b3d7c02032ae6ae3649914f70803e21f791b5399e2ff201fbcefad1dc059c192

Analysis

max time kernel
100s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

iTunes64Setup.exe
Size

202.0MB
MD5

6f5b5621639479d86dd0b3fb3e4ba12a
SHA1

2ca88d8561f9d4395a3cc00aeed5bae2799c2924
SHA256

b3d7c02032ae6ae3649914f70803e21f791b5399e2ff201fbcefad1dc059c192
SHA512

f1d35a246e353452806c3b00690fd4872b850238582a0178616c6100bee00b4abd1de1af06c5cb815055268a07078579831f5f570b0a82459b3992e3ca51c88c
SSDEEP

6291456:e8V6CMvnzMNS2K8ejC0XbllKuplC8nE4VTDd:ZMzvINS22O0XZ1nVTDd

Score

10^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper = "\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""	msiexec.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	2904	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\PrintingTemplates\14.Insert.LargePlaylistBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ProfileView.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hr.lproj\ViewLineItemSubscribe.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\NetworkInstrument.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ObjectTreeArrayIndexTreeElement.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\TextMarker.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ja.lproj\iPhone License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\PrintingTemplates\08.Insert.Mosaic.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\StoreBlankBuyButton.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\AuditNavigationSidebarPanel.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\PrintingTemplates\07.Insert.TextOnly.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\InstructionPointer.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en.lproj\PrintingTemplates\13.Insert.SingleSideBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\HeapAllocationsTimelineView.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ms.lproj\StorePreOrderButton.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ErrorObjectView.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\da.lproj\PrintingTemplates\01.Playlist.Songs.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sv.lproj\iTunesLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Controllers\WebInspectorExtensionController.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\uk.lproj\PrintingTemplates\07.Insert.TextOnly.xml	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\English.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\fr.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\Minus.svg	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt.lproj\PrintingTemplates\01.Playlist.Songs.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\id.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\DataGrid.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\th.lproj\ViewLineItemRatingC.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\AlignContentEnd.svg	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Protocol\InspectorBackend.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\vi.lproj\StoreRentButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Controllers\DragToAdjustController.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ShaderProgramContentView.css	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\Slider.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\id.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\TextToggleButtonNavigationItem.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\LocalScript.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\cs.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\RatingCaution.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ScrubberNavigationItem.css	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\StorageTreeElement.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nl.lproj\PrintingTemplates\09.Insert.WhiteMosaic.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\CFNetwork.resources\sk.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\nl.lproj\mediaControlsLocalizedStrings.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ro.lproj\CleanLyrics.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\TimelineIcons.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\da.lproj\PrintingTemplates\03.Playlist.DatesPlayed.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sk.lproj\ViewLineItemRatingE_dark.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fi.lproj\CleanLyrics.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ms.lproj\PrintingTemplates\07.Insert.TextOnly.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nb.lproj\PrintingTemplates\11.Insert.TextOnlyBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\[email protected]	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\ms.lproj\Error.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\RadioButtonNavigationItem.css	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\da.lproj\AVCFError.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\iPod touch License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\it.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pl.lproj\PrintingTemplates\09.Insert.WhiteMosaic.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\RecordingTraceDetailsSidebarPanel.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es_419.lproj\StoreGetButton.png	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{B292D163-23D2-4523-A699-1ABEC1875609}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5837.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\e586671.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D91.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA24A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\e586676.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEEA8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI698.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B22.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA5B.tmp	msiexec.exe
File created	C:\Windows\Installer\e586675.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586676.msi	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7EEA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AAFEC555-4154-4A21-9523-30B8CDE94533}	msiexec.exe
File created	C:\Windows\Installer\{3E7108BB-C12A-4CE7-97EA-C774EF3AE827}\iTunes.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{3E7108BB-C12A-4CE7-97EA-C774EF3AE827}\iTunes.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B9B.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\{AAFEC555-4154-4A21-9523-30B8CDE94533}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DC4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6751.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433\18.0.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\{3E7108BB-C12A-4CE7-97EA-C774EF3AE827}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\e586666.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586666.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B90.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{AAFEC555-4154-4A21-9523-30B8CDE94533}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{AAFEC555-4154-4A21-9523-30B8CDE94533}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58666c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\555CEFAA451412A45932038BDC9E5433	msiexec.exe
File created	C:\Windows\Installer\{3E7108BB-C12A-4CE7-97EA-C774EF3AE827}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{3E7108BB-C12A-4CE7-97EA-C774EF3AE827}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI869C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E9A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8ECD.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
3444	SetupAdmin.exe
5104	mDNSResponder.exe
2640	Process not Found
2164	AppleMobileDeviceService.exe
4776	SoftwareUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
1908	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4512	MsiExec.exe
4512	MsiExec.exe
1504	MsiExec.exe
2124	MsiExec.exe
4668	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
4120	MsiExec.exe
2332	MsiExec.exe
4024	MsiExec.exe
4024	MsiExec.exe
4024	MsiExec.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
4120	MsiExec.exe
4044	MsiExec.exe
4044	MsiExec.exe
1252	MsiExec.exe
2636	MsiExec.exe
4776	SoftwareUpdate.exe
4776	SoftwareUpdate.exe
4776	SoftwareUpdate.exe
4764	DllHost.exe
4776	SoftwareUpdate.exe
4776	SoftwareUpdate.exe
1044	MsiExec.exe
3500	Process not Found
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupAdmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftwareUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f59c2d6185d8bf0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f59c2d610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f59c2d61000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df59c2d61000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f59c2d6100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	SoftwareUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SoftwareUpdate.exe

Modifies data under HKEY_USERS 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Apple Inc.\ASL\filenames\asl.log = "asl.182742_22Nov24.log"	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Apple Inc.	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Environment	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Apple Inc.\ASL	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	AppleMobileDeviceService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0AF768AC-4FBD-4914-B847-F4E13C984926}\1.0\0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itvlss\AppUserModelID = "Apple.iTunes"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\361D292B2D3232546A99A1EB1C786590\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP439.TMP\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{349CBB45-2E5A-4822-8E4A-A75555A186F7}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.itpc\Content Type = "application/x-itunes-itpc"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91A9E6A9-3935-4A37-AFBA-F0904B166364}\VersionIndependentProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SoftwareUpdate.ASUController\CLSID\ = "{2692A9D5-61DF-46D5-A5A1-A6CCA921D578}"	SoftwareUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\361D292B2D3232546A99A1EB1C786590\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4a\shell\open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.mov\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\Bonjour.DLL	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.itls	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunesAdmin.iTunesAdminAudible\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{46FF6393-09A6-4A74-8CE6-A3B8D1193A20}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itmss\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.daap\DefaultIcon\ = "C:\\Program Files\\iTunes\\iTunes.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppleSoftwareUpdate.ASUInstallHost\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{88F48C4A-46DF-4236-A838-364BF1B3FD1E}\ = "IASUInstallHost"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2742D7-418C-4858-9AF9-2981B062D23E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.aa\ = "iTunes.aa"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.cdda\shell\play\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /play \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mp3\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunesAdmin.iTunesAdminEnableAutoRun\CurVer\ = "iTunesAdmin.iTunesAdminEnableAutoRun.1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB8017E3A21C7EC479AE7C47FEA38E72\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OutlookChangeNotifier.Connect.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4a\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC0C2640-1415-4644-875C-6F4D769839BA}\ProgID\ = "iTunes.Application.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B80C6976-50C0-4110-BC85-44EB975CDCA0}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\iTunes.exe\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aax\FriendlyTypeName = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,-4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.wav\shell\play\ = "&Play"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8DF592B-DE05-49f5-BB21-084F548F12A9}\LocalizedString = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,-23"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\ProgID\ = "Bonjour.DNSSDEventManager.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7F7E1C5D-4D91-48C9-B09E-3E45D502FFA0}\ = "IASUTaskScheduler"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{16D99191-6280-4B33-A2F5-04805A0FC582}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipg\Content Type = "application/x-itunes-ipg"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\pcast\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunesAdmin.iTunesAdminRepairIPodSW.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB46F03E-7CD2-489F-8F95-BB950F395FDB}\VersionIndependentProgID\ = "AppleSoftwareUpdateAdmin.ASUTaskSchedul"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u\OpenWithProgIds\iTunes.m3u	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast\ = "URL:iTunes Podcast"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aiff\shellex\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.m4a\OpenWithProgIds	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.mpeg\OpenWithProgIds	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	SoftwareUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.wav\FriendlyTypeName = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,-15"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.itls\Content Type = "application/x-itunes-itls"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{46FF6393-09A6-4A74-8CE6-A3B8D1193A20}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB8017E3A21C7EC479AE7C47FEA38E72\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\VersionIndependentProgID\ = "Bonjour.DNSSDService"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{56608F9C-223B-4CB6-813D-85EDCCADFB4B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\Content Type = "audio/mpeg"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itals\shell\open\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /url \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunesAdmin.iTunesAdminAudible.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunesAdmin.iTunesAdminEnableAutoRun.1\CLSID\ = "{B8DF592B-DE05-49f5-BB21-084F548F12A9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2692A9D5-61DF-46D5-A5A1-A6CCA921D578}\TypeLib\ = "{7C1E4FCC-B47E-44AE-8EA7-FA66EBC8BAC4}"	SoftwareUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}\ = "ISoftwareUpdate"	SoftwareUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cda\Content Type = "application/x-cdf"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9FAB0E27-70D7-4E3A-9965-B0C8B8869BB6}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.rmp\shell	msiexec.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2164	AppleMobileDeviceService.exe
2164	AppleMobileDeviceService.exe
3944	msiexec.exe
3944	msiexec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2348	iTunes64Setup.exe
Token: SeIncBasePriorityPrivilege	2348	iTunes64Setup.exe
Token: SeShutdownPrivilege	2904	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2904	msiexec.exe
Token: SeSecurityPrivilege	3944	msiexec.exe
Token: SeCreateTokenPrivilege	2904	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2904	msiexec.exe
Token: SeLockMemoryPrivilege	2904	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2904	msiexec.exe
Token: SeMachineAccountPrivilege	2904	msiexec.exe
Token: SeTcbPrivilege	2904	msiexec.exe
Token: SeSecurityPrivilege	2904	msiexec.exe
Token: SeTakeOwnershipPrivilege	2904	msiexec.exe
Token: SeLoadDriverPrivilege	2904	msiexec.exe
Token: SeSystemProfilePrivilege	2904	msiexec.exe
Token: SeSystemtimePrivilege	2904	msiexec.exe
Token: SeProfSingleProcessPrivilege	2904	msiexec.exe
Token: SeIncBasePriorityPrivilege	2904	msiexec.exe
Token: SeCreatePagefilePrivilege	2904	msiexec.exe
Token: SeCreatePermanentPrivilege	2904	msiexec.exe
Token: SeBackupPrivilege	2904	msiexec.exe
Token: SeRestorePrivilege	2904	msiexec.exe
Token: SeShutdownPrivilege	2904	msiexec.exe
Token: SeDebugPrivilege	2904	msiexec.exe
Token: SeAuditPrivilege	2904	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2904	msiexec.exe
Token: SeChangeNotifyPrivilege	2904	msiexec.exe
Token: SeRemoteShutdownPrivilege	2904	msiexec.exe
Token: SeUndockPrivilege	2904	msiexec.exe
Token: SeSyncAgentPrivilege	2904	msiexec.exe
Token: SeEnableDelegationPrivilege	2904	msiexec.exe
Token: SeManageVolumePrivilege	2904	msiexec.exe
Token: SeImpersonatePrivilege	2904	msiexec.exe
Token: SeCreateGlobalPrivilege	2904	msiexec.exe
Token: SeCreateTokenPrivilege	2904	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2904	msiexec.exe
Token: SeLockMemoryPrivilege	2904	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2904	msiexec.exe
Token: SeMachineAccountPrivilege	2904	msiexec.exe
Token: SeTcbPrivilege	2904	msiexec.exe
Token: SeSecurityPrivilege	2904	msiexec.exe
Token: SeTakeOwnershipPrivilege	2904	msiexec.exe
Token: SeLoadDriverPrivilege	2904	msiexec.exe
Token: SeSystemProfilePrivilege	2904	msiexec.exe
Token: SeSystemtimePrivilege	2904	msiexec.exe
Token: SeProfSingleProcessPrivilege	2904	msiexec.exe
Token: SeIncBasePriorityPrivilege	2904	msiexec.exe
Token: SeCreatePagefilePrivilege	2904	msiexec.exe
Token: SeCreatePermanentPrivilege	2904	msiexec.exe
Token: SeBackupPrivilege	2904	msiexec.exe
Token: SeRestorePrivilege	2904	msiexec.exe
Token: SeShutdownPrivilege	2904	msiexec.exe
Token: SeDebugPrivilege	2904	msiexec.exe
Token: SeAuditPrivilege	2904	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2904	msiexec.exe
Token: SeChangeNotifyPrivilege	2904	msiexec.exe
Token: SeRemoteShutdownPrivilege	2904	msiexec.exe
Token: SeUndockPrivilege	2904	msiexec.exe
Token: SeSyncAgentPrivilege	2904	msiexec.exe
Token: SeEnableDelegationPrivilege	2904	msiexec.exe
Token: SeManageVolumePrivilege	2904	msiexec.exe
Token: SeImpersonatePrivilege	2904	msiexec.exe
Token: SeCreateGlobalPrivilege	2904	msiexec.exe
Token: SeCreateTokenPrivilege	2904	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2904	msiexec.exe
2904	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4776	SoftwareUpdate.exe
3496	LogonUI.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2904	2348	iTunes64Setup.exe	84
PID 2348 wrote to memory of 2904	2348	iTunes64Setup.exe	84
PID 3944 wrote to memory of 1908	3944	msiexec.exe	94
PID 3944 wrote to memory of 1908	3944	msiexec.exe	94
PID 1908 wrote to memory of 3444	1908	MsiExec.exe	104
PID 1908 wrote to memory of 3444	1908	MsiExec.exe	104
PID 1908 wrote to memory of 3444	1908	MsiExec.exe	104
PID 3944 wrote to memory of 4852	3944	msiexec.exe	105
PID 3944 wrote to memory of 4852	3944	msiexec.exe	105
PID 3944 wrote to memory of 4512	3944	msiexec.exe	106
PID 3944 wrote to memory of 4512	3944	msiexec.exe	106
PID 3944 wrote to memory of 4512	3944	msiexec.exe	106
PID 3944 wrote to memory of 1504	3944	msiexec.exe	107
PID 3944 wrote to memory of 1504	3944	msiexec.exe	107
PID 3944 wrote to memory of 1504	3944	msiexec.exe	107
PID 3944 wrote to memory of 2124	3944	msiexec.exe	108
PID 3944 wrote to memory of 2124	3944	msiexec.exe	108
PID 3944 wrote to memory of 4668	3944	msiexec.exe	109
PID 3944 wrote to memory of 4668	3944	msiexec.exe	109
PID 3944 wrote to memory of 4668	3944	msiexec.exe	109
PID 3944 wrote to memory of 2332	3944	msiexec.exe	112
PID 3944 wrote to memory of 2332	3944	msiexec.exe	112
PID 3944 wrote to memory of 2332	3944	msiexec.exe	112
PID 3944 wrote to memory of 4120	3944	msiexec.exe	114
PID 3944 wrote to memory of 4120	3944	msiexec.exe	114
PID 3944 wrote to memory of 4024	3944	msiexec.exe	115
PID 3944 wrote to memory of 4024	3944	msiexec.exe	115
PID 3944 wrote to memory of 4024	3944	msiexec.exe	115
PID 3944 wrote to memory of 4044	3944	msiexec.exe	119
PID 3944 wrote to memory of 4044	3944	msiexec.exe	119
PID 3944 wrote to memory of 4044	3944	msiexec.exe	119
PID 3944 wrote to memory of 1252	3944	msiexec.exe	122
PID 3944 wrote to memory of 1252	3944	msiexec.exe	122
PID 3944 wrote to memory of 1252	3944	msiexec.exe	122
PID 3944 wrote to memory of 2636	3944	msiexec.exe	123
PID 3944 wrote to memory of 2636	3944	msiexec.exe	123
PID 3944 wrote to memory of 2636	3944	msiexec.exe	123
PID 3944 wrote to memory of 4776	3944	msiexec.exe	124
PID 3944 wrote to memory of 4776	3944	msiexec.exe	124
PID 3944 wrote to memory of 4776	3944	msiexec.exe	124
PID 3944 wrote to memory of 1044	3944	msiexec.exe	126
PID 3944 wrote to memory of 1044	3944	msiexec.exe	126
PID 3944 wrote to memory of 1044	3944	msiexec.exe	126
PID 3944 wrote to memory of 1268	3944	msiexec.exe	135
PID 3944 wrote to memory of 1268	3944	msiexec.exe	135
PID 3944 wrote to memory of 3408	3944	msiexec.exe	137
PID 3944 wrote to memory of 3408	3944	msiexec.exe	137
PID 3944 wrote to memory of 3036	3944	msiexec.exe	138
PID 3944 wrote to memory of 3036	3944	msiexec.exe	138
PID 3944 wrote to memory of 3036	3944	msiexec.exe	138
PID 3944 wrote to memory of 212	3944	msiexec.exe	140
PID 3944 wrote to memory of 212	3944	msiexec.exe	140
PID 3944 wrote to memory of 4252	3944	msiexec.exe	141
PID 3944 wrote to memory of 4252	3944	msiexec.exe	141
PID 3944 wrote to memory of 4252	3944	msiexec.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\iTunes64Setup.exe
"C:\Users\Admin\AppData\Local\Temp\iTunes64Setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP439.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2904

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding BB4E816E76DEC5CDFA9CA21A9F374DB9 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\IXP439.TMP\SetupAdmin.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP439.TMP\SetupAdmin.exe" /evt EC23 /pid 1908 /mon 788 800
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3444
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E01853C8E282B7B2B92C12C040FC6F24
  2⤵
  - Loads dropped DLL
  PID:4852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A8CEFB3786C8A4E3CD989F112C939AE5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B28BA36CC60B695D03544DEAED77F913 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1504
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:2124
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5A4CD6CC206AEBA8CF7F8674B50414B7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F83A8A38DC6D9CC1953B12D0EB043F07
  2⤵
  - Loads dropped DLL
  PID:4120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CFCEDDF476054B037E832B99EDB420F E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 806FA7A72D74D9E9ABFAF6C13877BD00
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4044
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1252
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2636
- C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
  "C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" /RegServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F6FA6F057FE5531515B9F1EDAE86C280 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1044
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1268
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B402530980256E9400D75CDAC08D2A84
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA7FDE4334D7DE1C3AB714DC88E05D36
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3036
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A8A15AA86776C86225D5FCCD8B503176 E Global\MSI0000
  2⤵
  PID:212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C1360CAC84C707CF161F811DD4A1683D E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4252

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:5104

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2164

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{16D99191-6280-4B33-A2F5-04805A0FC582}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:860

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38e4855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e586669.rbs

Filesize
126KB

MD5
f96aeca3be20c61b67cd8793312ec27d

SHA1
6b928bd3b58777c8410351754d52df85d0e61a84

SHA256
0b359d64b8087de04babcc6357c9d8fdae1c248a2204310e25a3e7124577667e

SHA512
e1896b3d6b303f6d0220f8a2ade71a1a3a4f9a5ea683f660e35245a111216c0497ad448e4f297b46e9ce4785a2d8978b27b7cd42ba67966ff32895d3feb9c865

Download Submit
C:\Config.Msi\e58666f.rbs

Filesize
332KB

MD5
4b91a1bb5ebef83d29ebdb075cdf6cdb

SHA1
407063f3db28acd8fccd26604e6bd3af322954c2

SHA256
3819fd7868127b8aab85a69b39f5549d55421bbe17b7db7e5bc8e00fa4befed2

SHA512
eb5109f0d8ca37db53a3ef007100ecd3fd518e97a539e1c5817957dea4ee493c84cc010b45646f84ea998ae385bf46ae92331b7cdae1b91eb120fa0d862933aa

Download Submit
C:\Config.Msi\e586674.rbs

Filesize
167KB

MD5
bd2a1a08698837c2a763cf7c2e615604

SHA1
f0df1d5f2f9477b0778a1a74d52996d40894c4f4

SHA256
631631f4c0f37c50d9936fe5ae1f6e78f4d344fda190a73709f15dccb1ea57c7

SHA512
3aebdd9f2f4bdbef5743d5bcf833e5685bf2bb91557f5e7a2406be785bf98fda86dd84b9639bb58be268cf61dc3db95f57a3a63a592ee017a5e17d22b7646a19

Download Submit
C:\Config.Msi\e586677.rbs

Filesize
1.3MB

MD5
603d2b7f2b4185668784dce8a5b843b9

SHA1
c54a5281fb8db39e10eb04d1cb398efba4c6e6d9

SHA256
faffc00d012a0291e3b5ea9f9a638c0b37a48857193b7d4adcdbc8e517c84d69

SHA512
10d147131b60c4a5fab280efdbf660b85fd8b08345eb8189bdf1110898901ab04d2f4d11fed8e2fb1e9c1fdbc2d369bbd1402c64c5b19d8334502d0b8145b4b4

Download Submit
C:\Program Files (x86)\Bonjour\mDNSResponder.exe

Filesize
381KB

MD5
5ea9c80f18cbc393ea7d9a2991ded4b5

SHA1
b8917c5ae45d1ba5ca534058f1386fac92f5da63

SHA256
7e5eb1ce44febe93686174058d51581fa00bdff0ebb84bd74bc08f6386019253

SHA512
7fd949b792a40630ca385dd2bc88db9673f9106975b9f55481e2382f67986dd75b03cdf0fbf59846b513a8def0c506ac6561f6ba658775286f11d761b575513a

Download Submit
C:\Program Files (x86)\Bonjour\mdnsNSP.dll

Filesize
119KB

MD5
f6d02735de16705c1ebe6429592cd355

SHA1
c6ee693de2c01cad34012471b70d87869969a0cb

SHA256
356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4

SHA512
1e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13

Download Submit
C:\Program Files\Bonjour\mDNSResponder.exe

Filesize
451KB

MD5
b5c2f92ee1106dfe7bb1cce4d35b6037

SHA1
31070ef84c5355b082873ffc19ff60659637995f

SHA256
e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50

SHA512
7f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7

Download Submit
C:\Program Files\Bonjour\mdnsNSP.dll

Filesize
130KB

MD5
eaaa2b83c4764fdcfbee4a4d6546de92

SHA1
961a7e7735ee8f07ca54fa7cbfb23399748f8174

SHA256
043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

SHA512
bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

Filesize
101KB

MD5
5dc16f968b5470a4538730e8b59211c3

SHA1
3967d7463e47aad2ee7fedcc880c135105d865ae

SHA256
60f07cfbc42b92e14104ea17ff408506c3c29fa7a529d6cc7b352006b3805a94

SHA512
eed2d0c940acc70786d71d3a5d2f91d15a5cc95974666fba252998510b9671322cd31aa892433446b51eac98d06fffb16ab42cbf1a17e4192c5a43686d7f5684

Download Submit
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleVersions.dll

Filesize
28KB

MD5
888382a6b44006c5b81905944d04a3b2

SHA1
bb5260b3daa737025fecb4ee7c4a56a69329dff7

SHA256
def4e62bdec8ed09b0a6fbe28fd1d9017236a82ae013f850b113e7d9ede295ac

SHA512
e67249c4c22fd80ea508f24bcb03ed72c539ac61a424132a9b08a776edd2cb88c6c70c305a7ec310f22c41cec2c315629055439c8198639acc665c58e4dcd294

Download Submit
C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar

Filesize
17KB

MD5
ce9a2f5a7fcfff341d6d901ad919a2ab

SHA1
341f9d9a0b3fd8cfbefe0169b148dcc55688ee93

SHA256
cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7

SHA512
1f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f

Download Submit
C:\Program Files\iTunes\CFNetwork.resources\en_GB.lproj\Localizable.strings

Filesize
22KB

MD5
11d00b701160c1244899bc1647e3b756

SHA1
866c9acf31291a1459e6719dff2764af41eddde0

SHA256
47be7f1aea7eba3fe98080713b1c4414ed5018aee75ee7f6453ae2ff95aa76c0

SHA512
f1e8727fa33b70bd146d71aa782ef8000b6824c06b936b7584057ca77cd082a001398bc5ef2202e12b50bd86687f3a75ba3a6b028d14c7ae3d1a21d868cb756b

Download Submit
C:\Program Files\iTunes\iTunes.Resources\ar.lproj\genresLoc.plist

Filesize
236B

MD5
093deba2a9db087a0cb01a676bff1c9b

SHA1
9c7d3070d1fef593731dacdde8cf38e7f96962ab

SHA256
2950ef6f4409f89b8513f2bb787f9070c2983b698b35b678088c59cd83246bce

SHA512
dc3860ac3d87ad8f28988b2c7e694721757a43367ce6a1333205cf335de1c29e739a8468a70bc305a60c4d0587aa062fe01f3762d608c9bc4d76867f2d381c1b

Download Submit
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\[email protected]

Filesize
5KB

MD5
236216d5b66e7e9f48715b953b465c56

SHA1
7ad8425770aeb398922005b2649c4764c5b6dc5f

SHA256
ebdb9147c9b509b923fbb4e1e7903c84f67b42542b0055b2f8356a16c456191f

SHA512
6da4821957d52ef729cee2c6436f75b8581b702efeced430e99abc81be11f8cd2f2b2c374a88d68ee177b46b0cf34f723341a78d642dd4c81a8b5f09e8c77bd1

Download Submit
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraGridView.png

Filesize
4KB

MD5
94eae9dc7a205de2ee0a17effa21b60c

SHA1
54f23cb71ac3a62680bd22a3b2b8ed5c6c86d5a4

SHA256
a33f1e4d73943a77e6471143d263aaa53a871f7534e27435beeea19e75c82fbb

SHA512
5601cb432d92697a630dfa9c5403b7ff1210f517c51eb84a4036d7c14192af287eb86782a8036b0da72ff39f827d118d276a43cfdc0019f40b85147948d3d99c

Download Submit
C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraListView.png

Filesize
3KB

MD5
5e93c7b6af1f907359091cd0c629b3dd

SHA1
4aba4ecd7b1b5d7937e7c7faaf7ac1629c0394cc

SHA256
b21d24670a44bea7c5c86c2b87d356e66006cfeaebb8e6b7d4ebf07974ac3f66

SHA512
492683e196bceb4f80d2bf07dc9031fd8f1667b0d8e3da877df1666bc419276bde0a6af8a1dd983a0b5594d5e0143eeda09ad2b87378cd221fbdb3e45291772c

Download Submit
C:\Program Files\iTunes\iTunes.Resources\da.lproj\[email protected]

Filesize
1KB

MD5
b8f2462ffc91bd1956cb2607c1c9df31

SHA1
b4d4a46fd481f23268fce6b63496e753ec1c8a25

SHA256
b58b3ac76194b282833d971e2e2379cb25e7149f29f4a585e9405daf810a3d50

SHA512
6814101aaa72a241e4f9d37594c666016a36bd4d5e5ef50623e23590ccf94bac80d2b8c062213b557ebbef5e007fe0400ed9c84422df8f5a5486d2c9bc4516c2

Download Submit
C:\Program Files\iTunes\iTunes.Resources\el.lproj\CleanLyrics.png

Filesize
3KB

MD5
357922d796c4ab56acb274ec1c89ed4b

SHA1
4f29801424d33877426dc21cf02bdbabaa321120

SHA256
66e1fc581446d80a7f64afeae19273cef7d6a10001e3e7d3127ade5842c754ff

SHA512
e0c7b23cec3ba61f83ba3a9675ce078d4fd36fed08f8e1c20be6e9b7891c1d4175e5ceca9ec3797419b22806d82d86fa4fbad314565d000a36fbe92905c9e36a

Download Submit
C:\Program Files\iTunes\iTunes.Resources\en.lproj\[email protected]

Filesize
20KB

MD5
498055b7ec8f362e71a988ff8c79b517

SHA1
4b28c12932e86c68c7acea45303be3900bf987ea

SHA256
065261151f732d9f8391b0bfc00e71d3dd8e47c84331aa94b58e295782d74a30

SHA512
0b7c4dd87fed1ec01b14334e129ac43c598c30a1141bc9831f7b0ad106704072112b36ff4688520d675eb72652ef6a1dc349c95f55f6a59a245c5c151771f0f7

Download Submit
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\[email protected]

Filesize
4KB

MD5
59d4281f0f7f665c809f2a68434999ff

SHA1
1c71204e311646a1b367860c0de11ea5e60e06ed

SHA256
57b642737825507373c0b192e3431f7a15848c1fb061b51b262b8d2438551e43

SHA512
e38edd4b53f950b8c3202552d38a6a56ee726a239527a1aec064b9a3a66f06a3aced67c0b6bc3c240994d006d8dbd5f2e2ec67bdd4e76c181e9331891d1d0154

Download Submit
C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhone License.rtf

Filesize
46KB

MD5
cb4f512972b12e3b783e89704cccea3f

SHA1
e64cd7091224e3449e15e4ea664aef256534183c

SHA256
b636c8c51b01fd142af1134448763dc526041f3fbf635e841b0c2882254d64f4

SHA512
8b9abc21f291f53ae89b16f1cd9403bb881f9fa9140cb919e0fd5f4ef8544dca0359b7d5e45f54e3ff74eeccd4d9f0b62494992a58c6e230e4467015a1092988

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE.png

Filesize
538B

MD5
30aa67b32a3542874bcc88e146e17b46

SHA1
6d86b94d2c71ae27504ce8b3ad000fa4ef532a6b

SHA256
2ece6d0b0fc97dd6deacfdbaef44458a4b96e43319c78cb74c55d4f7ea79d9b6

SHA512
dfd082a54a13c5d2fdfa66ee9db8c893bbc6b32108308727665267f0a9e9fa9610c174082c0ca7a34832cbba768a1e2d8f6218b4c5a538a328a6159be05f3cc3

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE_dark.png

Filesize
222B

MD5
ef859a036759f6f29c3dc14928a75c76

SHA1
45f8c4450757f2ec653ee0845f5ce497b6832598

SHA256
c5c8219de48b954849bf19b716dbba8358c66b02836417d8d729dd2a672935c0

SHA512
93aae547f72edf6c466b4f6c1a43f7f0fe0393cc7f7ea87818b462a4938cd86903017a12cf4eb1f3e05492b312e8826c5fea1935388a168e1f0278cbf3fb505d

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr.lproj\genresLoc.plist

Filesize
218B

MD5
17d011dc9b1de5a0dbcbe11f5dfa4dda

SHA1
22b3182f41bc4a322f162832b4dfa92a46a71859

SHA256
a0f0336ccbb2964f1b6534fc1a59a04896bc104473812ce0f407496648eaa93c

SHA512
99193d05842ff4debac4d1c1ae772d3fa6424f5c097eea557095a9bbbcec044a18c3557afb1d2f474a2b86db7a8ce24d44d2b70d1c5a989258ad9f70d6561452

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\TextStyles.plist

Filesize
41KB

MD5
7f9f90998dbb72a12f12464fffd40997

SHA1
01a41b41e92271eea01f31b208a2c2b47b496b59

SHA256
503b82910c0a98e3509cdf590dfa8f722ef149390b260068675fae09c3cf12ef

SHA512
7c293a39681c386002107aeb852c15ec8b4acea037f8abcef601cc76380f3487f421d267a6ae856df90b10fe8d032852c3650d5feb36f675a524163314e23a98

Download Submit
C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\ViewLineItemUnsubscribe.png

Filesize
9KB

MD5
001e313e3be5e546cb50d86cb65dec8c

SHA1
e7feac3aa8b53b2670077ae0254a2900ac579467

SHA256
59a9ffdd81daf97ceb9e66f1e29b292dcf78373eef8df94038df3845d3e6d5a5

SHA512
26329e02aba9b0ed9295dcdc0834a7b2a75aa05843365490ae0d86f787159967943a8040ab425c10266523e15308c6c52673cd2ac5db7073369bd76c0777278f

Download Submit
C:\Program Files\iTunes\iTunes.Resources\he.lproj\ViewLineItemiTunesExtras.png

Filesize
797B

MD5
59ecde9c26c45850d5d42fefd0a2fad5

SHA1
6bca0dc1fb62c293f30bd7880d91cf96835ed4e9

SHA256
2f0e9c34845db2353f8798bbd7ec23ef4fc151cd61b3383b0a3280b7de78309c

SHA512
9b9744414188aacbace2bfa37561266f7aa6426c6e61bece4990601f0a57c7c41302dcefe1757e3da86947baac2ebb06c266f18108448ccee41d205680822994

Download Submit
C:\Program Files\iTunes\iTunes.Resources\he.lproj\[email protected]

Filesize
5KB

MD5
8875b575ec840a83ede84ca27762761b

SHA1
7463b50c8483598dc6ae4889633a11edfcd3a5ad

SHA256
6529e898923292f4163ad09594682cb7fa1c32c6c71baac0e4405d9996dda509

SHA512
9af764d681309781353504d270d78ee59798154c94292e8eb73b07e78f077a52cecc9523ee088d68fc08de353541c6ed34fb2d73eabd1316e638485ceec6a6bd

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hi.lproj\RatingCaution.png

Filesize
3KB

MD5
22b6a916115477a43ce634ea820a6304

SHA1
a34138e73bae3a62d745171d62f9f05a6dc07276

SHA256
138d6ca25775eee1f0ea7001f694a5b286224372aa168a09578a1a9af7eb76bd

SHA512
97502dcec76353fd69ffabf398b53777bde50d08cc998a6213410596fc42eade86f717eef60bea0d5a4f193fbdd18b33f09fe360b043246b9c96d3316c7a0347

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hi.lproj\ViewLineItemSubscribe.png

Filesize
8KB

MD5
d4eda1881d75dbd2b0d9336e9a5108da

SHA1
fa2264a591a47e42b7cd581b9e0a3ada33874746

SHA256
a9ccdc7553e6cf9095d3760e88a3c9f76c0817ea6596337f21ae748828ce3532

SHA512
4a953a46684569c02fa447f46ebc5d8c8445a045703f36cc17df708eb53b2c324bf83c4c71a72f35d96f4655e5159b919f4eb631df598d4888d40a73d675f527

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hi.lproj\[email protected]

Filesize
28KB

MD5
7676be0b698ae5a36b25772f547142bf

SHA1
4f5ab9344fc8cc6de692bce6881878185b96bd4b

SHA256
946361d40f1b68a0cc29004ad4f55522c648023004e6adc9975e90b6e382657c

SHA512
09f77f33a281a5d4ab712b2f43f01da729085cbc27a973c8f34e3fe0cab1fc515f9dbc45ef35ed9d0a04aa76cf26e98d0c78e8b1805f12560e2866239bb9248c

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hr.lproj\[email protected]

Filesize
302B

MD5
5132ff3c2935630e2f54ccc9a360b742

SHA1
58a0b7d8667d625d8e0c9267bfbab88551c6524a

SHA256
5501b7a0c2af99684fb58c1acd227fe53bf07f4028382aca136607ed9459fc8a

SHA512
816d16f9b37c52f97a64a5a1f4c4b6c1bd2705231703416c7713212e1cca2753e3bc5e3352439a0cebc89a5ba0de584edd1183603cd387e7c7fdea1f023b1f85

Download Submit
C:\Program Files\iTunes\iTunes.Resources\hu.lproj\[email protected]

Filesize
3KB

MD5
02185d025965988b87c6b4748cdcd745

SHA1
e110b97b7d669361a0f2a2cc38c4a62f3d5deeab

SHA256
ce8aa4cf4ded795fbf1c10fc881978746ce6c76f13accf566e7ba0e98f5af774

SHA512
f1b6617eff4a584a760c24423226c844e2ceec8df8023bc9a53da69b18f76d2226ad24d0d1b2bf61cb2da9711caf4c23ff7905298edb309cf771cca1797a2c48

Download Submit
C:\Program Files\iTunes\iTunes.Resources\id.lproj\ColumnWidths.plist

Filesize
18KB

MD5
8490f8bf0576147ba7cd139446e6cf20

SHA1
48a557825885bea1a6afcb662b07113e99a20136

SHA256
bf81225b2c30aabab43beb74142693ba800af85f88025446aaed2dcfd5068ffa

SHA512
86f0896fa6ad25a9550cbb3d0746eb413c86832986165e0824eadd917bb902b1f13c9aa60db78d477c3c5921fb7fe1465025765429b6a5a7e638da8063487753

Download Submit
C:\Program Files\iTunes\iTunes.Resources\id.lproj\[email protected]

Filesize
5KB

MD5
11b4d45789544050871f75c0fb3b5e3b

SHA1
3362722a15fdd5a67d0c7e1c643c64a3630e89df

SHA256
f03209b2a8826502acf29e9769c73e1fabb923f4ac11057299cf8fea57a13def

SHA512
51854f9a9961224dac3fab303d2e39e0a30d3f52b9d5e561dc07c69950733e6a9c6f585e001a3f9453fe0a7932a74e9b53fea0e87a691787cd11cb009017a794

Download Submit
C:\Program Files\iTunes\iTunes.Resources\it.lproj\ViewLineItemRatingC.png

Filesize
261B

MD5
71062ebf3a5a9b5c578387aabb2e7fd3

SHA1
410d43bb43f7ddc7ee7cc225963303326485bc0a

SHA256
5c751b7f4b96d07b22971ea4977566ed88c3297ab7d0b2853e7e9baec00be1a7

SHA512
0ad45440a3e77a4ea2d1ebc8531c91fcd663e596a90f5cdf1d0a57384c54d988c0759dff51f5231d973f9886c80c16feecfc16da84579a0cad53ba70b984a865

Download Submit
C:\Program Files\iTunes\iTunes.Resources\ms.lproj\ViewLineItemRatingC_dark.png

Filesize
241B

MD5
b52bc951d0c8f8dae4329368388dbb76

SHA1
ae408ee6f2d946aaddb8be466f7de2b99c7c4c58

SHA256
befb8ccb14ff090ad56345786c9f367a8cb2d14516ccb52dcda123df5e5dfbe4

SHA512
144de7bcef6fc1be493229c84c2038e2c6b6719c5ceba95d7abbc14539c5222a3bd1e65eb00e0c0f3bfbe6e0be4ddbc9d2876dcfdb9f1b3372cd3361d7f58d98

Download Submit
C:\Program Files\iTunes\iTunes.Resources\nb.lproj\[email protected]

Filesize
948B

MD5
c6beffb1568071b2fab6f19bb9c875c2

SHA1
137ada0e83cce6b784a8d4f345430c28d61944a3

SHA256
f1b5cce0aece4f65441bb7cbbf86155ad2d4e90b8bbba8252de985ae02d751a5

SHA512
a1e811646642fbfd11ae794e7c764a3bff39e285f1724deddbf9ed516cfa7929e8ce10611b9d0cc11f6c1944728f4aedca99df5badc72f2878209c3d24b28758

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\SortPrefixes.plist

Filesize
310B

MD5
e4f62c535e191b6d40912f32c60e1eff

SHA1
37203bd8a250fb9b7471e1a4b8b2dd4f727aca2a

SHA256
800cb75b9347c5142edc9094c9c829b10b6a280271f19e8ef3b4673a1cc48484

SHA512
2b64834f62de68efc971bf59e36d7cc0a29c3e7dc4c2c987ae6840488f6fb94e88ca73276fd0968f2f6b68d427a5f87a97faa0821f0cefb533deab38a58f3630

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pl.lproj\[email protected]

Filesize
9KB

MD5
010e5869f100573199acf50905ba17b3

SHA1
da950fbeb52dea27dc393ad4a113422238bd6002

SHA256
f533c5ca2a6bdcd1a9c7f757c0c9a17d894b2717c3493bd7ced8f36a722eecc3

SHA512
83c30c0291ce0540a41f07a6566eab12b784efe5a7a8dabe29dee67fdfdc0e53e89026511476d0abd46a267bda76e179892a249be46619c7b6fd621d1ce753ca

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ParentalAdvisory.png

Filesize
5KB

MD5
d947d2a1018ae12438bc118af0a04215

SHA1
c816253a5341d804712b8fe00967cbc887f99907

SHA256
041204ca5fb90b0d19d0f8b5bae858bf4022d9c794990e8fa4a0bc7eae093ed7

SHA512
bf7192cd4f137311d4696a0dfcb5fec66df5ad45e301fff3f8d4104163b0c64d8abf2b2d3f4100802f75aa55b435cc890005d5836c1350702473b0359add46a8

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemRatingC.png

Filesize
662B

MD5
471584f30a8dbce0f8e4ab7a781d3705

SHA1
1d4ec7b6ad3ae1ccd48056c84d05f2d684db85b5

SHA256
ec0e0c2e51cf0c587bd8cd8842682ed78becd0cdb76ba06cb1c8cc1d98c710c1

SHA512
b6370cdbf9430cccb041c21641409e43bfd2a1b78836ee38fd0a706f26623ea1cc84e645fe6b501fed06b4222173055c101bee5de2cdd012c0cf5451cd3031d5

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemiTunesExtras_dark.png

Filesize
622B

MD5
589bbd384b604e83cadeba1d59f8fd90

SHA1
ee6fe62fb935e9f1007f31eea754e3cdc315d022

SHA256
096343c9ddc34fead4232f182085ceba66907446657257969f3916ba991eb58d

SHA512
369b8d35ee411971f1dfd02fa065ce2badca714a0046cd26d098c15a8f55185178206516a62de59f81bfd285d4a8804a29b64d98f51f4e4a543bdb2eea993736

Download Submit
C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\DeviceCapacityBox.png

Filesize
10KB

MD5
8246496c258d58712c0a972bece0d69a

SHA1
65f4a403895354702552e2769cfe7f480a70ea6f

SHA256
f930036e7cae52b4022d979fdd6274d8604ca4c7e6f14495223dd78c17bc19a7

SHA512
b1dc4bfc186762e414ece274b158f10fefaa86ec373c732c804381733a7c17cd56e27331ca7381e7e9fb795c04a4a09ac75642684f36f99d4c2ae2871dd8d447

Download Submit
C:\Program Files\iTunes\iTunes.Resources\ro.lproj\[email protected]

Filesize
1KB

MD5
6cf4cedb6b5148b103fc91a2d057888d

SHA1
23e873c7d60c21248eb9f8381643a295dc4fb12a

SHA256
dae1592358924b99a4363cf20fc4a6dbcaeffb5af2f7a248a0fb687e95336597

SHA512
4847a96925aa568c6d523f84e760b35d0f4abad4b6df70c3ed6003289b776b3327bbc41dda3da96221113e41b0097a2275db5bc562c77117db6c04e4275fc583

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]

Filesize
25KB

MD5
784f871663195e678f524f4aefccc28a

SHA1
ee8a70134370ce17ce49bb31e92cff252958d202

SHA256
efab63103f90135001658bac9c8724da424e81fc05c9385953a7555c6ce1ace3

SHA512
7e1b0f1f74abd674b09443b835da35b9b1855a0d7ac15e60670c6d3ffa1059fb13ccc579f069e444d073be0da76b65b4dc1d517c2ffef654a99ba9143fda6f7b

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\MasteredForiTunes.png

Filesize
2KB

MD5
67f1b4232079935a9998b0395a6b7c10

SHA1
ac4bfc88ed92cb526720f9cc9b4a377ae6a7a787

SHA256
95f0affa39a202e292a5f630a2524c8de31b6478304e040ef06488d9dd1e9f0a

SHA512
410e56ec048d2033e7e05202fc09575758d5c5e441146bd89070106108f1332e3ed3b8868238c78f18c0d641898607ecf1c704f51234d741f0693868966b0219

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]

Filesize
8KB

MD5
d9eb252906d8d98e592ef01034a94c76

SHA1
5fd847136846bba1957e2ace9e1d3ec482de2e5a

SHA256
6f231775671c67eaa458a6a2d1405f3e5c52d56882f5620aa435166f4bfb7529

SHA512
7bd132759532496ca864cfff7ad411ff48e3d2a9ab28e3b50afdabe5782d853da52a09f093b25c0d7c60906ce42ae8a28634df363fc6a435962dfdf3ae9faa71

Download Submit
C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]

Filesize
1KB

MD5
e85fcfa0b73018404b29d4fa04f047a8

SHA1
2c7ba150c3fd101231563ffec9a7fd5ec5ae02a0

SHA256
55617519bf037182dc93082300e162933c3771996607aeb605079bb834a182ef

SHA512
141c92030b58dea61e29020b1792cc2a8dafd306af2a9130b105721a026b81a05d0d1621d4a76f6b6e5509dfffd47506885579279b6a098130b542df60b0f884

Download Submit
C:\Program Files\iTunes\iTunes.Resources\tr.lproj\ViewLineItemRatingE.png

Filesize
226B

MD5
18109ed593d861bd659055a5bd9db831

SHA1
3b2596e909633ca509e857650d7d7c9693987a4c

SHA256
1c28554bca95dba35ce291c0a42e0810e2ceebe805d63f916b6b7505e057752e

SHA512
1b8bb8ce363f7b5db7fe6648f518d0d528cb47bc90f5c80e66d8928b79f7912879b1c35ec6944d9ff91cb70c84547b9e46758cdd315e299453016da3cc24bed9

Download Submit
C:\Program Files\iTunes\iTunes.Resources\vi.lproj\StoreBlankBuyButton.png

Filesize
3KB

MD5
ceeb4e2a8deb651b69a973f5d671d92f

SHA1
3fff59aa350cdd2cfea69c08b55540b63122bf26

SHA256
51edab4204721531caab3a704e86d54445db4b4ddca70ef2c4b1012fa6bb3d5f

SHA512
9112040b761b90b93e89249986e6e75d55038fc1537293d7eadd02e181effd601ea15aff7a3100cf2c72de610b8b4cfefb433ae8bd75499e4a3dbbccf8410493

Download Submit
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]

Filesize
386B

MD5
ff602a53d097a0d42fae257d6cd2fcac

SHA1
57ed476c7c88b7c231ec9e4d6acbd5c04808d78c

SHA256
8acad76c6c4eb0c023664b845a7492adc2e418cefa48aba7e99496125a06e5cf

SHA512
a5f0d07314040fdbc614d09e2d38bf87ad0a1286c472f8c7403dd488488124e769d436ec1b01ff1b47825455f03aafadcac5722f4367fcdefb13ec3de0ec8def

Download Submit
C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]

Filesize
314B

MD5
755eb418266342b17633f1615a1882b0

SHA1
df51fddb36717426da15d38f4edd48f74c140364

SHA256
f5f639656493f65e4a5462f6c4e280fdd54a7a4e839c2c0f52c8b5b1840fdab2

SHA512
8bd4b9879f1899c2a5e5f9de80897882f262252260c69767365634f9a97e281020176613c58a9d22ffcb510f1cce66dcf26903092c455d7b17f951ba0876f116

Download Submit
C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\[email protected]

Filesize
416B

MD5
e14f8e390a9c489b10eb23306d27824a

SHA1
e33831e12fa5092ca15e7d8af7b01afed996b30c

SHA256
0775705d7637f7173ec31f22e324af8160b43d4cc6a47a2f199b3751963252b5

SHA512
63c3e261ea445de5d7eaab326e0168db054b4d953e81f89f16446a1ef5170a96aa32db5d7cf42181f990a8028e9a67764885a6d94f74d1d1c9910dcebc4f8a4d

Download Submit
C:\Program Files\iTunes\iTunes.exe

Filesize
37.1MB

MD5
4838dc0d3320212ca64e2be611007b73

SHA1
704ddbcf701b22fcd1f7d3159bf275f8dc1656a3

SHA256
0e593879dd03f64125efcfbf42bd2c81a6339f3c3e8675527af52956298c278e

SHA512
1a4d6b72c14d7b86e9b3071bcf45d5af7fd3e03ff29deecbda00e7522e4130739f34e39f27995904f8b3a8bb6402d2721b908cf4c5998f17f86d79aaedee01d4

Download Submit
C:\ProgramData\Apple\Installer Cache\Apple Software Update 2.7.0.3\AppleSoftwareUpdate.msi

Filesize
3.4MB

MD5
adf71b16f66b235268c5d894bb7c46a5

SHA1
b44a713560477c1ddc0be33bfff1a21cba714bc7

SHA256
0610ef6e01c2ba53f57035545f2c61e85b1bafa6334a47f6de8a63b060f9a130

SHA512
4564dba8763a165b582e0ab785fbf658f50fe07469716d0b840261a8faa9b1b9ffba54cab14f674b46bb22445128a1f56e36491421c8ca0b7dab1d933e0dcbd4

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk

Filesize
1KB

MD5
309618ab834a8a223c5b7360a6ff1ffa

SHA1
52d5756c05e226678f96364aa1fd7fb1959edd07

SHA256
d6a180fb27094b29eddaacef6b91c9ef658f2b134555674ed14d855973102a8a

SHA512
70a2b1a4c41d333ce1f17597de831f909ebf143dd5332a40b6d083f0f6fc92f0b3ef0dfc9237d78cb70c08dc76c211512958b3759e23a1935a2f59c8766d7aab

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk~RFe599169.TMP

Filesize
1KB

MD5
4143779170de14468a1d61e9fb5c32e8

SHA1
23a3aaffdc364b967fc6ffd1d67a012fcee75253

SHA256
f06f0a499e86c23fd40f12d0b305373f91707413e268ddfa55e6097ffe846df3

SHA512
7d442d48ab5ad814504a447fb98f5e9ce3051af4a40469e2953aaf51b9b69e37545d4460785fda9259548485414a75216070e13d81197bc17173dc52f9bb6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP439.TMP\AppleMobileDeviceSupport64.msi

Filesize
38.4MB

MD5
822cc0b857a684a4d7ae764df894b3d7

SHA1
8061ba2ab236a37f3e9d3f02c32245f491a4822c

SHA256
689898bad3bf4cf51ee5c016f10d8920011e6aa9a60e36c25203c15f9db790e2

SHA512
670d3384702cf198c4f18de8a84b5d0f0c8c1f6377fee702f757f9b2175735fde04f3d2deecf70dd3babcd4535d27ada555e957990628988ae14c4a5df782d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP439.TMP\Bonjour64.msi

Filesize
2.6MB

MD5
86e2b390629665fbc20e06dfbf01a48f

SHA1
d9f4697a6f4eceea24735822cb1df501268ca0b0

SHA256
46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

SHA512
05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP439.TMP\SetupAdmin.exe

Filesize
141KB

MD5
c9a5611e664603dc6d1fde5a5c184e82

SHA1
ac5d33f18f20c4f35c2bc1953ffdff90b2b67eef

SHA256
82b6275f0b7ebda120fb4c5a902eccd14b536900b5058c260c58d6ed9983444a

SHA512
ed7ade6f6f32e4bcf98c79470bbba631fcac10ee583ee2c8eb67ac3cf64f92a42014674b16dea7ec944f4b65f34907c9a0596075dcdd2e5cbeacd1384a32acad

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4198.tmp

Filesize
205KB

MD5
f1744d984e68dff3a3d163aa6fa04330

SHA1
2d461feb85a264e890876baa17fb784848e5a77c

SHA256
ee4774ab38a39d5bbf7ad620a9b3c1b8fce11b11740566de4eb88919e10a748a

SHA512
bd49847322e9ddc8c7ede601ee7f4858facd92ff255b421eee986a904da06c9219fd73e3e1cd94f4878365afa19a528bab492d813e8656060f332aa0cdd3c483

Download Submit
C:\Windows\Installer\MSI66B4.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI6A90.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\MSI7B5C.tmp

Filesize
137KB

MD5
99722faa1307994df9d9ed20ca02b667

SHA1
232b9ed77bede43ec1e98b367a414c28f24efb43

SHA256
cf300f523b7499fd7296a69182d7b3ffc62e45bfee98570016f644f24e43a4e3

SHA512
5c71a07b5d2d63f02bf6657de13a2ac8033d1698bf755ad13e3b8b50568983b011557900bf7bde09dfcc3b572c80088271c1d0f141c1d4c53af45891b3d8c9bc

Download Submit
C:\Windows\Installer\MSI8A76.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI8B22.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI910C.tmp

Filesize
127KB

MD5
93394d2866590fb66759f5f0263453f2

SHA1
2f0903d4b21a0231add1b4cd02e25c7c4974da84

SHA256
5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b

SHA512
f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622

Download Submit
C:\Windows\Installer\MSIAA5B.tmp

Filesize
133KB

MD5
928f5dc7a304a78d8687b16618ae7808

SHA1
b75a22cbcce356cdaf39ad2315ac8974f4ee62d4

SHA256
d1727467b076e59abc58fbc6a4355a9d238fc5b1842644e33a0f920aab449e28

SHA512
c85167a58195261cf71c528e4877618fc7183fe04284abf7cc1b50bb74add5bff81d53371d881771bc96302b0be35c2aad9696a7cb3292c3c3ab3cb8e4712900

Download Submit
C:\Windows\System32\msvcp140.dll

Filesize
554KB

MD5
c7a693fcffcb6c245282d1132e38ac5b

SHA1
8965f69c938eecb2226ad7329a9df5109d93cb8c

SHA256
a8102891d06b5f21c35c67e4ab26eb84f54405b67e67eaf75dadc62cef08b55a

SHA512
321456ae04eb392734a0aba27e965500467d58dc1277fc550b6573916607ba53c686db05219ce326fb3f9289cc4430b85990362f630e4a7829345067986ca6d2

Download Submit
C:\Windows\System32\vcruntime140.dll

Filesize
94KB

MD5
6e34fc4a713c3fbd88e47ac188d2540d

SHA1
1877a17da406d147566168c56aac1eb576782b37

SHA256
d8faf8ebf360ed0b3b1a43877a04863f7e044b3d19b641d88737e0829d683b36

SHA512
848a1d9602210d7da0f6e4d7817af08dc02baac7eccf1cfaadaf3a24b55e1316e77c40672a6a1195797e525f448817e534ae200e99cdf548ee64a7996fbcec4f

Download Submit
C:\Windows\System32\vcruntime140_1.dll

Filesize
36KB

MD5
d76532f224b6648179b77525326e8754

SHA1
cb0a90adf84b9c19e750b166789452693f031053

SHA256
0d8217dbb0d52a3f8cd233b089131ca19aa6e0fc0c0fb10081f3c50761f5d15e

SHA512
721b4f0f55fbeefa394d3471c66d32e2f0f452f9977987450b1662b8e2e9a88d1b9c014b5f2a4b378d99f6fe4de6b5810f8b00157ae25b0de2a3bf3e211ea2fc

Download Submit
memory/2164-5205-0x00007FFF2FA00000-0x00007FFF2FA8E000-memory.dmp

Filesize
568KB

Download
memory/2164-5206-0x00007FFF40B00000-0x00007FFF40B0C000-memory.dmp

Filesize
48KB

Download
memory/2164-5207-0x00007FFF40B30000-0x00007FFF40B4B000-memory.dmp

Filesize
108KB

Download
memory/3408-695-0x0000017AE23E0000-0x0000017AE2414000-memory.dmp

Filesize
208KB

Download
memory/4776-666-0x0000000002B20000-0x0000000002B5F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads