576d4be68267765822ee0fdd

SHA1
ff15040a20dba69d1c3a2ce186156f6848272b01

SHA256
4c2bf256ef227826fac20886048d0a3a1c9c440513b57cb294abb62378d50dfd

SHA512
e7aba909df77e2d8f850bfcabfdfa1cb43839995f0b08ac022a0fa26ca223aed313528e03b572ff25b47b6277d2776f30a6d2e22e7f2682ac5928e2a17d11d5c

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeEssentials.qtx

Filesize
591KB

MD5
4ce70ddb8be46deb1ea3751a4d17e00a

SHA1
e51706abe78ff3a00af381b781f93f0926641cf6

SHA256
d57ccf7ce8eeb33e093ff7f870effba5bcfea49adc173db7554dbd301df0946f

SHA512
cf7a9e31cdde8acba5659c7d5802c1c1e61de88e9c42f654fbe5e2e98f3a852e288b301b39f1801257bdf60278caf6810b8a9f23125aaf74c251a4667e333c27

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeImage.qtx

Filesize
548KB

MD5
58f64d9c5f7e644e217627b0e29b8800

SHA1
9e31531744e20414d87b3dc30cd14868ab30148b

SHA256
95adb37cfd05517865fb3c13cd30a134f33bb4947d36ac9d9b976d2d43c06109

SHA512
0859583d97ed4f628041c3717baa86978f0d68a78bf9b220584015f15dd95fd6cd692c3dcbeb3ba7165c13c48ab14925745def3b8ac57d55c39a3a68b79d06cb

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeInternetExtras.qtx

Filesize
921KB

MD5
ca02ca89ac3777f4cc52773003b0153d

SHA1
d124a4f2467cc5df617e890db4e0b8594ae8ec69

SHA256
c488d073e6ae92421e07184844a7a5800fb68efb69263861d6ba4922194ff469

SHA512
da6a0da8ea5d647244ea59465ce3474e5c97d5eab2a4eb3ff1086ee00c54891fb243012e73da3ad265bc8fc10ade5274b5d6dfa3ac76148ef78974daa9e1283f

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG.qtx

Filesize
429KB

MD5
f8d848d9862d1af6c348dab34e967c64

SHA1
00aa10afb7680476b0c6480025acd493ef22e171

SHA256
aa3eba8ddc647216b2a687e3e99d243f202a34de656a02e5145dd32b186519ff

SHA512
223c0e8814a49e945f40faf4cbef044bb26e007ab56f2b471e6270c4bc359e6aab49fdcc11cfb32e9f30b9059e9c05c13fd083ebc5b6205fb78f98533225bb3a

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG4.qtx

Filesize
462KB

MD5
7ec7ef819108509a93fee0d11b0a90fa

SHA1
1b08c7f67c504108a9ec9fa3c1792fe9478d470f

SHA256
a6cd66b6409e91615969f9a7db6ba80f6002b154f969dedc14bfadcb950a4c5e

SHA512
0b6cbb4307e43d2c8550024d7c67c2350882368b6a2799a699971157deb67d5e159b92574b99bb67a9bd60cb4d7e78a69110d72f3f2aa6b13138ef62173f8808

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeMPEG4Authoring.qtx

Filesize
732KB

MD5
7834e5412dd8d84a424ab4057dadf6d0

SHA1
c9404ecd7da2fab10117c09905d6fd498dbdbdfb

SHA256
296d6757051d180ffaafe0779b5a266e555b069ea197bf6e0ee75f630fd3248d

SHA512
cb350aa999dee6e2bec2d68b2e0e0f5866614f1d4d1440d40e4d5665a691ebef180ba6f31ba12da94aa9e395c92f05e59a17171f52f742207a65148453c48785

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeMusic.qtx

Filesize
587KB

MD5
7ced498bd50fd0b8ddec121e222a4789

SHA1
e7f6d5525f717a4cf19de39e0df745b7f75d2fe3

SHA256
1107080da03d316c7f4312ea3ede76120d6be67f306e5aece45603004fb178c1

SHA512
dd3ef7cfb2e6bab17e142e0bce85dbb583f5ee1372408cd9d855d2341576c5640726f2e5382ac2887a802de6cfaf11444ba407d6d0317d40ece6182802f384da

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeStreaming.qtx

Filesize
783KB

MD5
45afcc5c4311142d8f893fa7f88e4c28

SHA1
acd2858e9249e265213808d85c1acbd44a69805c

SHA256
3e9f149a642d0909e880dd8b8cf01fb9922184ea9f2d67835bfdc6d92568f429

SHA512
9b047720335a248b297b384bb5064f4eae622841b621e4de3308111c2cb6eb0ee02d26515133b6a857f4fc7ca2d7590fe17125ecf921ba88f7e1f222e6b50d24

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeStreamingAuthoring.qtx

Filesize
309KB

MD5
5720f5daebaccc7df749091d44122947

SHA1
f842257cb9e0669fddcfdefca291274634ad975d

SHA256
5a5f1aefe336bb62008768948b941d1954733546f7b0d31e24ccc912dd905440

SHA512
248407b249edbf25371be2ea931916186c1d395415b2ca9f99426635f92f2e05c533050bacff4a18c3730fd3a561db3f84eea4dbd59d18929fa7960da5baad70

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeStreamingExtras.qtx

Filesize
123KB

MD5
452d0bd806480c4526311f09df6ace61

SHA1
9f0c693479ad5bae61d5ac71fa65f2c17d767693

SHA256
b5f0d50aa83824ade0659c6dc7fa7d5d78fe91eedef4f1f50fc6fc8c148b248f

SHA512
70064a3ccc60f1a80b3b317196bb264e778e1d9fe7bccd2e079189b0d32fc73c806ca8dc71fbaeb3f79928321f715440c3d099bd207e562e71f44cf636dd8d9f

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeUpdateHelper.exe

Filesize
68KB

MD5
57fa52441f2a6f759ff369ba9cbe617f

SHA1
6c2d29f9ae238d8e0b3945ca424cb889c113b49c

SHA256
a9bd9e8fec9d2ebbce2f63e21f50339de28087db1ec841507218fa6e96e57c89

SHA512
27b14a9cea20972a224e2a7f0d41e601c36f2fad03807b5d46201c1de067058b279fef6caba7cf5c197db0a89907ca723793b6fcdf80d46958e58a11232209b4

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeVRAuthoring.qtx

Filesize
208KB

MD5
108d81f0443383a8c058b7ecde5e869f

SHA1
4df543ad6991aded22d9af0c43a1161821fff81b

SHA256
ead1b4f0fb3ebdd3565bcdb019a6b50aa84d6dd7610ab1403d02b1902872e22d

SHA512
a6bd2b50b81f90d498d223cb25c71bcbfe246c9b93179db5ebdcdb1c7617ca056dce9673be99734d9d80ae2f1f52e9ccd62c92c04361edb3fb604cc6c49c4e8e

Download Submit
C:\Windows\SysWOW64\QuickTime\QuickTimeWebHelper.qtx

Filesize
401KB

MD5
3cfe3bba50e3ff2bec1e8b2d9cb6b8a7

SHA1
744d68d520e5886f11f0989caae6a2888ce1ed6a

SHA256
7eefe6d1c7b4a312d607fc71edea45e60442ff25538fcfb60bf51abc91132c99

SHA512
ee16415c62b6b3f070d7aa1ad68e4e0890949572e4bdbdc89f0b9caa42df028c07a1d33d80de7bae6da2f1253773ed99cf889e9a08d7103720243ee8b3bead22

Download Submit
C:\Windows\unvise32qt.exe

Filesize
84KB

MD5
23a458e8eb269a71a29ada0cb3e22e65

SHA1
ed89dac3cc37f2d47f2df0824965a1bac8f4638f

SHA256
e55f951b5951b2299e2ad562a97cf3d7dd5ccc869ef9144d4bdb87df37cf2a30

SHA512
f186e209f34c62e42b2dcdad5bdab1adee5a37f878cbc0f71463f7ce906b1b443da43ba73e0e788d5ce1950dafbeafbb2ac5fac1da048d2a12c62ac6aef2b22b

Download Submit
\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IScript8.dll

Filesize
232KB

MD5
ffeba6524ba6b2737e765e1f07e64184

SHA1
e2ed713b8eadfdf64e2be7040c35caa1694456a0

SHA256
cdba886320dc16ad24607db02ac0303382c01d8ce77dd6de4d55dfaa9ffec99d

SHA512
da50948f74d99d84ad930e16b0b2956208b6fdc3c729da59f9bf99c3c9a56e1c7b78f1f281ad9a36eb8756e4a61e21a3692f271b40085d500135abfac1a86cea

Download Submit
\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IUser8.dll

Filesize
184KB

MD5
223dc0d36a316f8d330bf989a8f7d31e

SHA1
eaf3fef5f498dc0051e250ab6f12f64787f5e383

SHA256
d50c64269d45dca0f52a7722e3bd3fc0390cd1d9b942d6be1b532a414673a328

SHA512
71530ae0fbfa965e2cd98fbb5e33e37dbafc35cb4cfa8aa98c3b2756c4a43039b0edacdeea5841b511b753b0da08b48e957512c57079b79650578d7531e46283

Download Submit
\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\objps8.dll

Filesize
32KB

MD5
b7b39587207b0dbfd5c11745fe34836d

SHA1
d67ee42eb26ce87739a7213cde239e1ef99e969f

SHA256
d6261eb82445ecf2d107cdd12e261ec53c3b31aa0478bb8aab135af53f294833

SHA512
42bd9097ca52284b715a2e2074250f0c01203cc75055e8a763442a4717efee7c40b87d5c6af4fdb73779e9335723298a6de1eb309a9b5114b03f62201870eb4e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC4A6.tmp

Filesize
104KB

MD5
0cbadcbda4648021c05f19150147cd06

SHA1
db8b13de6a64ac4d65969b316ac9f0a8a67ddbe0

SHA256
814515c71e77e36bea8e0c062c23bb19d90e4c4f18c3e77142b7bff5ee7c3ed5

SHA512
5d4d9cb3e434d13c99eb1688a16404135c4438375f19479d3fd4899d5002cdd7c98a7db35d4b2c352a202eb8b50dccf5b41633a304808a6c7fb8beb0819828db

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC776.tmp

Filesize
60KB

MD5
0d1bd6352e9dff52829acb137d4a2676

SHA1
3488ec4059b67b4282ff38ac69609f605be8402a

SHA256
df50c0242690c81b6b1ccc43d7a95a1f2a2c0b964652530e8e7582b0d15a21b3

SHA512
fea48100b2da0f757f13be1c4058cb5607932bcbc1e4c7a21ae646df97cae0272c665b4e7a44ca5b0da616d6eedcfa256529b344febf9913b5af6cf5b6b95a0a

Download Submit
\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\IGdi.dll

Filesize
156KB

MD5
5aca67afa03a9c7f6204591431b1cde9

SHA1
51cd401b7c0449aa40eda31102ccfd5e2159c141

SHA256
cb7b75bdfed1afa37c3b177b2a03d5aa0c5a62a917522e7f6b8edfdf3200400d

SHA512
2a5e36d45148c52b1f1d8d7bb9b45951af2148369cf53f04821591b002d1418b16d3741a39143b4ca80f39f10cdd74aea3fcf5294bec2550b29bc58e1818b4f9

Download Submit
\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\QTInstallInfo.dll

Filesize
84KB

MD5
e32517ce1a61b7db33ca582f89c9fa92

SHA1
fa1c39b443ce70348382ec06becd7f726a9276b6

SHA256
b510211c82deb866fbd6606fc96fec5c690ed83ea20c92962e1c6d4437ec5231

SHA512
f3f17b1eb3fffad61b16c9369dcfc1caf34a1891a09728b4af905f85ac52a97b0d9bfc700f4e27585d9c9ae5ef4e15a33c02ccee375225740142b9d54e42aeae

Download Submit
\Users\Admin\AppData\Local\Temp\{BE20E2F5-1903-4AAE-B1AF-2046E586C925}\_ISUSER.DLL

Filesize
192KB

MD5
c5438e4dc83275e8d281ef8af6e17b23

SHA1
e5f1ab94522ca6c99da70e600b250398248422ae

SHA256
0be25dd0a2a7f2b15a0629cdde753fc5ba1ec61d828862f382f566052d8265c2

SHA512
cc5d55472d7296fdb8fedd8f35484e56bf76cb102e4a0e6c245c64524e46540fe7a9c03b34f621290bac2ba9e726ccc05485ad2a59f579935ec2a1016e53718f

Download Submit
memory/812-202-0x0000000000190000-0x00000000001AC000-memory.dmp

Filesize
112KB

Download
memory/812-2335-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/1052-2284-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/1052-360-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/1080-183-0x0000000005BF0000-0x0000000005C06000-memory.dmp

Filesize
88KB

Download
memory/1080-170-0x0000000005510000-0x0000000005562000-memory.dmp

Filesize
328KB

Download
memory/1080-166-0x0000000002220000-0x000000000224F000-memory.dmp

Filesize
188KB

Download
memory/1080-178-0x00000000057F0000-0x0000000005818000-memory.dmp

Filesize
160KB

Download
memory/1080-2158-0x0000000000CB0000-0x0000000000CC4000-memory.dmp

Filesize
80KB

Download
memory/1784-1840-0x0000000004730000-0x0000000004761000-memory.dmp

Filesize
196KB

Download
memory/1784-368-0x0000000000250000-0x0000000000264000-memory.dmp

Filesize
80KB

Download
memory/1784-2283-0x0000000000250000-0x0000000000264000-memory.dmp

Filesize
80KB

Download
memory/2592-2374-0x0000000000400000-0x0000000000CE4000-memory.dmp

Filesize
8.9MB

Download
memory/2592-2382-0x0000000000400000-0x0000000000CE4000-memory.dmp

Filesize
8.9MB

Download