d1c3690b4b7a5a955f9b4c1e19493437c7e057f668a8f3b0bcb511261d23528d

Analysis

max time kernel
99s
max time network
108s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3uTools_v3.17.025_Setup_x86.exe
Size

193.4MB
MD5

1053009a1066b9e155fff9e9745a7368
SHA1

297aa07257a87cb55e81bb2902f419c47f410ce2
SHA256

d1c3690b4b7a5a955f9b4c1e19493437c7e057f668a8f3b0bcb511261d23528d
SHA512

f66357d8580b7de76f8a3f149fceb9445a7b1a595599b0c770e84e2aa9fc2751c92b427bcf7849a616564c1c60377ed66e31a58af21a8e8e74893e031807343f
SSDEEP

6291456:/p99hBcrsudS5yaLZ/7TFqN0mnIEwUE3WNoZ8:jyPd7G7TkN54WNq8

Score

10^/10

discovery evasion persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1852	takeown.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
266	2572	msiexec.exe
268	2572	msiexec.exe
270	2572	msiexec.exe
272	2572	msiexec.exe
274	2572	msiexec.exe
279	2572	msiexec.exe
281	2572	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\Geo\Nation	3uTools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB56A.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\usbaapl64.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2ED.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB56A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\USBAAPL64.CAT	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2EC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\usbaaplrc.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\wdfcoinstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\netaapl64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netaapl64.inf_amd64_neutral_56f23639c9617984\netaapl64.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2DB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2EE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\netaapl64.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	pnputil.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	pnputil.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2EE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_neutral_c0e4d8c2aef471b7\usbaapl64.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\netaapl64.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netaapl64.inf_amd64_neutral_56f23639c9617984\netaapl64.PNF	DrvInst.exe
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2EC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2ED.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	pnputil.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}	DrvInst.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\usbaapl64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_neutral_c0e4d8c2aef471b7\usbaapl64.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2DB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57D.tmp	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\OpenStreetMap\geocoder.png	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\files\Cydia\Cydia.tar	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\resources\icudtl.dat	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\itunesDll\asrp.dll	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\libphoto.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\postproc-55.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\cache\devices_table\border_14Pro_DeepPurple.svg.tmp	3uTools.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\resources\locales\hu.pak	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\OpenStreetMap\images\marker-icon-2x.png	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\inf\InfInstallerx64.exe	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\Qt5PrintSupport.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\api-ms-win-crt-multibyte-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\pt.lproj\Error.strings	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\cache\hometmp\03.png.tmp	3uTools.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\SQLite3.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Schema.plist	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ja.lproj\About Bonjour.rtf	msiexec.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\iCloudDll	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\ipa\u200.ipa	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\translations\qtbase_ru.qm	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\translations\qt_pt.qm	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\Qt5WebEngineWidgets.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\plugins\audio\qtaudio_wasapi.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\cache\devices_table\border_16pro_yuanse.svg.tmp	3uTools.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\id.lproj\Error.strings	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\de.lproj\Error.strings	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\translations\qtwebengine_locales\hr.pak	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\resources\locales\sv.pak	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\SMS\images\TIMLogo.png	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\Uninstall-Ext.xml	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\files\NOOTA.mobileconfig	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\Openhiddenncm\InfInstallerx64.exe	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-utility-l1-1-0.dll	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\record.db	3uTools.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\Foundation.resources\en.lproj\Document.strings	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\uk.lproj\Error.strings	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServices.dll	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\translations\qtwebengine_locales\ca.pak	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\translations\qtwebsockets_ja.qm	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\patchtools\7z-64\7z.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\itunesFlashDll\libicuuc.dll	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\Qt5Pdf.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\ASL.dll	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\translations\qtwebengine_locales\mr.pak	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\locales\images\ru\icon_ipa_type.png	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\files\OpenStreetMap\sear.png	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\itunesDll\libicuin.dll	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\Qt5WebEngineCore.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper_main.dll	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\itunesDll\libdispatch.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\Qt5SerialPort.dll	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\plugins\virtualkeyboard\qtvirtualkeyboard_hangul.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleVersions.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\Mingler.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServicesUI.Resources\SyncServicesUI-Info.plist	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\resources\locales\zh-CN.pak	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\files\GoogleMap\map.js	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-filesystem-l1-1-0.dll	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\idm_jb.dll	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileBackup_main.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\files\PrintTemplate	3uTools_v3.17.025_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\x86\translations\qtwebengine_locales\ko.pak	3uTools_v3.17.025_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\x86\files\GoogleMap\click.js	3uTools_v3.17.025_Setup_x86.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA692.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB137.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File created	C:\Windows\Installer\f77a1c1.msi	msiexec.exe
File created	C:\Windows\Installer\wix{F9CEF01A-3907-4614-824F-CF5D3E4675EF}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{F9CEF01A-3907-4614-824F-CF5D3E4675EF}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA75F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\f77a1c4.ipi	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB81D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8D9.tmp	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA790.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9D4.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a1be.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBABD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a1bb.msi	msiexec.exe
File created	C:\Windows\Installer\f77a1be.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBBA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA770.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBADD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBA9.tmp	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	pnputil.exe
File created	C:\Windows\Installer\f77a1bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{F9CEF01A-3907-4614-824F-CF5D3E4675EF}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\f77a1c7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a1c4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7A0.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCC7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBCA.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a1c1.msi	msiexec.exe
File created	C:\Windows\Installer\f77a1c0.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A10FEC9F7093416428F4FCD5E36457FE\14.1.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB50E.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 11 IoCs

pid	Process
2876	3uTools.exe
964	updater.exe
2384	3uViewer.exe
2184	3uViewer.exe
2728	7z.exe
2712	AppleMobileDeviceService.exe
1748	mDNSResponder.exe
2108	InfInstallerx64.exe
2016	QtWebEngineProcess.exe
1600	QtWebEngineProcess.exe
1836	QtWebEngineProcess.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2816	sc.exe
2796	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
2648	3uTools_v3.17.025_Setup_x86.exe
2648	3uTools_v3.17.025_Setup_x86.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uTools_v3.17.025_Setup_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uTools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Apple Inc.\ASL	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Apple Inc.\ASL\filenames\asl.log = "asl.184353_29Sep24.log"	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Apple Inc.	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1523EA646D34FC14C8FD9E203C58611D\8BFDDD6597F70844985D521E5FA22BF8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8BFDDD6597F70844985D521E5FA22BF8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService\CurVer\ = "Bonjour.DNSSDService.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\CLSID\ = "{5E93C5A9-7516-4259-A67B-41A656F6E01C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\NumMethods\ = "14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\ProductIcon = "C:\\Windows\\Installer\\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\\Bonjour.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.TXTRecord\ = "TXTRecord Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\NumMethods\ = "9"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A10FEC9F7093416428F4FCD5E36457FE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDRecord.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\Version = "50397184"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\PlistEditor.plist\shell\3uTools	3uTools.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\PlistEditor.plist\shell	3uTools.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A10FEC9F7093416428F4FCD5E36457FE\ProductName = "Apple Mobile Device Support"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A10FEC9F7093416428F4FCD5E36457FE\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.TXTRecord\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\ = "DNSSDRecord Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ = "DNSSDRecord Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OutlookChangeNotifier.Connect.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32\ = "C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\OutlookChangeNotifierAddIn.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A10FEC9F7093416428F4FCD5E36457FE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\iTunes.ipa\shell\3uTools\command	3uTools.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PC3uTools\shell\open	3uTools.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\iTunes.ipa\shell\3uTools\ = "Use 3uTools to install"	3uTools.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\VersionIndependentProgID\ = "Bonjour.DNSSDEventManager"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	QtWebEngineProcess.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	QtWebEngineProcess.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	QtWebEngineProcess.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	QtWebEngineProcess.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	QtWebEngineProcess.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	QtWebEngineProcess.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2876	3uTools.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2648	3uTools_v3.17.025_Setup_x86.exe
2648	3uTools_v3.17.025_Setup_x86.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
2712	AppleMobileDeviceService.exe
2876	3uTools.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	3uTools.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	3uTools_v3.17.025_Setup_x86.exe
Token: SeDebugPrivilege	2876	3uTools.exe
Token: SeRestorePrivilege	2728	7z.exe
Token: 35	2728	7z.exe
Token: SeSecurityPrivilege	2728	7z.exe
Token: SeSecurityPrivilege	2728	7z.exe
Token: SeShutdownPrivilege	2876	3uTools.exe
Token: SeIncreaseQuotaPrivilege	2876	3uTools.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeSecurityPrivilege	2572	msiexec.exe
Token: SeCreateTokenPrivilege	2876	3uTools.exe
Token: SeAssignPrimaryTokenPrivilege	2876	3uTools.exe
Token: SeLockMemoryPrivilege	2876	3uTools.exe
Token: SeIncreaseQuotaPrivilege	2876	3uTools.exe
Token: SeMachineAccountPrivilege	2876	3uTools.exe
Token: SeTcbPrivilege	2876	3uTools.exe
Token: SeSecurityPrivilege	2876	3uTools.exe
Token: SeTakeOwnershipPrivilege	2876	3uTools.exe
Token: SeLoadDriverPrivilege	2876	3uTools.exe
Token: SeSystemProfilePrivilege	2876	3uTools.exe
Token: SeSystemtimePrivilege	2876	3uTools.exe
Token: SeProfSingleProcessPrivilege	2876	3uTools.exe
Token: SeIncBasePriorityPrivilege	2876	3uTools.exe
Token: SeCreatePagefilePrivilege	2876	3uTools.exe
Token: SeCreatePermanentPrivilege	2876	3uTools.exe
Token: SeBackupPrivilege	2876	3uTools.exe
Token: SeRestorePrivilege	2876	3uTools.exe
Token: SeShutdownPrivilege	2876	3uTools.exe
Token: SeDebugPrivilege	2876	3uTools.exe
Token: SeAuditPrivilege	2876	3uTools.exe
Token: SeSystemEnvironmentPrivilege	2876	3uTools.exe
Token: SeChangeNotifyPrivilege	2876	3uTools.exe
Token: SeRemoteShutdownPrivilege	2876	3uTools.exe
Token: SeUndockPrivilege	2876	3uTools.exe
Token: SeSyncAgentPrivilege	2876	3uTools.exe
Token: SeEnableDelegationPrivilege	2876	3uTools.exe
Token: SeManageVolumePrivilege	2876	3uTools.exe
Token: SeImpersonatePrivilege	2876	3uTools.exe
Token: SeCreateGlobalPrivilege	2876	3uTools.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe
2876	3uTools.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2876	2648	3uTools_v3.17.025_Setup_x86.exe	31
PID 2648 wrote to memory of 2876	2648	3uTools_v3.17.025_Setup_x86.exe	31
PID 2648 wrote to memory of 2876	2648	3uTools_v3.17.025_Setup_x86.exe	31
PID 2648 wrote to memory of 2876	2648	3uTools_v3.17.025_Setup_x86.exe	31
PID 2876 wrote to memory of 964	2876	3uTools.exe	33
PID 2876 wrote to memory of 964	2876	3uTools.exe	33
PID 2876 wrote to memory of 964	2876	3uTools.exe	33
PID 2876 wrote to memory of 964	2876	3uTools.exe	33
PID 2876 wrote to memory of 964	2876	3uTools.exe	33
PID 2876 wrote to memory of 964	2876	3uTools.exe	33
PID 2876 wrote to memory of 964	2876	3uTools.exe	33
PID 2876 wrote to memory of 2384	2876	3uTools.exe	34
PID 2876 wrote to memory of 2384	2876	3uTools.exe	34
PID 2876 wrote to memory of 2384	2876	3uTools.exe	34
PID 2876 wrote to memory of 2384	2876	3uTools.exe	34
PID 2876 wrote to memory of 2184	2876	3uTools.exe	35
PID 2876 wrote to memory of 2184	2876	3uTools.exe	35
PID 2876 wrote to memory of 2184	2876	3uTools.exe	35
PID 2876 wrote to memory of 2184	2876	3uTools.exe	35
PID 2876 wrote to memory of 2816	2876	3uTools.exe	37
PID 2876 wrote to memory of 2816	2876	3uTools.exe	37
PID 2876 wrote to memory of 2816	2876	3uTools.exe	37
PID 2876 wrote to memory of 2816	2876	3uTools.exe	37
PID 2876 wrote to memory of 2796	2876	3uTools.exe	39
PID 2876 wrote to memory of 2796	2876	3uTools.exe	39
PID 2876 wrote to memory of 2796	2876	3uTools.exe	39
PID 2876 wrote to memory of 2796	2876	3uTools.exe	39
PID 2876 wrote to memory of 2728	2876	3uTools.exe	41
PID 2876 wrote to memory of 2728	2876	3uTools.exe	41
PID 2876 wrote to memory of 2728	2876	3uTools.exe	41
PID 2876 wrote to memory of 2728	2876	3uTools.exe	41
PID 2572 wrote to memory of 1908	2572	msiexec.exe	44
PID 2572 wrote to memory of 1908	2572	msiexec.exe	44
PID 2572 wrote to memory of 1908	2572	msiexec.exe	44
PID 2572 wrote to memory of 1908	2572	msiexec.exe	44
PID 2572 wrote to memory of 1908	2572	msiexec.exe	44
PID 2572 wrote to memory of 1908	2572	msiexec.exe	44
PID 2572 wrote to memory of 1908	2572	msiexec.exe	44
PID 2572 wrote to memory of 540	2572	msiexec.exe	46
PID 2572 wrote to memory of 540	2572	msiexec.exe	46
PID 2572 wrote to memory of 540	2572	msiexec.exe	46
PID 2572 wrote to memory of 540	2572	msiexec.exe	46
PID 2572 wrote to memory of 540	2572	msiexec.exe	46
PID 2572 wrote to memory of 1784	2572	msiexec.exe	47
PID 2572 wrote to memory of 1784	2572	msiexec.exe	47
PID 2572 wrote to memory of 1784	2572	msiexec.exe	47
PID 2572 wrote to memory of 1784	2572	msiexec.exe	47
PID 2572 wrote to memory of 1784	2572	msiexec.exe	47
PID 2572 wrote to memory of 828	2572	msiexec.exe	50
PID 2572 wrote to memory of 828	2572	msiexec.exe	50
PID 2572 wrote to memory of 828	2572	msiexec.exe	50
PID 2572 wrote to memory of 828	2572	msiexec.exe	50
PID 2572 wrote to memory of 828	2572	msiexec.exe	50
PID 2572 wrote to memory of 828	2572	msiexec.exe	50
PID 2572 wrote to memory of 828	2572	msiexec.exe	50
PID 2572 wrote to memory of 880	2572	msiexec.exe	52
PID 2572 wrote to memory of 880	2572	msiexec.exe	52
PID 2572 wrote to memory of 880	2572	msiexec.exe	52
PID 2572 wrote to memory of 880	2572	msiexec.exe	52
PID 2572 wrote to memory of 880	2572	msiexec.exe	52
PID 2572 wrote to memory of 2192	2572	msiexec.exe	53
PID 2572 wrote to memory of 2192	2572	msiexec.exe	53
PID 2572 wrote to memory of 2192	2572	msiexec.exe	53
PID 2572 wrote to memory of 2192	2572	msiexec.exe	53

C:\Users\Admin\AppData\Local\Temp\3uTools_v3.17.025_Setup_x86.exe
"C:\Users\Admin\AppData\Local\Temp\3uTools_v3.17.025_Setup_x86.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\3uToolsV3\x86\3uTools.exe
  "C:\Program Files (x86)\3uToolsV3\x86\3uTools.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Program Files (x86)\3uToolsV3\x86\updater.exe
    "C:\Program Files (x86)\3uToolsV3\x86\updater.exe" /background
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:964
- - C:\Program Files (x86)\3uToolsV3\x86\3uViewer.exe
    3uViewer.exe /reg 1
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
- - C:\Program Files (x86)\3uToolsV3\x86\3uViewer.exe
    3uViewer.exe /reg 2
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2184
- - C:\Windows\SysWOW64\sc.exe
    sc start DeviceInstall
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2816
- - C:\Windows\SysWOW64\sc.exe
    sc start DsmSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2796
- - C:\Program Files (x86)\3uToolsV3\x86\files\patchtools\7z-64\7z.exe
    "C:\Program Files (x86)\3uToolsV3\x86\files\patchtools\7z-64\7z.exe" x "F:\3uToolsV3\Other\iTunes(12.10.9.3).exe" -aoa -o"C:\Users\Admin\AppData\Local\Temp\3uTools\iTunes(12.10.9.3)"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Program Files (x86)\3uToolsV3\x86\files\inf\InfInstallerx64.exe
    "C:\Program Files (x86)\3uToolsV3\x86\files\inf\InfInstallerx64.exe" -i "C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers\usbaapl64.inf"
    3⤵
    - Executes dropped EXE
    PID:2108
  - - C:\Windows\system32\takeown.exe
      takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
      4⤵
      Modifies file permissions
      PID:1852
  - - C:\Windows\system32\cacls.exe
      cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
      4⤵
      PID:1556
  - - C:\Windows\system32\pnputil.exe
      pnputil -i -a "C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers\usbaapl64.inf"
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:1752
- - C:\Program Files (x86)\3uToolsV3\x86\QtWebEngineProcess.exe
    "C:\Program Files (x86)\3uToolsV3\x86\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --no-sandbox --application-name=3uTools --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=2056 /prefetch:8
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:1600
- - C:\Program Files (x86)\3uToolsV3\x86\QtWebEngineProcess.exe
    "C:\Program Files (x86)\3uToolsV3\x86\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=2 --mojo-platform-channel-handle=2596 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2016
- - C:\Program Files (x86)\3uToolsV3\x86\QtWebEngineProcess.exe
    "C:\Program Files (x86)\3uToolsV3\x86\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2772 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1836

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 564632DFA7B212859E54AD57D9D08EEE
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 7127C674E9E99F431481FCC8891596B6
  2⤵
  PID:540
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding F3C69024C1BB1D275EDB34030FDE52A1 M Global\MSI0000
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD1B55D903FC71D4C527A4B1F5E13CA4 M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:828
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding B129200E815EA87A5FCF8F980267A753
  2⤵
  PID:880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A551308C29DF42DC6EB28481EB4941F4
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2192
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91ACD0C5AE5E00425459099618150B54 M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  PID:1652
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1324

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3881a324-8242-0dfe-be45-611aeb117d13}\usbaapl64.inf" "9" "651b8e3b3" "0000000000000488" "WinSta0\Default" "00000000000004BC" "208" "C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2268

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{14870a33-c1bc-472e-2770-d3799f8aec70}\netaapl64.inf" "9" "6bf3f1eef" "00000000000004BC" "WinSta0\Default" "00000000000003B4" "208" "C:\Program Files\Common Files\Apple\Mobile Device Support\NetDrivers"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2364

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2712

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f77a1bf.rbs

Filesize
1.7MB

MD5
29ab4768e63634fe3badbeb60f17f0a1

SHA1
129aa2b01bd8581acbed7d494b981d7149ccadca

SHA256
0aac9c4d90a09a3b39f497ca740ae0dca05c6bd1a6d90ba439a9e354931df804

SHA512
874e88239e9c0e5b36c22d86845f5f5b7f6a2f0ba75349cb27a97b004b26dd3169761845ad47fcdd59ac8f5dc3ed513666d4de2d95c4ef35a70aa26e1a812259

Download Submit
C:\Config.Msi\f77a1c5.rbs

Filesize
118KB

MD5
40cfd1292308ba639636be98046e4975

SHA1
ce462ec2c6887afe662a63fdfe2bd731e3aed6d1

SHA256
db50f2d0ccbf57ab847f2846eca05715ad423259ce3f4ccda009241945abaf11

SHA512
c21d94ac33437d16c97cf9816d1989d0a8c7533963d86f9ddcfb82ec7a3b848e5ecc1232fc5e4a280f164ac1f246ed11c567e190d0bca57dcc72261e4c2b5a42

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\3uTools.exe

Filesize
13.0MB

MD5
db99be2db62df78e98d22275c0ab7b6b

SHA1
ed45462948a6e186c224d0214174fe32c8ad0c6a

SHA256
b0e7002abb2b379c299ca6af684e4d78a8b0b9413b521b8a81807d8a718faba5

SHA512
6ebe1d8c73d65a41c48c2ad5ed4b103028202c42def6f06fde5bb429476de4b25dc06cac6f1a311971fe7322c7de344ea0db5dac081efd24303418a36c227545

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\Qt5Quick.dll

Filesize
3.3MB

MD5
87237f29152adbbc26406f9fc49b121e

SHA1
1fbb3f1fda36d3d8d56db6c835f1d652e5a01db2

SHA256
b96dc4157bb53e205005f7096d36c2af69551edfbc3c07b4146fa45b61f2a117

SHA512
533d0ef0b82335e51f7848aabcdf6b83aa5942a364bd914c63a0da8443ac16fd22dafbb7a3786a6a570375673aed24bd09bd6ec757b6ddba4281b339493d4249

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\Qt5Svg.dll

Filesize
274KB

MD5
f0d8f516e1065e1e0d0626c21e8acbdc

SHA1
81292194e8c9c446b67cba87e0c12780acc1af3a

SHA256
2dcf8a941bd06dbd8426db484cda2aee48b9fa9eb9b22a498eeed269c2fca19d

SHA512
df8971a9812fe209c368007afe00dccfbdb756fcee511f5495dd6b998296b7a88606c8269567b5fcfa6307752e7d49272ca83221388fd2913282688ad0fbb571

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\Qt5WebEngineWidgets.dll

Filesize
213KB

MD5
c57f73a2008dfc9ee53d469820583487

SHA1
29d596078068ec51bcaaff495176ac63012bfd60

SHA256
0a51fe6a9c577fc0b3e831b7bb22054ab992812dcd15fc617b4bc906d8041baf

SHA512
ca42feca121f9ee7726ee9db4cd2c381a39d8e1c9341bb9c30db01928f1fd6e51918c680eb2124304fb19e6d29b61bc42b23a71745a72a5016299abcb947f4de

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\Qt5Widgets.dll

Filesize
4.2MB

MD5
2ecaab6e87a870dbcc4ff3020b8999fa

SHA1
f1b38ed9c859e1e7538006b1cf29c1a8b0dd7a10

SHA256
e25db7540bd89bf4ef9b46dfe471da6fdcaaa79996785deee9de0d1715e943f6

SHA512
4d8c36984bdaca039e5b4143d4b7fae3bec57d0e669c458f3ebc36c1982a9b1aa4e8215abcee73f1efef277e3f400e31bb2c9a698d286e82a98f125b2c585183

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\Uninstall.exe

Filesize
1.1MB

MD5
bb65f68a98ece21bb4291f9c32f7dde5

SHA1
cc67611ef6b41e711571e7eecf15bf7d1f29e12c

SHA256
5cf614af4f2a6aadb672dce95ab6bfb3eaa2d513de1a9159e4565582f194d9d0

SHA512
fdd73e175707a20380fb62c38043479eada9492b95ae6edd5b269eed72abbed4b21287f043a72a9ec22042effeabcbc54fc7f59ab8244dd1ea1a5dfcd57ee515

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\VCRUNTIME140.dll

Filesize
77KB

MD5
a54c936d19b705398e9ad26294505a4e

SHA1
bf26954fa21ed9c34234da41734bd08315a8de6e

SHA256
72730b1843aa0ef2331bd99c48fd132ab29593c1fe0c123810b625fee75d00e1

SHA512
cfe47fda3554515179f0aafac76dff398399724698f69a82ccc086cbaa24eb4538283a746f29e38f6682886c69b636b5bb931a6e684044c92bc0441c0d5dd4f5

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\cache\devices_table\border_14Pro_SpaceBlack.svg.tmp

Filesize
25KB

MD5
7f2390f5032c2a01f2af2efd2fbf0fe6

SHA1
155dfa69d939cbba1a6f147d608a102347af3509

SHA256
65d4e961734340bcc372fb5789c5ee02070239e6209b9cdeedae54623ec2b7f3

SHA512
7cfa63e91cf4f6569cf37fd49134cdc417758fefbf9720560bba36f7e85263954bc3979750213757550b7794f5d588bb2583273334fa44161248e2e36fa78a6e

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\cache\hometmp\1691646872461_895937.png

Filesize
85KB

MD5
417a9a266186eba0b5c0e7fae060d5b6

SHA1
cbedf7bd71f7737c076069565fcab54cd040cf3a

SHA256
fb536ebf3436a353ca42d3efe03204d9bd13f6d073887f8f38b875896d1b51eb

SHA512
bd6fd68e74312501cfe4701ed8627e341d53cb59c6f5bd23a86ee3ae7310762e0dbabaf0f96c5dd99e60a616242d4410e30f3ee083d9b54880ce3073c63a3c62

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\cache\hometmp\1691646971451_957085.png

Filesize
55KB

MD5
ddcce3bb78f7afe368ae73dc3ea96ac7

SHA1
adbc9d45e15c436b494a3141beeacfd94ad5dc46

SHA256
e8cae30319ecbd47cc171f1b594249b475ee6e21b3be7f647b8b498140fcc4c9

SHA512
70243d9e576e73797664e3abbf01aed97d8c74ebd5fb73d63e37222131f8f32a65aec7676d4357867d969adc30eb1037bf3841dc63a6b0bbc8468b3b9ceccbe1

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\files\OpenStreetMap\search.png

Filesize
1KB

MD5
a73bcc83dc2729d19d9d0e1eb36bbd96

SHA1
9d15df65438cab48d07ebe7e9359258ff1011423

SHA256
29739779fd76b21175d4ea24d7ded3e057233127062d05c164b9ab4df9e11a3f

SHA512
c37de466294c22c9b3ed6587c639a7d53ae6f5cc8d352931035885191a2fd329dae3ff28d1bdeb363c2c12243505584354acc5f88bb8e21da9c2942d03cacf03

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\files\bonjour\Bonjour64.msi

Filesize
2.6MB

MD5
86e2b390629665fbc20e06dfbf01a48f

SHA1
d9f4697a6f4eceea24735822cb1df501268ca0b0

SHA256
46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

SHA512
05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\files\tutorial\ios9trustapp\jquery-1.11.1.min.js

Filesize
93KB

MD5
8101d596b2b8fa35fe3a634ea342d7c3

SHA1
d6c1f41972de07b09bfa63d2e50f9ab41ec372bd

SHA256
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

SHA512
9e1634eb02ab6acdfd95bf6544eefa278dfdec21f55e94522df2c949fb537a8dfeab6bcfecf69e6c82c7f53a87f864699ce85f0068ee60c56655339927eebcdb

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\setting.cfg

Filesize
64B

MD5
5e06b34689cabd514a777db740fde4a3

SHA1
860f45d178b33f3236e988567645581b27d604a9

SHA256
d02ec6da1bfd753c72438f00628d498c573c1d6f5dba881255817dbe3f16af70

SHA512
c40e251aa511b4775e1ce0f6b58130768b0ac2f61a5c40cc410fa125d584bcf9c0cde8ac5eddd6887def3e9ecd408cd3d7e89391e5e75eb9e4f4ef2a20d3528f

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\setting.cfg

Filesize
153B

MD5
308f790aff038b35f3b335b575d1f270

SHA1
3671bb802150ecb99ea3f44e503572b0ace55ebe

SHA256
49fc9df1e386337b1e9c22afa282860161775bc05e0508da1b4c0218b523164a

SHA512
dcb875e275769b59754021a06c465dfe261007b0a1cf341189d75a34721429d0381e0cf5d7b4c6b3a301dd2446b81907c6d7bce65d4160b8ebe89fb0cc0ea449

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\setting.cfg

Filesize
207B

MD5
2b28b12d17217f669edd966630c056fb

SHA1
a4edc1600376ed078325c48d9fab84a71e6289f3

SHA256
f008a8c253b1b42ce916a29404815677728ad82d0b23d0be16e28466714ae40f

SHA512
aced60e3efa0aed2db508639047290024a51a508b676429620f93ef81d74ba7d92a2b4dc83efc966487e4d39d52454e89bd956fd8fce562c069361b8f7f7d6e8

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\setting.cfg.habjyl

Filesize
254B

MD5
12c5e7a9cea0b3fbc1f817393bdea960

SHA1
af01f1354aae849a52204af03cc3c56babbb1735

SHA256
e89038d2f800bb2dfb097da32827d44a8f921afc9b512e8b5af55920567d81a4

SHA512
571a9a081d6ba8cc792eecc06197b0dfc164c673214c8fac24b8dbcafa8185071cc7400db735adc2e393b2f38ffb33fb1e82679ee4343dcecf5fdcb4b80ca012

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\setting.cfg.lock

Filesize
60B

MD5
52c2a3a9d39c9909df13e2e459f5640b

SHA1
86f308084695219895fe75e25d554930e6820010

SHA256
f491feab491bacdd45956fcb3d531436f245e307e43cdaf156f588419e1799e1

SHA512
35f49f77d65230406bf324afb97fc47085c01fed3acece53188b0a27fe69a42bd3993ace9316e0633754afa5a382a9b1864cac0e9c67751f8234ded1140b2e21

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\translations\qt_gd.qm

Filesize
185KB

MD5
d512456777500dc13ef834ed528d3704

SHA1
90a32284052c3fe12c18afec9f7ff56735e2e34b

SHA256
c515dd2a2e00765b5f651aae124a55d617b24777138019abc5a7001da7417561

SHA512
babef929ac600c117967b42389623f352d219a466c484ae68ef3c9da9ff61555875ffb0dafc3e5eada6fb43d37f7afe74a6b6c73458a93ffb42819e1068c9a3b

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\translations\qt_he.qm

Filesize
135KB

MD5
26b777c6c94c5aa6e61f949aa889bf74

SHA1
f78da73388c86d4d5e90d19bb3bd5f895c027f27

SHA256
4281c421984772665a9d72ab32276cfe1e2a3b0ebe21d4b63c5a4c3ba1f49365

SHA512
8e02ce06f6de77729aefa24410cbd4bfba2d935ef10dcf071da47bb70d9c5e0969f528bdb3db5cab00e3142d7c573fcf66ea5eb4a2bc557229ad082c0eb1dbcc

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\translations\qtmultimedia_en.qm

Filesize
16B

MD5
bcebcf42735c6849bdecbb77451021dd

SHA1
4884fd9af6890647b7af1aefa57f38cca49ad899

SHA256
9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85

SHA512
f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78

Download Submit
C:\Program Files (x86)\3uToolsV3\x86\ucrtbase.DLL

Filesize
1.1MB

MD5
126fb99e7037b6a56a14d701fd27178b

SHA1
0969f27c4a0d8270c34edb342510de4f388752cd

SHA256
10f8f24aa678db8e38e6917748c52bbcd219161b9a07286d6f8093ab1d0318fa

SHA512
d787a9530bce036d405988770621b6f15162347a892506ce637839ac83ac6c23001dc5b2292afd652e0804bd327a7536d5f1b92412697c3be335a03133d5fe17

Download Submit
C:\Program Files\Java\jre7\lib\ext\dns_sd.jar

Filesize
17KB

MD5
ce9a2f5a7fcfff341d6d901ad919a2ab

SHA1
341f9d9a0b3fd8cfbefe0169b148dcc55688ee93

SHA256
cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7

SHA512
1f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A19ADAD9D098E039450ABBEDD5616EB_8882E6641F4980577F6015B0188D2368

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc05b67bcb478f9e8d616428b99c3575

SHA1
11485998efeea53a507d3cd912a054169434fbd0

SHA256
a09424b455fa444942a0e5112073b81cf296c01a42ffaddfe26b74e7baa5e78d

SHA512
4a3f29821d0cecc59421bd60febf787f305c627d828cf38835f5ba5d86665563c6b8a041af9c4ee5674bd5f6d853b03f4a77bac9310f6315375b2a99483cc125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
729b2ec4ef78d5617a72065b6a5ef1e9

SHA1
e36042ca60332634f84f7947a10f22e8498de22b

SHA256
adee815a35baec95e0e8179819168355a6619c3da4a2e2cbb995127a40532c15

SHA512
14c99ebbf8134406ed94027a569d4d4c437f62811005cfa6dda276d1a0845c4ed5e33830f87d207d205d7da1d3940727787ba1ed4e5a5c7f7a0cb72e598eeb3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ffb3bd9a0c96d96d6df12e678cec479

SHA1
0135861fe590f5f7ba852555e28feab658c869b6

SHA256
f11313aeeb7dc05dacfe4abc2e6e9c524078e35315771cfaa9f41158aa87be81

SHA512
2e0a4ead5170283b9b85d7bacee536fd507dcf71a6ac2e998f30d8ee40feffed61dab4e099e63e2ea8ae70e060a96fe15fbf18b74bc27ef8a4dab7f0d4a35817

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA288.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA29B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSIA75F.tmp

Filesize
128KB

MD5
edc14f8208b25da93d496f3462f2791b

SHA1
a086bf82baa051dcd24665bf3614a12e749fdf04

SHA256
7b931376a019c3c696b7d1854c694c5f44cf37f3e0c4bab08eed9fc354e3b29a

SHA512
7f3a642ee58961c5bb342ae31ca8ad8bcef376d92a956e8b9465071ec97cc06d3daaa30be99852a2ec719d266f25a070154697e57f4346fa3dfca608336aa479

Download Submit
C:\Windows\Installer\MSIBBBA.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSIBCC7.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\f77a1bb.msi

Filesize
38.1MB

MD5
6d421afed4efe2f869468f62aca556e5

SHA1
53bae432440005f8f899ea97ec5ec0516a59fad4

SHA256
c5e29cc998be6f8d680ed358dd3b8e1dd7331f5706e47ad7cfeefdb0c6fcbcfa

SHA512
585923d5e73c91509a4c8e0f2cd1db2bc3b1dc7d6a1735e965a06fd6305db00aa6c46d2357d66e83264c8073d5102bcb3ec03db693145b433cc95d90175aa46a

Download Submit
C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB56A.tmp

Filesize
1.6MB

MD5
4da5da193e0e4f86f6f8fd43ef25329a

SHA1
68a44d37ff535a2c454f2440e1429833a1c6d810

SHA256
18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

SHA512
b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

Download Submit
C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57B.tmp

Filesize
10KB

MD5
168c4256eea6a76983d79d45f191469f

SHA1
2f4e6d8db4bcfeec816d31a70045895a3e6158e3

SHA256
2b8a6ebc3e10d06a6ebbcb4ef89992978836eb52d2ad1c09e19b137b0963c2f9

SHA512
743f28589f4357594c4490c6bdc46b6ca6e3164ab58495d686316ba8effc004e68507b26cb07032f3232ecf21045078a97aae0fad9ac78acff48ec2ae0c26585

Download Submit
C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57C.tmp

Filesize
4KB

MD5
2428e7f81420a9d7e81dfce9fa0613b3

SHA1
96605444de2721d553530179ea96024f29b32827

SHA256
6db20d1374088a64b5a435189e3cbf1c0f30496d4a2c80346bc904605f3d0261

SHA512
fc98a3010d5a71ce4c9ec2ef16914cc6fabf531fdbf1cfc487d42dc352111e47f970565a011cc6ebd18b2632af5bc107e5c0e784127b789b68e6cb3f214aaf5b

Download Submit
C:\Windows\System32\DriverStore\Temp\{3da0caec-f61d-332d-23bb-b12a1160043e}\SETB57D.tmp

Filesize
22KB

MD5
ee00c544c025958af50c7b199f3c8595

SHA1
1a9320ad1ebcaaa21abb5527d9a55ca265deec5d

SHA256
d774db020d9c46d1aa0b2db9fa2c36c4a9c38d904cc6929695321d32aca0d4d1

SHA512
c08cfb84b6bc98a965b5195b06234646e8f500a0c7e167d8c2961dad3c10da47407d339f1fbd2c3af4104932b94ee042872680d968c3c9b086705d374fc9c94e

Download Submit
C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2DB.tmp

Filesize
14KB

MD5
26eee7af8aa1ef8c1bd7c9327c602844

SHA1
990a56215aac7000eac9371f489a0fc57d560078

SHA256
946b0a8150213d6a4dd3aef6248ebb923f8167c84c7ff1b10137e5030ec8bf30

SHA512
1cce53edb09f449720005ee9ca013fabb0be498991adf38ce738330a02b336790cb835e235e097c57a7cf983b4bf18664bc113b074cd94f9118901565d83e24d

Download Submit
C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2EC.tmp

Filesize
5KB

MD5
2da3a91b71919d035d8fd17b6b90bbc2

SHA1
c2c6a29f3abc80fd992777a92df30699124d37c5

SHA256
edea577e694efceec5b26d745fff8125e9fc8a78cacd7365e77ef35031ebc49b

SHA512
71b98c884c338902110c83f6c858b906bd8d63e09e5f92d3e019f586d82961fdc71a459e6456a3e9a56b9b109838b4556aee91e0befb68c2ae505c93a41fe56b

Download Submit
C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2ED.tmp

Filesize
53KB

MD5
f957092c63cd71d85903ca0d8370f473

SHA1
9d76d3df84ca8b3b384577cb87b7aba0ee33f08d

SHA256
4dec2fc20329f248135da24cb6694fd972dcce8b1bbea8d872fde41939e96aaf

SHA512
a43ca7f24281f67c63c54037fa9c02220cd0fa34a10b1658bae7e544236b939f26a1972513f392a5555dd97077bba91bbe920d41b19737f9960ef427599622bc

Download Submit
C:\Windows\System32\DriverStore\Temp\{67d2b777-bd86-6d33-c3f4-c4406ca1fb43}\SETB2EE.tmp

Filesize
5.8MB

MD5
1428a8b3dbf4f73b257c4a461df9b996

SHA1
0fe85ab508bd44dfb2fa9830f98de4714dfce4fa

SHA256
5ed0d8f2066dd19d5aec42c5498fdd1db9cefab4d024a1015c707dfd0cfd5b20

SHA512
916a61feb9a36872a7c1adece8933599e55b46f7d113966ec4ad2af0e2568f1a339629ec48eca10bd1e071c88171fe88292dab27ce509ceea42afbd049599cc7

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
191KB

MD5
ba5b83e84a0cc8416780a35500c3503a

SHA1
3842b7a3f6a34dec2a8f0eae661a39673f28f88a

SHA256
8492f4ac4d6c5b55023ac5f3d9097d787d295b88a060b8e9df8689ad160fe272

SHA512
358fe732f8dd7143aa0463bab8a3f6c4d5a9506a523cc6dbf7c62add5472259cb6955c4083126feda135ce5b6090dc2c5ce507c2aee431acb7ce0cfdf35dcd3c

Download Submit
F:\3uToolsV3\Other\iTunes(12.10.9.3).exe.tmp.cfg

Filesize
262B

MD5
e9904dabb667ec0d66ccc16b6c17ed3d

SHA1
14efaa409c23ef316966dcdc1396f933bd883feb

SHA256
bd8ad2c99cf3e80a6f9c05425506fc3536bd004797ff00e4db64eccad83c55db

SHA512
659f9bd3cb8e98483af1a4f4c7933a2724fd9a06f275adb84dfd6e10d39b4b322f6ca57a0a1d38b95d33ab7903dfaff9e8a809d42eeb44d79881586d1636f188

Download Submit
F:\3uToolsV3\Other\iTunes(12.10.9.3).exe.tmp.cfg

Filesize
262B

MD5
e1477fab33d0f555526f99aec71f3862

SHA1
b65629acc390cd8868b8ba9877bb4918e8d306bd

SHA256
75b7f23a367cdd65d80ca4334457df38cce3104441422ad5359a1903961ab0b0

SHA512
30be67e19cf63122678014c4f9d9136111bf09e70df44cbb1255ff3c1e2664035f4f35b2bce532e5b14d885910bc7c8c2a0c8e712aa827476a3117d8aa5bddb4

Download Submit
F:\3uToolsV3\Other\iTunes(12.10.9.3).exe.tmp.cfg

Filesize
262B

MD5
f6f1c7be35b75b50b5570195e84bfa28

SHA1
8af6d99fb15e29f0336bb54c47ebe04d269aafa2

SHA256
f102cada4a9f0f1a2a0f448b4221c2103b0942b44c4a301769d3cea9c301b318

SHA512
469c079efbcd1016c2398c242f1a930a3255f53c464e4a6fd58aa679e2e19be3ee686626a06697393fc4e117e74d9dcf49b87d59cbd33aff46f200db65cf7650

Download Submit
\Program Files (x86)\3uToolsV3\x86\Qt5Core.dll

Filesize
4.7MB

MD5
4ce26f9aa264e3ddacb8545dec7a7c05

SHA1
92fb679c3ede5b9e769609f6639025cc336e6147

SHA256
27aed4e6f7746ab33def0a38940d46b11bf0f34a702c5c6a0a38e9a41a3f9f3e

SHA512
ad47741d0236bc95e52050d9dd65fe23891fe7ddec25f9a5487b4038a8bdc097e618414dd49c5ac1101cb604406f15492c14b20365829d07c3c40f394ff3cf08

Download Submit
\Program Files (x86)\3uToolsV3\x86\Qt5Gui.dll

Filesize
5.4MB

MD5
627f6981811410b10a37c73ec8aff39d

SHA1
e2ff30f1d50b55e4cbb358d3eb9268352ff20130

SHA256
ffa2fca013f9b10fe27d819b33b780addff2159cacba90318d781b588bf40a2d

SHA512
902f94614f0f344618f055237339a0d59a09c012d3623607e82995e68883a3b2be9f4496cee87761fec753134d11c4b1585285cfc40573584b8d06ed04336a6f

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
f6d1216e974fb76585fd350ebdc30648

SHA1
f8f73aa038e49d9fcf3bd05a30dc2e8cbbe54a7c

SHA256
348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271

SHA512
756ee21ba895179a5b6836b75aeefb75389b0fe4ae2aaff9ed84f33075094663117133c810ab2e697ec04eaffd54ff03efa3b9344e467a847acea9f732935843

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfb08fb09e8d68673f2f0213c59e2b97

SHA1
e1e5ff4e7dd1c902afbe195d3e9fd2a7d4a539f2

SHA256
6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e

SHA512
e4f33306f3d06ea5c8e539ebdb6926d5f818234f481ff4605a9d5698ae8f2afdf79f194acd0e55ac963383b78bb4c9311ee97f3a188e12fbf2ee13b35d409900

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
3b9d034ca8a0345bc8f248927a86bf22

SHA1
95faf5007daf8ba712a5d17f865f0e7938da662b

SHA256
a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d

SHA512
04f0830878e0166ffd1220536592d0d7ec8aacd3f04340a8d91df24d728f34fbbd559432e5c35f256d231afe0ae926139d7503107cea09bfd720ad65e19d1cdc

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
c2ead5fcce95a04d31810768a3d44d57

SHA1
96e791b4d217b3612b0263e8df2f00009d5af8d8

SHA256
42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62

SHA512
c90048481d8f0a5eda2eb6e7703b5a064f481bb7d8c78970408b374cb82e89febc2e36633f1f3e28323fb633d6a95aa1050a626cb0cb5ec62e9010491aae91f4

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
f6b4d8d403d22eb87a60bf6e4a3e7041

SHA1
b51a63f258b57527549d5331c405eacc77969433

SHA256
25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270

SHA512
1acd8f7bc5d3ae1db46824b3a5548b33e56c9bac81dcd2e7d90fdbd1d3dd76f93cdf4d52a5f316728f92e623f73bc2ccd0bc505a259dff20c1a5a2eb2f12e41b

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
a20084f41b3f1c549d6625c790b72268

SHA1
e3669b8d89402a047bfbf9775d18438b0d95437e

SHA256
0fa42237fd1140fd125c6edb728d4c70ad0276c72fa96c2faabf7f429fa7e8f1

SHA512
ddf294a47dd80b3abfb3a0d82bc5f2b510d3734439f5a25da609edbbd9241ed78045114d011925d61c3d80b1ccd0283471b1dad4cf16e2194e9bc22e8abf278f

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
5245f303e96166b8e625dd0a97e2d66a

SHA1
1c9ed748763f1ff5b14b8c791a4c29de753a96ab

SHA256
90a63611d9169a8cd7d030cd2b107b6e290e50e2beba6fa640a7497a8599aff5

SHA512
af51f341670f925449e69c4b5f0a82f4fc4eb32913943272c32e3f3f18ee43b4afb78c0d7d2f965c1abe6a0f3a368616dd7a4fb74d83d22d1b69b405aef1e043

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
45c54a21261180410091cefb23f6a5ae

SHA1
80eee466d086d30c61eaefc559d57e5e64f56f61

SHA256
2b0fea07db507b7266346eab3ca7ede3821876aadc519daf059b130b85640918

SHA512
4962f85c94162fe2e35979fff4e4b3752f322c61d801419769916f5e3a0e0c406284d95c22709c690212d4572eb688d9311a8f85f17c4f5d1a5a9f00e732808c

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
ab8734c2328a46e7e9583befeb7085a2

SHA1
b4686f07d1217c77eb013153e6ff55b34be0af65

SHA256
921b7cf74744c4336f976db6750921b2a0960e8aa11268457f5ed27c0e13b2c8

SHA512
fd7e828f842deabf2dcdcea3e947dc3aa909c0b6a35c75fd64edc63c359ab97020876e6c59ad335a2a166437fa65f57433f86c1c2fe10a34b90d15d8592fe911

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
39d81596a7308e978d67ad6fdccdd331

SHA1
a0b2d43dd1c27d8244d11495e16d9f4f889e34c4

SHA256
3d109fd01f6684414d8a1d0d2f5e6c5b4e24de952a0695884744a6cbd44a8ec7

SHA512
0ef6578de4e6ba55eda64691892d114e154d288c419d05d6cff0ef4240118c20a4ce7f4174eec1a33397c6cd0135d13798dc91cc97416351775f9abf60fcae76

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
e70d8fe9d21841202b4fd1cf55d37ac5

SHA1
fa62fb609d15c8ad3b5a12618bcc50f0d95cdea3

SHA256
e087f611b3659151dfb674728202944a7c0fe71710f280840e00a5c4b640632d

SHA512
bd38bdf80defd4548580e7973d89ed29e1edd401f202c367a3ba0020678206da3acc9b4436c9a122e4efc32e80dbb39eb9bf08587e4febc8f14ec86a8993bcc8

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
d0d380af839124368a96d6aa82c7c8ae

SHA1
e2ac42f829085e0e5beea29fcff09e467810a777

SHA256
06985d00bf4985024e95442702bbdb53c2127e99f16440424f3380a88883f1a5

SHA512
daf3997922e18c0be088a15209c9f01cc1dda90972a6aadcf76de867b85d34483ad5e138e3fa321c7140bf8e455c2b908d0a4db6a9e35011786398656b886479

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
ae3fa6bf777b0429b825fb6b028f8a48

SHA1
b53dbfdb7c8deaa9a05381f5ac2e596830039838

SHA256
66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb

SHA512
1339e7ce01916573e7fdd71e331eeee5e27b1ddd968cadfa6cbc73d58070b9c9f8d9515384af004e5e015bd743c7a629eb0c62a6c0fa420d75b069096c5d1ece

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
32d7b95b1bce23db9fbd0578053ba87f

SHA1
7e14a34ac667a087f66d576c65cd6fe6c1dfdd34

SHA256
104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728

SHA512
7dad74a0e3820a8237bab48f4962fe43e5b60b00f003a5de563b4cf61ee206353c9689a639566dc009f41585b54b915ff04f014230f0f38416020e08c8a44cb4

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
5e72659b38a2977984bbc23ed274f007

SHA1
ea622d608cc942bdb0fad118c8060b60b2e985c9

SHA256
44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea

SHA512
ed3cb656a5f5aee2cc04dd1f25b1390d52f3e85f0c7742ed0d473a117d2ac49e225a0cb324c31747d221617abcd6a9200c16dd840284bb29155726a3aa749bb1

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
1fa7c2b81cdfd7ace42a2a9a0781c946

SHA1
f5b7117d18a7335228829447e3eccc7b806ef478

SHA256
cafdb772a1d7acf0807478fdba1e00fd101fc29c136547b37131f80d21dacffd

SHA512
339cdaf8de445cf05bc201400d65bb9037ea7a3782ba76864842adb6fbe5445d06863227dd774ab50e6f582b75886b302d5dd152aff1825cf90e4f252398ace0

Download Submit
\Program Files (x86)\3uToolsV3\x86\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
d6abf5c056d80592f8e2439e195d61ac

SHA1
33f793fd6a28673e766ad11ee1cf8eb8ef351bc0

SHA256
8858d883d180cea63e3bf4a3f5bc9e0f9fa16c9a35a84c4efe65308cea13a364

SHA512
6678f17f2274aabba5279ba40a0159ff8a54241d811845a48d845172f4aa6f7397cfd07bf2368299a613df1f3ff12e06c0e62c26683dfb08d82122609c3a3f62

Download Submit
\Program Files (x86)\3uToolsV3\x86\icudt72.dll

Filesize
29.0MB

MD5
8e3a999f20d9b06eea041df9ccbdf336

SHA1
12d0729dc9bdc6eb145325984fba740d92091ff4

SHA256
8d314572d4d340f2bda88ac7a86b366800e4f4bfe8b34bbf0eb279b0f143b91e

SHA512
58d8f14cfffdabd84783c26629aaeefe04ab6e135e24bcbfbcef4e54255e765ae91939d33fd5282ef5ab4a0c0ebed6e2c3f8c6e817aab93754d2b2ae37da00c0

Download Submit
\Program Files (x86)\3uToolsV3\x86\icuin72.dll

Filesize
2.7MB

MD5
10fa4e259cb775bc8ca666e79b76b704

SHA1
46337b64bb8b93e3c6abcb10dbabc070f10b2808

SHA256
eed5dca93112512e556abfe8b10292f65b1ab3c4e943b5d3833bad1d31775659

SHA512
2509880d5fc8f8ed37d3c4d0a8ed13fa1343ed14d836f38fafaafc237acbea53150427c858ffbb01ac474c436f0019653665fa54a224e3b4d3e62490fcf7b69e

Download Submit
\Program Files (x86)\3uToolsV3\x86\icuuc72.dll

Filesize
1.7MB

MD5
6b675cb7f36bdd02131acf25cc10cfcc

SHA1
6b8a516ba7f8b4cfa31ad926ccaf049fb3f91825

SHA256
99035826c3493a4f7abb6c7389873384dcdeca5dff58539050688fed384bc26b

SHA512
7fd8c6ec142cafa0c1fc9a103838ba7f1c3bea468dc506d3d108a691b2b7ed8991b6491ac4115d84ffdba4bec99703aead297df40ae1886c0bee27ed6e01dae5

Download Submit
\Program Files (x86)\3uToolsV3\x86\msvcp140.dll

Filesize
429KB

MD5
2b4ffec9d5fee9785112aeffc12772fd

SHA1
af4ce2133cacbdec1ff369bd161f9e9baf24b219

SHA256
3bad372a03a23d6b1f375edb643052b7c3aee288721ec4f46cd497112201fc78

SHA512
253728cb067125fad712b4af37bd5428a17b78a525b2c6f98a15e3c400adc5dbcddfc3c3e0ae0bbb94e77659f67d76de7114e1c97471f60fc0856f84721a582e

Download Submit
\Program Files (x86)\3uToolsV3\x86\msvcp140_1.dll

Filesize
22KB

MD5
2a31e80d4231ee1e21744b7cfc6d3b4e

SHA1
4ebb489e8eb1411a6c44d446669ee519a49e9656

SHA256
01d02cc706198987e0c616891b00fbd63d15329139dfb8af3475ad25294d3de6

SHA512
6ed116b62ee093aa40dd9ab45827b16f57d6bb2b7ba4d1d66147ed7a476d9f559fcd37ceb62d5df02c8c06aa8e402a37cfc428836ea00c52fd0cf5f4bf09f244

Download Submit
memory/2876-2755-0x000000000C3E0000-0x000000000C3EA000-memory.dmp

Filesize
40KB

Download
memory/2876-1887-0x00000000033D0000-0x00000000033DA000-memory.dmp

Filesize
40KB

Download
memory/2876-1869-0x00000000033D0000-0x00000000033DA000-memory.dmp

Filesize
40KB

Download
memory/2876-1679-0x00000000010E0000-0x0000000001DE2000-memory.dmp

Filesize
13.0MB

Download
memory/2876-1727-0x00000000033D0000-0x00000000033DA000-memory.dmp

Filesize
40KB

Download
memory/2876-1867-0x0000000000730000-0x000000000073A000-memory.dmp

Filesize
40KB

Download
memory/2876-1866-0x0000000000730000-0x000000000073A000-memory.dmp

Filesize
40KB

Download
memory/2876-1680-0x0000000000730000-0x000000000073A000-memory.dmp

Filesize
40KB

Download
memory/2876-1922-0x000000005F4F0000-0x000000005F9EB000-memory.dmp

Filesize
5.0MB

Download
memory/2876-2008-0x000000005F4F0000-0x000000005F9EB000-memory.dmp

Filesize
5.0MB

Download
memory/2876-1728-0x00000000033D0000-0x00000000033DA000-memory.dmp

Filesize
40KB

Download
memory/2876-2762-0x000000005F4F0000-0x000000005F9EB000-memory.dmp

Filesize
5.0MB

Download
memory/2876-1895-0x000000005F4F0000-0x000000005F9EB000-memory.dmp

Filesize
5.0MB

Download
memory/2876-1681-0x0000000000730000-0x000000000073A000-memory.dmp

Filesize
40KB

Download
memory/2876-1908-0x000000005F4F0000-0x000000005F9EB000-memory.dmp

Filesize
5.0MB

Download
memory/2876-2883-0x000000000C3E0000-0x000000000C3EA000-memory.dmp

Filesize
40KB

Download
memory/2876-2884-0x000000005F4F0000-0x000000005F9EB000-memory.dmp

Filesize
5.0MB

Download
memory/2876-2889-0x000000005F4F0000-0x000000005F9EB000-memory.dmp

Filesize
5.0MB

Download