hxxps://url[.]3u[.]com/zmAJjyaa

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
31	1368	msedge.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iTunes.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	3uTools_v3.26.007_Setup_x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	3uTools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	iTunes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 21 IoCs

pid	Process
2552	3uTools_v3.26.007_Setup_x86.exe
3008	3uTools_v3.26.007_Setup_x86.exe
6004	3uTools.exe
5196	updater.exe
3244	3uViewer.exe
928	3uViewer.exe
3460	InfInstallerx64.exe
5116	InfInstallerx64.exe
3932	InfInstallerx64.exe
3752	iTunes(12.12.9.4).exe
4360	SetupAdmin.exe
1600	mDNSResponder.exe
2824	Process not Found
4900	AppleMobileDeviceService.exe
5960	SoftwareUpdate.exe
5244	iTunesHelper.exe
4088	iTunesHelper.exe
4464	iTunes.exe
3872	QtWebEngineProcess.exe
5244	QtWebEngineProcess.exe
6008	QtWebEngineProcess.exe

Loads dropped DLL 64 IoCs

pid	Process
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6024	takeown.exe
3220	takeown.exe
6064	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper = "\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""	msiexec.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
357	5928	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\appleusb.inf_amd64_58854158183af679\AppleKmdfFilter.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\appleusb.inf_amd64_58854158183af679\AppleUsb.inf	DrvInst.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\AppleKIS.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\AppleRSMInterface.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applersm.inf_amd64_22734d1c46db7f66\AppleRSM.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applersm.inf_amd64_22734d1c46db7f66\AppleRSM.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}	DrvInst.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\SET69AF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\AppleUsbFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applekis.inf_amd64_0d321f6593083a69\AppleKISInterface.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applekis.inf_amd64_0d321f6593083a69\AppleKIS.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET7248.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\SET69AE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\AppleKIS.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\AppleLowerFilter.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET792F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET7941.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET7249.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\AppleUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET725B.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applekis.inf_amd64_0d321f6593083a69\AppleKIS.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET724A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET791E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\appleusb.inf_amd64_58854158183af679\AppleUsbFilter.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\SET69B0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET7941.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\SET69AF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET7248.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET724A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\AppleRSM.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET791E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET7931.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\AppleKIS.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applekis.inf_amd64_0d321f6593083a69\AppleKIS.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\AppleRSM.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\AppleRSM.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET7930.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\SET69B0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET7249.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7aedeb92-8733-8d43-8ad9-6af903157791}\SET725B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET792F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\AppleKmdfFilter.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applersm.inf_amd64_22734d1c46db7f66\AppleRSMInterface.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\appleusb.inf_amd64_58854158183af679\AppleUSB.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\SET699D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abfcc58c-88c1-4e46-aa73-0bbf92f56c9e}\AppleKISInterface.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\AppleUsb.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}\SET7931.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\appleusb.inf_amd64_58854158183af679\AppleLowerFilter.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{464005a9-3371-d04b-bbca-301eacff0cb8}	DrvInst.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/6004-1995-0x000000006BED0000-0x000000006C76F000-memory.dmp	upx
behavioral1/memory/6004-2783-0x000000006BED0000-0x000000006C76F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\PrintingTemplates\02.Playlist.UserRatings.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hi.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\HeapAllocationsInstrument.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\SpringEditor.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\Qt5Gui.dll	3uTools_v3.26.007_Setup_x86.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\libdispatch.dll	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\es_419.lproj\Error.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\Undock.svg	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\en_GB.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fi.lproj\PrintingTemplates\12.Insert.MosaicBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\ViewLineItemiTunesExtras.png	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\resources\locales\da.pak	3uTools_v3.26.007_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\plugins\audio\qtaudio_windows.dll	3uTools_v3.26.007_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\plugins\imageformats\qtga.dll	3uTools_v3.26.007_Setup_x86.exe
File created	C:\Program Files\iTunes\Acknowledgements.rtf	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Test\ProtocolTestHarness.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pl.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\JavaScriptCore.resources\Info.plist	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Controllers\DOMManager.js	msiexec.exe
File created	C:\Program Files\iTunes\MediaAccessibility.resources\pt.lproj\ProfileNames.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\th.lproj\iTunesExtraListView.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\locales\images\fr\icon_ipa_type.png	3uTools_v3.26.007_Setup_x86.exe
File created	C:\Program Files (x86)\3uToolsV3\QCommonPlugins.dll	3uTools_v3.26.007_Setup_x86.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\da.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServicesUI.Resources\SyncServicesUI-Info.plist	msiexec.exe
File created	C:\Program Files\iTunes\CFNetwork.resources\id.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\th.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\StorageIcons.css	msiexec.exe
File created	C:\Program Files\iTunes\CoreFoundation.resources\ca.lproj\Error.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\CFNetwork.resources\pl.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\Sending.svg	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\it.lproj\PrintingTemplates\07.Insert.TextOnly.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\PrintingTemplates\06.AlbumList.ListOfAlbums.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ms.lproj\DeviceCapacityBox.png	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\files\ipa\u200js.zip	3uTools_v3.26.007_Setup_x86.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1800_2057266992\safety_tips.pb	msedge.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hi.lproj\StorePreOrderButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\cs.lproj\StoreRentButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ro.lproj\StorePreOrderButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hu.lproj\ViewLineItemiTunesExtras_dark.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nb.lproj\License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\LocalResourceOverrideLabelView.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\plugins\virtualkeyboard	3uTools_v3.26.007_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\translations\qtwebsockets_fr.qm	3uTools_v3.26.007_Setup_x86.exe
File opened for modification	C:\Program Files (x86)\3uToolsV3\Qt5WebChannel.dll	3uTools_v3.26.007_Setup_x86.exe
File created	C:\Program Files\iTunes\MediaAccessibility.resources\uk.lproj\ProfileNames.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Controllers\SelectionController.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sk.lproj\PrintingTemplates\12.Insert.MosaicBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\da.lproj\iPod License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ru.lproj\ViewLineItemUnsubscribe.png	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\translations\qtwebengine_locales\nb.pak	3uTools_v3.26.007_Setup_x86.exe
File created	C:\Program Files (x86)\Apple Software Update\SoftwareUpdateFiles.Resources\el.lproj\SoftwareUpdateFilesLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\CoreFoundation.resources\fr.lproj\Error.strings	msiexec.exe
File created	C:\Program Files\iTunes\ColorSync.resources\Profiles\BGR.icc	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hr.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\EventStop.svg	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ObjectTreeMapEntryTreeElement.js	msiexec.exe
File created	C:\Program Files (x86)\3uToolsV3\files\OpenStreetMap\images\marker-icon.png	3uTools_v3.26.007_Setup_x86.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File created	C:\Windows\Installer\e5b4f5a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6018.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{CA8EDE78-7A08-4F27-9B31-D6161C095986}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI77ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D71.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\Installer\MSI68A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9AE.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\Installer\e5b4f5b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\87EDE8AC80A772F4B9136D61C1909568\16.5.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4f60.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B292D163-23D2-4523-A699-1ABEC1875609}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5303.tmp	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File created	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\AppleSoftwareUpdateIco.exe	msiexec.exe
File created	C:\Windows\Installer\e5b4f65.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC48E.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CA8EDE78-7A08-4F27-9B31-D6161C095986}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7694.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b4f60.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\87EDE8AC80A772F4B9136D61C1909568\16.5.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\e5b4f5f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D81.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51C8.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\87EDE8AC80A772F4B9136D61C1909568\16.5.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\SourceHash{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\87EDE8AC80A772F4B9136D61C1909568\16.5.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e5b4f55.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F7A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4f5b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\87EDE8AC80A772F4B9136D61C1909568	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e5b4f67.msi	msiexec.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{76420BC2-0A88-4483-BDB1-0DD97DFF3163}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{76420BC2-0A88-4483-BDB1-0DD97DFF3163}\iTunes.ico	msiexec.exe
File created	C:\Windows\Installer\{76420BC2-0A88-4483-BDB1-0DD97DFF3163}\RichText.ico	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80CB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b4f64.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CB0246788A03844DB1BD09DD7FF1336\12.12.9\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5040.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5246.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6077.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4f65.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uTools_v3.26.007_Setup_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uTools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupAdmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3uTools_v3.26.007_Setup_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftwareUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	3uTools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	3uTools.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	pnputil.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003c452df13e30c07c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003c452df10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003c452df1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3c452df1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003c452df100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	3uTools.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	pnputil.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	pnputil.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SoftwareUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iTunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	iTunes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	SoftwareUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

defense_evasion spyware trojan

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133957837952206892"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDRecord\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Bonjour.DLL\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.itpc\Content Type = "application/x-itunes-itpc"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{11E4D223-C650-43F9-AB90-AB3AE4FB38F0}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71A1A612-F7B4-4092-8E0F-C79C8FB0391D}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\ = "DNSSDRecord Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{88F48C4A-46DF-4236-A838-364BF1B3FD1E}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u8\ = "iTunes.m3u8"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.itls\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpg\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}\ = "{031EE060-67BC-460d-8847-E4A7C5E45A27}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\ProgID\ = "Bonjour.DNSSDService.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpg\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\OpenWithProgIds\iTunes.wav	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunesAdmin.iTunesAdminMobileDeviceService.1\CLSID\ = "{71A1A612-F7B4-4092-8E0F-C79C8FB0391D}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB46F03E-7CD2-489F-8F95-BB950F395FDB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.itpc\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.wave\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\itms\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11E4D223-C650-43F9-AB90-AB3AE4FB38F0}\NumMethods\ = "11"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.wav\OpenWithProgids	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wave\OpenWithProgIds\iTunes.wave	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoftwareUpdate.ASUController	SoftwareUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\361D292B2D3232546A99A1EB1C786590\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0A6C1F8-BF3D-4CD8-AC47-FE32BDD17257}\ = "IITArtwork"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.rmp\ = "RealJukebox Music Package"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C403E73D-D090-490C-BCF9-F4C375094C7F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.AssocProtocol.itls	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpg\shell\play\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /play \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8DF592B-DE05-49f5-BB21-084F548F12A9}\ProgID\ = "iTunesAdmin.iTunesAdminEnableAutoRun.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunesAdmin.iTunesAdminMigrateApplication	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CB0246788A03844DB1BD09DD7FF1336\ProductIcon = "C:\\Windows\\Installer\\{76420BC2-0A88-4483-BDB1-0DD97DFF3163}\\Installer.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppleSoftwareUpdate.ASUInstallHost\CLSID\ = "{91A9E6A9-3935-4A37-AFBA-F0904B166364}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cda\Content Type = "application/x-cdf"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.aa\shell\play\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.aif\shell\play	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aifc\shell\play\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /play \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\itpc\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC0C2640-1415-4644-875C-6F4D769839BA}\VersionIndependentProgID\ = "iTunes.Application"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4r\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\daap\ = "URL:Digital Audio Access Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itunesradio\DefaultIcon\ = "C:\\Program Files\\iTunes\\iTunes.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\itls\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ShowSongsOnCD\shell\showsongs\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /AutoPlayShowSongs \"%L\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aifc\ = "AIFF Audio File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C47A705-8E8A-45A1-9EED-71C993F0BF60}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aifc\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdda\OpenWithProgIds\iTunes.cdda	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m3u\shell\play\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /play \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.itdb	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpeg\shell\open\ = "&Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aif\DefaultIcon\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\",-132"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{08A6AF6A-8FF2-4a3b-BECF-C2FAC8630BBF}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11E4D223-C650-43F9-AB90-AB3AE4FB38F0}\InProcServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SoftwareUpdate.exe	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{F98206B5-F052-4965-9FA0-85F61BC3C19D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aax\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aiff\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.mov\shellex	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	QtWebEngineProcess.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	QtWebEngineProcess.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	QtWebEngineProcess.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6004	3uTools.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2552	3uTools_v3.26.007_Setup_x86.exe
2552	3uTools_v3.26.007_Setup_x86.exe
2552	3uTools_v3.26.007_Setup_x86.exe
2552	3uTools_v3.26.007_Setup_x86.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
1984	msedge.exe
1984	msedge.exe
6004	3uTools.exe
6004	3uTools.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe
1484	MsiExec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6004	3uTools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	3uTools_v3.26.007_Setup_x86.exe
Token: SeDebugPrivilege	6004	3uTools.exe
Token: SeRestorePrivilege	6004	3uTools.exe
Token: SeBackupPrivilege	6004	3uTools.exe
Token: SeTakeOwnershipPrivilege	6024	takeown.exe
Token: SeAuditPrivilege	3732	svchost.exe
Token: SeSecurityPrivilege	3732	svchost.exe
Token: SeLoadDriverPrivilege	3460	InfInstallerx64.exe
Token: SeLoadDriverPrivilege	6004	3uTools.exe
Token: SeRestorePrivilege	6004	3uTools.exe
Token: SeBackupPrivilege	6004	3uTools.exe
Token: SeLoadDriverPrivilege	5116	InfInstallerx64.exe
Token: SeLoadDriverPrivilege	6004	3uTools.exe
Token: SeRestorePrivilege	6004	3uTools.exe
Token: SeBackupPrivilege	6004	3uTools.exe
Token: SeLoadDriverPrivilege	3932	InfInstallerx64.exe
Token: SeLoadDriverPrivilege	6004	3uTools.exe
Token: 33	3752	iTunes(12.12.9.4).exe
Token: SeIncBasePriorityPrivilege	3752	iTunes(12.12.9.4).exe
Token: SeShutdownPrivilege	5928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5928	msiexec.exe
Token: SeSecurityPrivilege	2700	msiexec.exe
Token: SeCreateTokenPrivilege	5928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5928	msiexec.exe
Token: SeLockMemoryPrivilege	5928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5928	msiexec.exe
Token: SeMachineAccountPrivilege	5928	msiexec.exe
Token: SeTcbPrivilege	5928	msiexec.exe
Token: SeSecurityPrivilege	5928	msiexec.exe
Token: SeTakeOwnershipPrivilege	5928	msiexec.exe
Token: SeLoadDriverPrivilege	5928	msiexec.exe
Token: SeSystemProfilePrivilege	5928	msiexec.exe
Token: SeSystemtimePrivilege	5928	msiexec.exe
Token: SeProfSingleProcessPrivilege	5928	msiexec.exe
Token: SeIncBasePriorityPrivilege	5928	msiexec.exe
Token: SeCreatePagefilePrivilege	5928	msiexec.exe
Token: SeCreatePermanentPrivilege	5928	msiexec.exe
Token: SeBackupPrivilege	5928	msiexec.exe
Token: SeRestorePrivilege	5928	msiexec.exe
Token: SeShutdownPrivilege	5928	msiexec.exe
Token: SeDebugPrivilege	5928	msiexec.exe
Token: SeAuditPrivilege	5928	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5928	msiexec.exe
Token: SeChangeNotifyPrivilege	5928	msiexec.exe
Token: SeRemoteShutdownPrivilege	5928	msiexec.exe
Token: SeUndockPrivilege	5928	msiexec.exe
Token: SeSyncAgentPrivilege	5928	msiexec.exe
Token: SeEnableDelegationPrivilege	5928	msiexec.exe
Token: SeManageVolumePrivilege	5928	msiexec.exe
Token: SeImpersonatePrivilege	5928	msiexec.exe
Token: SeCreateGlobalPrivilege	5928	msiexec.exe
Token: SeCreateTokenPrivilege	5928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5928	msiexec.exe
Token: SeLockMemoryPrivilege	5928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5928	msiexec.exe
Token: SeMachineAccountPrivilege	5928	msiexec.exe
Token: SeTcbPrivilege	5928	msiexec.exe
Token: SeSecurityPrivilege	5928	msiexec.exe
Token: SeTakeOwnershipPrivilege	5928	msiexec.exe
Token: SeLoadDriverPrivilege	5928	msiexec.exe
Token: SeSystemProfilePrivilege	5928	msiexec.exe
Token: SeSystemtimePrivilege	5928	msiexec.exe
Token: SeProfSingleProcessPrivilege	5928	msiexec.exe
Token: SeIncBasePriorityPrivilege	5928	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
2552	3uTools_v3.26.007_Setup_x86.exe
3008	3uTools_v3.26.007_Setup_x86.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
6004	3uTools.exe
5196	updater.exe
6004	3uTools.exe
6004	3uTools.exe
3244	3uViewer.exe
928	3uViewer.exe
6004	3uTools.exe
6004	3uTools.exe
3752	iTunes(12.12.9.4).exe
5960	SoftwareUpdate.exe
4464	iTunes.exe
4464	iTunes.exe
3872	QtWebEngineProcess.exe
5244	QtWebEngineProcess.exe
6008	QtWebEngineProcess.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3556	1800	msedge.exe	87
PID 1800 wrote to memory of 3556	1800	msedge.exe	87
PID 1800 wrote to memory of 1368	1800	msedge.exe	88
PID 1800 wrote to memory of 1368	1800	msedge.exe	88
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1296	1800	msedge.exe	89
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90
PID 1800 wrote to memory of 1436	1800	msedge.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.3u.com/zmAJjyaa
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2e4,0x7ffc565ef208,0x7ffc565ef214,0x7ffc565ef220
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1760,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2184,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2588,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3516,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3524,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4816,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4876,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5552,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5996,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6376,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6376,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6740,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6304,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5036,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5196,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3564,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5224,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:5292
- C:\Users\Admin\Downloads\3uTools_v3.26.007_Setup_x86.exe
  "C:\Users\Admin\Downloads\3uTools_v3.26.007_Setup_x86.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2552
- - C:\Program Files (x86)\3uToolsV3\3uTools.exe
    "C:\Program Files (x86)\3uToolsV3\3uTools.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:6004
  - - C:\Program Files (x86)\3uToolsV3\updater.exe
      "C:\Program Files (x86)\3uToolsV3\updater.exe" /background
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5196
  - - C:\Program Files (x86)\3uToolsV3\3uViewer.exe
      3uViewer.exe /reg 1
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3244
  - - C:\Program Files (x86)\3uToolsV3\3uViewer.exe
      3uViewer.exe /reg 2
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:928
  - - C:\Program Files (x86)\3uToolsV3\files\inf\InfInstallerx64.exe
      "C:\Program Files (x86)\3uToolsV3\files\inf\InfInstallerx64.exe" -i "C:\Users\Admin\AppData\Local\Temp\itunes_fix\applekis\x64\AppleKIS.inf"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3460
    - - C:\Windows\SYSTEM32\takeown.exe
        
        takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
        5⤵
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:6024
    - - C:\Windows\SYSTEM32\cacls.exe
        
        cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
        5⤵
        
        PID:4660
    - - C:\Windows\SYSTEM32\pnputil.exe
        
        pnputil -i -a "C:\Users\Admin\AppData\Local\Temp\itunes_fix\applekis\x64\AppleKIS.inf"
        5⤵
        Drops file in Windows directory
        Checks SCSI registry key(s)
        
        PID:3264
  - - C:\Program Files (x86)\3uToolsV3\files\inf\InfInstallerx64.exe
      "C:\Program Files (x86)\3uToolsV3\files\inf\InfInstallerx64.exe" -i "C:\Users\Admin\AppData\Local\Temp\itunes_fix\applersm\x64\AppleRSM.inf"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5116
    - - C:\Windows\SYSTEM32\takeown.exe
        
        takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
        5⤵
        Modifies file permissions
        
        PID:3220
    - - C:\Windows\SYSTEM32\cacls.exe
        
        cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
        5⤵
        
        PID:1056
    - - C:\Windows\SYSTEM32\pnputil.exe
        
        pnputil -i -a "C:\Users\Admin\AppData\Local\Temp\itunes_fix\applersm\x64\AppleRSM.inf"
        5⤵
        Checks SCSI registry key(s)
        
        PID:4108
  - - C:\Program Files (x86)\3uToolsV3\files\inf\InfInstallerx64.exe
      "C:\Program Files (x86)\3uToolsV3\files\inf\InfInstallerx64.exe" -i "C:\Users\Admin\AppData\Local\Temp\itunes_fix\appleusbdevice\x64\AppleUsb.inf"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3932
    - - C:\Windows\SYSTEM32\takeown.exe
        
        takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
        5⤵
        Modifies file permissions
        
        PID:6064
    - - C:\Windows\SYSTEM32\cacls.exe
        
        cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
        5⤵
        
        PID:1924
    - - C:\Windows\SYSTEM32\pnputil.exe
        
        pnputil -i -a "C:\Users\Admin\AppData\Local\Temp\itunes_fix\appleusbdevice\x64\AppleUsb.inf"
        5⤵
        Drops file in Windows directory
        Checks SCSI registry key(s)
        
        PID:5484
  - - F:\3uToolsV3\Other\iTunes(12.12.9.4).exe
      "F:\3uToolsV3\Other\iTunes(12.12.9.4).exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3752
    - - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP694.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
        5⤵
        Blocklisted process makes network request
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:5928
      - C:\Program Files\iTunes\iTunesHelper.exe
        
        "C:\Program Files\iTunes\iTunesHelper.exe"
        6⤵
        Executes dropped EXE
        
        PID:4088
      - C:\Program Files\iTunes\iTunes.exe
        
        "C:\Program Files\iTunes\iTunes.exe"
        6⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:4464
  - - C:\Program Files (x86)\3uToolsV3\QtWebEngineProcess.exe
      "C:\Program Files (x86)\3uToolsV3\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --no-sandbox --application-name=3uTools --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3748 /prefetch:8
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      PID:3872
  - - C:\Program Files (x86)\3uToolsV3\QtWebEngineProcess.exe
      "C:\Program Files (x86)\3uToolsV3\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=2 --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5244
  - - C:\Program Files (x86)\3uToolsV3\QtWebEngineProcess.exe
      "C:\Program Files (x86)\3uToolsV3\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2488 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:6008
- C:\Users\Admin\Downloads\3uTools_v3.26.007_Setup_x86.exe
  "C:\Users\Admin\Downloads\3uTools_v3.26.007_Setup_x86.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1640,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=868,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6940,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6236,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6024,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6892,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1124,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3240,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5608,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5868,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5516,i,1014305907601762469,7115288935115738626,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3732
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{482a71f4-243c-be44-a231-643435ab5b13}\AppleKIS.inf" "9" "4639b046f" "0000000000000140" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\AppData\Local\Temp\itunes_fix\applekis\x64"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2992
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c488992e-1c82-254a-9bb5-3b4fb063b2ed}\AppleRSM.inf" "9" "4c7809927" "0000000000000140" "WinSta0\Default" "00000000000000E8" "208" "C:\Users\Admin\AppData\Local\Temp\itunes_fix\applersm\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5732
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1b2a9100-79f5-9748-8bb9-46df7e9783dd}\AppleUsb.inf" "9" "4ca0613ab" "00000000000000E8" "WinSta0\Default" "0000000000000170" "208" "C:\Users\Admin\AppData\Local\Temp\itunes_fix\appleusbdevice\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2700
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 523A596621093268976157206D6128E8 C
  2⤵
  PID:4276
- - C:\Users\Admin\AppData\Local\Temp\IXP694.TMP\SetupAdmin.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP694.TMP\SetupAdmin.exe" /evt E090 /pid 4276 /mon 780 796
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4360
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D1FDF070B67BB9779E27A5E38EC8B726
  2⤵
  PID:3504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C05BE68634460C96C4AB3D2761288328
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2B200C200FBAC4031E5ABAF4118B3116 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3092
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  PID:1076
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EB137E94AAF6F05509D25A589602EE4A
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding ABC87B4E229619E99D0C450AB5EB4123
  2⤵
  PID:2768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5325CA2E3A9C3F5C1127571E1AAF6A32 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8AAC1FC868404377935DA7D7E078B7CA
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1804
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3872
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1780
- C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
  "C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" /RegServer
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DFE50F95829020F6C3C87E3727B06829 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2552
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6064
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D23E0CC22A4F36A0C72E732CDE583B02
  2⤵
  PID:692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A2C635392427CFDC9BBB09EC36BE6C55
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1496
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C325C67DD45D35DCFBFDB9C8E5F09BE7 E Global\MSI0000
  2⤵
  PID:556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2A15218C28A7B214D29B29C9DC91BECF E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1060

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:1600

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4900

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{16D99191-6280-4B33-A2F5-04805A0FC582}
1⤵
- System Location Discovery: System Language Discovery
PID:1768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\iTunes\iTunesHelper.exe"
1⤵
PID:640
- C:\Program Files\iTunes\iTunesHelper.exe
  "C:\Program Files\iTunes\iTunesHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:5244

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x510
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b4f58.rbs

Path C:\Config.Msi\e5b4f58.rbs
Size 126KB
SHA256 b5cd589b703a12dbbbbc94b21040150f994c964c5501ff53ffec45f8ab134a69
MD5 5efa4fea10c228856acfe63253c25a44
SHA1 a1cf252d3798a7f7305e43f121251cb002a27f81
SHA512 c9b2ed97e30b777496a9b94287525eb35a2c2cea3271b7c4d7282728249a5abd30143f87161154fe76cdcf9fa65341e73fa50c3feee7561c44fc436bf57e9415
SSDEEP 1536:l91QTpWuHtAjssPAv1yiUHmByZXTN5GCOPRj15+3rT0q6MnuODy:Rjs0AvSXTNOtHKTZ6qy
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5b4f5e.rbs

Path C:\Config.Msi\e5b4f5e.rbs
Size 332KB
SHA256 8c2762b15bda30ea382bd22187d342ab2453b18733859f94d5a0932aa296395c
MD5 bc8e0803880358f608301cf77cf368ae
SHA1 f2982130af7a75eb681978835a2718c0d69a0686
SHA512 3fe9b6f9de1f21438cbc15c4b66b0efe892bac76b648c18e75224a4e7a7a7106d7880a8dc225602bb7360a49eab8b1d28c40b2d844ac0981951f4d427c039ebb
SSDEEP 3072:mMQEp5CKLNLJz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+7:mMft/kE1jOZy2KL4GBiwQtEa4L2sd
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5b4f63.rbs

Path C:\Config.Msi\e5b4f63.rbs
Size 167KB
SHA256 cad86f62a0a21c31a9dd430785290e8171b2c6f8e619d39ea38f2179b61afe76
MD5 abefb7a797b10b9b440f8d11b0d0d213
SHA1 12e284551e940d235b71df7e81030dc76282ef24
SHA512 bc6718b75cd388e427fff6bc026afe6be6ff809ca8cc00f8e0285aca3301ecf4d87d8410002bb7fdea8acb7ed554bb99deebccb3d93c703a57a305c2646c0dbf
SSDEEP 3072:Tytjj1CoPLdQroI9aoxZShVIkkq5U/ii4G652gyqUTzEZgG2b:nojdQr39r/2VIrRtgyqKGq
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5b4f66.rbs

Path C:\Config.Msi\e5b4f66.rbs
Size 1.3MB
SHA256 88b6f84626537f26fc439bf33eae7d580b67f7ec3ce23451be3d9f47b812de78
MD5 2a4d0fc718fc541273b139884fb56f07
SHA1 46a15836261f2a793cb8291ea7532006454e6aa2
SHA512 f6b4268b3b5e4042755107283bb29e5388f66a902b94463b3e4a2f74ba50403eeb3f28d4e3a7882d05e1d64beac5915251434408830c8031a76bc63eff09de25
SSDEEP 12288:MmnazHVXjUdqujnzh85oV+SZ7txA/NAUB5Es:6zNQv65X7Bh
MD5 SHA1 SHA512 SSDEEP

Submit Download

3uTools.exe

Path C:\Program Files (x86)\3uToolsV3\3uTools.exe
Size 13.1MB
SHA256 841a852a4adb5fe2f002e4c76669639dfff528bd35328fdaeb99f7aaa8c5d9c4
MD5 e7a1f0a9854b9f40aa199144a2aeb44c
SHA1 fd8c92a89e17a8ed44e7c3465b3b79b07cc3b027
SHA512 aca7cc1291ce4b62b340848f272f66b1ebe41a777c783a172f4deccfcf46e023c03e8ae9e6704eb02913cf30dbefae1d16f718fca8ea5abc4f6e7e45f32659ca
SSDEEP 196608:+mwj0q/9+61nDzlGOdJmGT8enffJdXut1le0ZcYEH59XsTDv1umu8QYrbVtCKnOt:+xj0q/9+6VdxeGT8enfvXUPoL8ZVtCB
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP140.dll

Path C:\Program Files (x86)\3uToolsV3\MSVCP140.dll
Size 429KB
SHA256 3bad372a03a23d6b1f375edb643052b7c3aee288721ec4f46cd497112201fc78
MD5 2b4ffec9d5fee9785112aeffc12772fd
SHA1 af4ce2133cacbdec1ff369bd161f9e9baf24b219
SHA512 253728cb067125fad712b4af37bd5428a17b78a525b2c6f98a15e3c400adc5dbcddfc3c3e0ae0bbb94e77659f67d76de7114e1c97471f60fc0856f84721a582e
SSDEEP 12288:csT3buPmG3yJrcAJ6feISGVzDu9jXi6bphUgiW6QR7t5s03Ooc8dHkC2es6kyZ:csT3qnyJrBJkSozDu9bi6bG03Ooc8dHn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Concurrent.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Concurrent.dll
Size 45KB
SHA256 82e98a575074e0509fb7b4b386e3882ca0251e3a2177cb06cd9136cc168d6916
MD5 63d3501f7f002daa96e31b463c566925
SHA1 bee2e5318f4d86c0a6abc7ad48469b8eb5773c7a
SHA512 3bdb875e630a4f68186aa491279a829dfda78a0f64ee84d6276dbde5530339fe42373e220eff7a14b42a938e477fcc888655ca17d57061a92d202d7b220bc5f6
SSDEEP 768:AVzwdKHHTi6DNBU8yGQVhrsR0EJPxITKVFvL2TKVcPxWEmp:AVz0KHHYGQVhraPxILRPxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Core.dll
Size 4.7MB
SHA256 27aed4e6f7746ab33def0a38940d46b11bf0f34a702c5c6a0a38e9a41a3f9f3e
MD5 4ce26f9aa264e3ddacb8545dec7a7c05
SHA1 92fb679c3ede5b9e769609f6639025cc336e6147
SHA512 ad47741d0236bc95e52050d9dd65fe23891fe7ddec25f9a5487b4038a8bdc097e618414dd49c5ac1101cb604406f15492c14b20365829d07c3c40f394ff3cf08
SSDEEP 98304:XRCmSMlsPH0xJsv6tWKFdu9CN2+6y4gwzK:hCBesPuJsv6tWKFdu9Cq3FzK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Gui.dll
Size 5.4MB
SHA256 ffa2fca013f9b10fe27d819b33b780addff2159cacba90318d781b588bf40a2d
MD5 627f6981811410b10a37c73ec8aff39d
SHA1 e2ff30f1d50b55e4cbb358d3eb9268352ff20130
SHA512 902f94614f0f344618f055237339a0d59a09c012d3623607e82995e68883a3b2be9f4496cee87761fec753134d11c4b1585285cfc40573584b8d06ed04336a6f
SSDEEP 49152:HSjBqeyCqkbCiqaBlxkDlCKLj7wi99MlcGKuySLfqo52FhBdHdjapY7d+mzsbrXJ:dXv1hvZjprGftby09qZohUYf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Multimedia.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Multimedia.dll
Size 604KB
SHA256 5f612abd914087980a4245f1508411b514cb8c419bdba34f39a00ffa59372274
MD5 bcae351d67c96a26496ff33a0d075209
SHA1 5a9a6f9c92d2d93338214168e2172634a4e4cf85
SHA512 dc7f9ccb2067dc03ac06145661d1a662c4ebf3aadb7f554ef053d2a4ad84937773bad738680613e0df70590560e691ea2e355ce587bf9d1e2423643c5dd51c85
SSDEEP 6144:Ue3UW7/NC/IXCwX/i6wAO8pi3zJ5IMH75cRfWkZFPylrm+gxQuZ4GXLWKcPOkN6o:UO7rXjw3U57lPXGaGJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Network.dll
Size 1014KB
SHA256 fff4613a020e81605dbe4d0d361aceb1943325ee555025580ec931244f8303f7
MD5 fe506eed9283c8a1c412d097762b812f
SHA1 c35be316cea9064392d975fab244030b2a02dfb0
SHA512 c33d40f5732bcd3f9ad5006a64093daacad54b4fdd66cd76d2c8581bd7f4991dcbe7a2852419ad2f5732db242688be74045fef88f45322c79f81214c5c600665
SSDEEP 12288:HIzTkHorf79NnInnli7dQ3SVVo9RcKv+RNxAr/LMd/kZqeNZNtAeu9IINuilibm9:jorhNulihQ3SVVvKvOqIdSnZwIQV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5PrintSupport.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5PrintSupport.dll
Size 277KB
SHA256 a93799ecaa973529eb67a49671d2f04fd121625997a23755f505dd0791774d66
MD5 fff04e545ac70f296983ae09cdb8c724
SHA1 f212b21e12e0d36f276c3d38af97378a711c37fc
SHA512 c9f2b195f62424ca947fc2a439f683e5aea20bdaac28e1b85c24ae93f7b4ef51549b7dafbf41f50ef256a24d7163cf33c2e95cbd7303b3df455766e503f0f4b9
SSDEEP 6144:of1ztjbCMrj1zZnVfQYDldfgpEQBZNhcJ3I9VHPpcYfe1GcmIVcEQFSVVADqo660:of1zRNrj1zDvHgEWMh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Quick.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Quick.dll
Size 3.3MB
SHA256 b96dc4157bb53e205005f7096d36c2af69551edfbc3c07b4146fa45b61f2a117
MD5 87237f29152adbbc26406f9fc49b121e
SHA1 1fbb3f1fda36d3d8d56db6c835f1d652e5a01db2
SHA512 533d0ef0b82335e51f7848aabcdf6b83aa5942a364bd914c63a0da8443ac16fd22dafbb7a3786a6a570375673aed24bd09bd6ec757b6ddba4281b339493d4249
SSDEEP 24576:LEXHVypULKCK14InXiYvtV6u58GdsHAgJVGJIYdFJTuoHkxDBiPyEAaMiPg5NBH2:ApKrHMjghAZiktIpeyhjEU9h1MO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Svg.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Svg.dll
Size 274KB
SHA256 2dcf8a941bd06dbd8426db484cda2aee48b9fa9eb9b22a498eeed269c2fca19d
MD5 f0d8f516e1065e1e0d0626c21e8acbdc
SHA1 81292194e8c9c446b67cba87e0c12780acc1af3a
SHA512 df8971a9812fe209c368007afe00dccfbdb756fcee511f5495dd6b998296b7a88606c8269567b5fcfa6307752e7d49272ca83221388fd2913282688ad0fbb571
SSDEEP 6144:jG/zxmX0QrnU4bZJ+b72UUI+q08KnwxpRkvQx9Obtx7SdyUIEDvj/rbTYxGeO4S6:jG7MlJ+b7FUI+q08B8K9OnSB/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5WebEngineWidgets.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5WebEngineWidgets.dll
Size 213KB
SHA256 0a51fe6a9c577fc0b3e831b7bb22054ab992812dcd15fc617b4bc906d8041baf
MD5 c57f73a2008dfc9ee53d469820583487
SHA1 29d596078068ec51bcaaff495176ac63012bfd60
SHA512 ca42feca121f9ee7726ee9db4cd2c381a39d8e1c9341bb9c30db01928f1fd6e51918c680eb2124304fb19e6d29b61bc42b23a71745a72a5016299abcb947f4de
SSDEEP 6144:f6D1pd2P7q6eWh7KLGh771F1GczC1ZXVDHs/Tb6np:yDrAP7q6eWhSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Widgets.dll
Size 4.2MB
SHA256 e25db7540bd89bf4ef9b46dfe471da6fdcaaa79996785deee9de0d1715e943f6
MD5 2ecaab6e87a870dbcc4ff3020b8999fa
SHA1 f1b38ed9c859e1e7538006b1cf29c1a8b0dd7a10
SHA512 4d8c36984bdaca039e5b4143d4b7fae3bec57d0e669c458f3ebc36c1982a9b1aa4e8215abcee73f1efef277e3f400e31bb2c9a698d286e82a98f125b2c585183
SSDEEP 49152:8mKbOKEIhVJFvNF9KI6EF5sjZtrmFz71oriunGsSQN1+sB1fFP8:FKbOKbVPQiFOriuGu1HfFP8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\3uToolsV3\Qt5Xml.dll
Size 186KB
SHA256 69062d64a743b9733cfa703bafd52376e28650d35f569445833cf3de7e1a67fa
MD5 bb08f8268b62aa158ab66fd8058ab833
SHA1 7c17621234682c2821571598a0c33821028ef1b7
SHA512 33e7c6f946236a739080008835c6e82ad3b289ff0a97fd96e1ae98029008ded43284277cf5bcdf3394845c2a6f0a6cb136d5bdc24135d2c2bac40c2e64dc863b
SSDEEP 3072:2zRggcs/LjfwU680vvfY1HpJfBFJtx5dzSMgR/WRSIEsV0iUAly3GMXdEt3veaxx:Pgc8rwU68oCgRxIEu0GMXda3kWH
MD5 SHA1 SHA512 SSDEEP

Submit Download

QtWebEngineProcess.exe

Path C:\Program Files (x86)\3uToolsV3\QtWebEngineProcess.exe
Size 512KB
SHA256 1d98e31589f0f7db5224856280d724eaa254eafe6d102b0abe2b1240e1049150
MD5 d6d8c120c2898d7d0a00594a28ee7910
SHA1 9470663c9be15597a50fd913084708e307c10c2d
SHA512 59f1daa0dec2c5f2c661014fc8004c07ba6ff2dfae554724e81442e7fa230f6f5f576c42001c6a582c7bc9970357cb73e25cef75622c2d095273109a29f2f6ad
SSDEEP 12288:SYULkMRzimsBXhiZkPqSf8ReL/bg0zWDrQ1dE4epamAbmBRPkB:S8MRM5cZkPn0l0kdpvPy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\3uToolsV3\Uninstall.exe
Size 1.1MB
SHA256 289004a79af56aa1c72dc2d37b07a2517bc65f616848320ce4aea1f1c4f9df79
MD5 653b88403120977be5455232b9bb7333
SHA1 238836be4d3cb39d346047f5ddb99a75bd05eb36
SHA512 fa644c1613b7fbc193232885b2b1f4097d0b8c625f8f2a28991d80209f8baea04551984ca434b3165c1d035c744512b25a9808a6f8e2411e146d0b0d3b80af61
SSDEEP 24576:7D+QQRuSfX4oenW9M+hKtY26tJC+equBXvoUghxh/Qipl0P:mQQRuSfX4TnW5hKtY2mg+equBXvoUghs
MD5 SHA1 SHA512 SSDEEP

Submit Download

border_14Pro_SpaceBlack.svg.tmp

Path C:\Program Files (x86)\3uToolsV3\cache\devices_table\border_14Pro_SpaceBlack.svg.tmp
Size 25KB
SHA256 65d4e961734340bcc372fb5789c5ee02070239e6209b9cdeedae54623ec2b7f3
MD5 7f2390f5032c2a01f2af2efd2fbf0fe6
SHA1 155dfa69d939cbba1a6f147d608a102347af3509
SHA512 7cfa63e91cf4f6569cf37fd49134cdc417758fefbf9720560bba36f7e85263954bc3979750213757550b7794f5d588bb2583273334fa44161248e2e36fa78a6e
SSDEEP 384:fjhjTtM6SjsD9Qtj19UHmHRCQJdlVZ5z0D:bZTDSjO9QtxomxCQfTO
MD5 SHA1 SHA512 SSDEEP

Submit Download

1691646872461_895937.png

Path C:\Program Files (x86)\3uToolsV3\cache\hometmp\1691646872461_895937.png
Size 85KB
SHA256 fb536ebf3436a353ca42d3efe03204d9bd13f6d073887f8f38b875896d1b51eb
MD5 417a9a266186eba0b5c0e7fae060d5b6
SHA1 cbedf7bd71f7737c076069565fcab54cd040cf3a
SHA512 bd6fd68e74312501cfe4701ed8627e341d53cb59c6f5bd23a86ee3ae7310762e0dbabaf0f96c5dd99e60a616242d4410e30f3ee083d9b54880ce3073c63a3c62
SSDEEP 1536:pOqdwmJozldv43SZzjqgmV2HAOPbVLLsEOppW1PBial5AYdk6plbjLjW7djTI:zdwmiLw3gvK6AOPyEMgki5v+MlXLW4
MD5 SHA1 SHA512 SSDEEP

Submit Download

1691646971451_957085.png

Path C:\Program Files (x86)\3uToolsV3\cache\hometmp\1691646971451_957085.png
Size 55KB
SHA256 e8cae30319ecbd47cc171f1b594249b475ee6e21b3be7f647b8b498140fcc4c9
MD5 ddcce3bb78f7afe368ae73dc3ea96ac7
SHA1 adbc9d45e15c436b494a3141beeacfd94ad5dc46
SHA512 70243d9e576e73797664e3abbf01aed97d8c74ebd5fb73d63e37222131f8f32a65aec7676d4357867d969adc30eb1037bf3841dc63a6b0bbc8468b3b9ceccbe1
SSDEEP 1536:E3kF6wi2rGgKbxOdOWWUnXI7sGZfwRJJSj4:E08wiw9KbEYWZG1YPQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

search.png

Path C:\Program Files (x86)\3uToolsV3\files\OpenStreetMap\search.png
Size 1KB
SHA256 29739779fd76b21175d4ea24d7ded3e057233127062d05c164b9ab4df9e11a3f
MD5 a73bcc83dc2729d19d9d0e1eb36bbd96
SHA1 9d15df65438cab48d07ebe7e9359258ff1011423
SHA512 c37de466294c22c9b3ed6587c639a7d53ae6f5cc8d352931035885191a2fd329dae3ff28d1bdeb363c2c12243505584354acc5f88bb8e21da9c2942d03cacf03
MD5 SHA1 SHA512

Submit Download

Bonjour64.msi

Path C:\Program Files (x86)\3uToolsV3\files\bonjour\Bonjour64.msi
Size 2.6MB
SHA256 46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1
MD5 86e2b390629665fbc20e06dfbf01a48f
SHA1 d9f4697a6f4eceea24735822cb1df501268ca0b0
SHA512 05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea
SSDEEP 49152:xDazwTevwRV3g79d+YUowu9iXeixErgN8HovTtazZ6COcLi4/uP/t/vh8h7ap830:owSvSg79AYUowaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jquery-1.11.1.min.js

Path C:\Program Files (x86)\3uToolsV3\files\tutorial\ios9trustapp\jquery-1.11.1.min.js
Size 93KB
SHA256 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
MD5 8101d596b2b8fa35fe3a634ea342d7c3
SHA1 d6c1f41972de07b09bfa63d2e50f9ab41ec372bd
SHA512 9e1634eb02ab6acdfd95bf6544eefa278dfdec21f55e94522df2c949fb537a8dfeab6bcfecf69e6c82c7f53a87f864699ce85f0068ee60c56655339927eebcdb
SSDEEP 1536:/PEkjP+iADIOr/NEe876nmBu3HvF38sEeLHFoqqhJ7SerN5wVI+xcBmPv7E+nzm6:ENMyqhJvN32cBC7M6Whca98HrB
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_app.dll

Path C:\Program Files (x86)\3uToolsV3\idm_app.dll
Size 130KB
SHA256 3311adb86a9f172f2570cb627da8c900c272a8bde30e5f44783ca3a6ef23ec5c
MD5 380f15afec9887f83b349adaeed5fd82
SHA1 2e3ae392ee080652ac20bb40351dcc65666d71c1
SHA512 089eee9df2b82cc4e3d090b1639a03784a4afc9ff67017165ab43fdc6ab67a2be1b2d047d8facab5155f6b688c9ce5d4d56e223a30a2e95841f1fd1cbdda0bb9
SSDEEP 3072:w3LmvfrtJ/Kn28CXK8Zemw1fyLuGrtCQgwVnhmfWOSiwc+:w3ifrtJ/Kn28CXK8Zemw1fyLlcZwYWB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_datamgr.dll

Path C:\Program Files (x86)\3uToolsV3\idm_datamgr.dll
Size 111KB
SHA256 f2687d64d728dd442538845c38197cfc1fb1565b38f5cacba395f6aca85af73d
MD5 611e73cd22afbea4e98503b84d193a34
SHA1 a72da70a629e882a60bf84ea90010d4f40e75007
SHA512 1811ca12b3170cc44df3c6a6745077a441195e83cff1949a1baf27fc39fc73bf61cb6e7f8039e888dd2289485c1a32a21436b6799a399ac8d2fe70f96795fa87
SSDEEP 3072:4INtFyOhK/O8Wy/ODWw9SFueBCTAbMzT4SHZ3Q9ZEhylWo3E1vXs:XvfhK/O8WyGDWw9SFueBCTAbMzT4SHZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_fm.dll

Path C:\Program Files (x86)\3uToolsV3\idm_fm.dll
Size 81KB
SHA256 2d8814df342465d490792d71d7c1054ad92f2e911f8c9001c8da6ba8181ca3c0
MD5 e42f52fd37f9de60c00730bcf53ef641
SHA1 95aed7d4c769f3d07e2112f307e14fb2e15759a5
SHA512 567498e2adc0c367009dc13244b932ddb9d7027b3a43aa85df547712b4cae1c635dcf9b965c46b53ed1af9f002bf328e0f8a336967aff8b0c4c8bf1f52755a0b
SSDEEP 1536:3e31qNmcTKf8YHpManojNzRV8ovkzBTgoZ/OPIa9HJWZYgs2wTl7dmVQcNxGl4x:ukNmcTKkYHpManojNzRfkzhgyGTlsQ1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_info.dll

Path C:\Program Files (x86)\3uToolsV3\idm_info.dll
Size 196KB
SHA256 1efa28ac7327c4498f81db20f607e5f2945d3c5e2c2a23c1174cbedf90a3dcf7
MD5 0a1da6ff2be415a0a1b2bbba5df17c5d
SHA1 28fda0b116b611ad1465f7719e3f6e8f1471b241
SHA512 73059c5309562303ff023dd6882ebd15e0e896aa51a5c8dddad8357c0a131a63279e225bf07ecdf632dd672f6f1157a856c994ecf47cc2cef4c8375a3a3b69fc
SSDEEP 6144:C80zrl4OLRrv1lnaMpO9w+DCJlyw9Qp2NDqEBe9YClvBq1qpunqpQb:C80zrl4OLRrv1uwUell41VjZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_jb.dll

Path C:\Program Files (x86)\3uToolsV3\idm_jb.dll
Size 97KB
SHA256 d58e0739ec139714fb753c4d31f9afeec5c97b1e97ad9f7534296e46205a7833
MD5 b7b19bed26ba9b6234be4cf4a6342fc5
SHA1 a601694f166a5fcc4bdd5cc5abf6ada473faef73
SHA512 7d914fae356d7af040716c6d710c853a2831c8e70d06cc15a1efaba9cedd1b8b68a01a8586cc4c34ebf075009eaefd02bd77d427e48aebf505aef669328ac1d1
SSDEEP 3072:HHwSxPVjed120dUxPCNV+MLT9HHJWDv3yv9/6W+565Cj:HQSxPVjem0dUxPCNV+MLxnmY6MCj
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_media.dll

Path C:\Program Files (x86)\3uToolsV3\idm_media.dll
Size 145KB
SHA256 182c5e1e7a712d5367e73ed9b050bca0e53bb62f39ec1df6823a01c8fd297c31
MD5 295eb2bfb3c1d881c3d086c323925fc6
SHA1 13581ba2850b0dfbbcae7649e584f6c33be22402
SHA512 6efe499a61e20a57a38921d7523233ae90240926720a8bbf67f8affbaf5c5f01b0faa01a59bca1d8a788d70e8dcac0709c993bf6b9f1e858c4f23efefc91af53
SSDEEP 3072:oY0eILnOUIpL7Oo1auaixYQbyZzCt8x3P1lr4X1wIASX9GJELi+ON6zZDjBnWU:LILnJIpL7Oo1auaixYvmcPg1FASXRnOi
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_other.dll

Path C:\Program Files (x86)\3uToolsV3\idm_other.dll
Size 175KB
SHA256 daae76021d89046f14e43cc10b0077111108904f65eb6ec759c89dcd92ca3721
MD5 f5ba9dce956803c1221b2e25da8ce61e
SHA1 5dd766a81cb6b288221fb8c1cc96b3ac9dcb2789
SHA512 00959c6ce52100fdca542a67f73a9efd4b6ee105f2e3baf9294790e12bff2fb802b1f0e9b14ce9ea238b3d0cdf704670fd32d7f17277eb023bf7e702dac3dfac
SSDEEP 3072:6pSMuRwnD/QHp06fdl9MzCG3FVuozlJ/JS/r66sK+1i3tC+F0D6gAISNH:ySMuenD/QHp06fdlJcfvHq661LJbNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

idm_sync.dll

Path C:\Program Files (x86)\3uToolsV3\idm_sync.dll
Size 76KB
SHA256 880a5ab118457a30d299cbf1cdf86292d89ee293ebd97e97927dcb8c4d4b4b8d
MD5 1ee835828b21a8ed51f8592fdfaa1b9c
SHA1 ab641f19562bbe72c01306683b1db2c58e247ba6
SHA512 1f35be239a83e8a5c45950e59fc90512e0cfd362973857a03c042883892dc1f17f23796715cd26edc8362c5b2b78d309025b24f3f45a78e8a4fb3ab8d657b2db
SSDEEP 1536:wBiwq7utp7KjthnZ8KX4MlpZ2i3y07+DxDYzcMa9HNWZ1tfhLl9c3v7BAjJxGKsU:sHD7KjthnZ8KX4MlpZS07+DxDA1tZLlr
MD5 SHA1 SHA512 SSDEEP

Submit Download

setting.cfg

Path C:\Program Files (x86)\3uToolsV3\setting.cfg
Size 144B
SHA256 319085efe9bc9eee9ff804a33a077186c60c0a9975050ad607b620f6531718fa
MD5 7eff6beb16e8d15e735d3d718975435d
SHA1 b7eb74ee2a082e79096a9b94f2c06e75f4695fbb
SHA512 7f5696aeca8102011ea5131a8666c9df06c77b7b1ecfd127f419ec896db29dd9e3065c11cbc4ffc389dec2f46babf8e7469e05342aef9f98839fdea2d4136774
MD5 SHA1 SHA512

Submit Download

setting.cfg

Path C:\Program Files (x86)\3uToolsV3\setting.cfg
Size 93B
SHA256 78a095c2205d3d1389eae26f6f08d90ec7cae79836d200c7f844c049cc01017e
MD5 20597c1917af28d7129d6d23ed5cf8db
SHA1 5587f3f873f66de2c534c6f71fb54b6be9f48ca0
SHA512 d22851cadd90f36b2cefd7abe0f2b8fb2166bafa3109c087bef2febac2f79963d4977fed9e30b11ff9ed8bd2a0430a363dc1f808f76bad89e9d1e481ca4c1686
MD5 SHA1 SHA512

Submit Download

setting.cfg

Path C:\Program Files (x86)\3uToolsV3\setting.cfg
Size 257B
SHA256 ba6eade872ca4b90cc2207c54f706d461a3a3e268fb0ec9bce2dc1bfc7710f53
MD5 295378b509925b097268cfc33042ad0a
SHA1 89fb9cafb2b95563c600e4dce8a3e523d357ab55
SHA512 cf0f1305b63f16d21b5ef3bdb104d34f9a8872cbdb9c065ee25a724152d0ea3cf2a746576c2ad3136a1e2591e2b75a0e3710b75d7fb08a0dad7e5003ab06de2a
MD5 SHA1 SHA512

Submit Download

setting.cfg.lock

Path C:\Program Files (x86)\3uToolsV3\setting.cfg.lock
Size 60B
SHA256 4738562e6df0ce990f22a21e7c2792905601751268bac2c6d5850d3772965737
MD5 21ccf9e22dbefe147597e8dcf9f6c256
SHA1 7e8632ba7857fb64d590e996201f26ec201ab9b7
SHA512 87a060a9a30c1efde89feffb10b9b6cafbbf4c25d40e3842d0944902a16a6d03da325e2b3849bafe4b023b3f79e5682bc602a1e36155ce8fb9597ceabb079b46
MD5 SHA1 SHA512

Submit Download

qt_gd.qm

Path C:\Program Files (x86)\3uToolsV3\translations\qt_gd.qm
Size 185KB
SHA256 c515dd2a2e00765b5f651aae124a55d617b24777138019abc5a7001da7417561
MD5 d512456777500dc13ef834ed528d3704
SHA1 90a32284052c3fe12c18afec9f7ff56735e2e34b
SHA512 babef929ac600c117967b42389623f352d219a466c484ae68ef3c9da9ff61555875ffb0dafc3e5eada6fb43d37f7afe74a6b6c73458a93ffb42819e1068c9a3b
SSDEEP 1536:SiaI3C87jhakhR0VGkw7ys7CskQH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yiqxTXhvQoejJd8FUjVgk
MD5 SHA1 SHA512 SSDEEP

Submit Download

qt_he.qm

Path C:\Program Files (x86)\3uToolsV3\translations\qt_he.qm
Size 135KB
SHA256 4281c421984772665a9d72ab32276cfe1e2a3b0ebe21d4b63c5a4c3ba1f49365
MD5 26b777c6c94c5aa6e61f949aa889bf74
SHA1 f78da73388c86d4d5e90d19bb3bd5f895c027f27
SHA512 8e02ce06f6de77729aefa24410cbd4bfba2d935ef10dcf071da47bb70d9c5e0969f528bdb3db5cab00e3142d7c573fcf66ea5eb4a2bc557229ad082c0eb1dbcc
SSDEEP 3072:XSue8FDn3iJsqBejd/zNDSLzdetY2ZISfCPS:XSuem7w7IjdIzUtYAISfCPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtmultimedia_en.qm

Path C:\Program Files (x86)\3uToolsV3\translations\qtmultimedia_en.qm
Size 16B
SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
MD5 bcebcf42735c6849bdecbb77451021dd
SHA1 4884fd9af6890647b7af1aefa57f38cca49ad899
SHA512 f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78
MD5 SHA1 SHA512

Submit Download

dns_sd.jar

Path C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar
Size 17KB
SHA256 cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7
MD5 ce9a2f5a7fcfff341d6d901ad919a2ab
SHA1 341f9d9a0b3fd8cfbefe0169b148dcc55688ee93
SHA512 1f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f
SSDEEP 384:qY35yWzioxoNsq1hj1I2Y6iDAENBB+gAN4buz:135yEioxMhj1IhzBXBFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_1362857646\manifest.json
Size 118B
SHA256 b88eec9977c596dc8adc22e39477392f808ebdc61220bfcf373dee09f87e764b
MD5 59e5d162c3a5d96b7ebd23712271b96d
SHA1 f48585f462ede55730df40a762f5234dbf67d664
SHA512 1b1924164338dde0a51b852de40b4c422ea69a56c0f7f2d0e87f0c4d861416e1f9f922ab04aef0b808df4f372c4bf12edd147ec34872b97e8aff92d823a695ab
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_1616746546\manifest.json
Size 119B
SHA256 b13947842a1d3e66e62bd32398a3780c18127a520e7212a4adbf006a9abfd74a
MD5 01cb8b111843d1f1dac11d249c24c8b7
SHA1 c4f1f6f219f325caee6363df7f459323109f2f6e
SHA512 075d54cdbd80078d4bf66f3c5814a055058f2535629cc7f5d88fa5c69d5c931dfd2c456a0bc634768d796af604ce4d585c7904c1924d35df7855dfd7e275d403
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_2054812254\manifest.json
Size 141B
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_2057266992\manifest.json
Size 72B
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_2085552059\manifest.json
Size 102B
SHA256 b2c8ee75956c3bb7ea6865137c441b916badfb99c922c17785875e784c96e29a
MD5 b0e549dcc425951a670808d628ab5181
SHA1 63c37e4fd9193836f0100cee2bf76585787ae94b
SHA512 d6dc7c7ddd5ad8ca06a831faa6bd399c8af77e0b21cfd039c608f366fb54b8d4553fc8f947a070544f472966190cf1ca5a236d1084be824b06684b6c6e8de0dc
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_294481257\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_565968708\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_565968708\manifest.json
Size 84B
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_592499532\manifest.json
Size 53B
SHA256 94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88
MD5 22b68a088a69906d96dc6d47246880d2
SHA1 06491f3fd9c4903ac64980f8d655b79082545f82
SHA512 8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_898630779\manifest.json
Size 69B
SHA256 dc6a19395ad3a24ee3805f6e90c6b16fdc141a51ac7fbb99fb784e423f8962f3
MD5 b721bdf2924d658186ac8868dbd2c008
SHA1 914aacc65bb7933bd73aa06f8bd2ca0b04de3858
SHA512 4c1c16f714a2e2436697bc801f7e2f684010c833e3d5fe6ed68d6f3e630afa495412ea5a1b46f4bbbb1102feede84e72f32686910492510cbce71888a85b5fda
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1800_947545299\manifest.json
Size 176B
SHA256 7bd96fc0239229d64cc38693c64f2524d95711534c606b2b39957af8411d870a
MD5 e7314184e67b4501f5048c2e5f181d96
SHA1 f741a8a1b8c18c8d4974f937ef589b134dde5419
SHA512 773ff8228cc87677e3f74667b61db59decfccb6ca4da80a5ac5e0aff0e3102e08e6c1561df35b9ed64c8b7db8dc8ed27210c2ca0139ec85d17f9e3f57018a086
MD5 SHA1 SHA512

Submit Download

Localizable.strings

Path C:\Program Files\iTunes\CFNetwork.resources\en_GB.lproj\Localizable.strings
Size 22KB
SHA256 47be7f1aea7eba3fe98080713b1c4414ed5018aee75ee7f6453ae2ff95aa76c0
MD5 11d00b701160c1244899bc1647e3b756
SHA1 866c9acf31291a1459e6719dff2764af41eddde0
SHA512 f1e8727fa33b70bd146d71aa782ef8000b6824c06b936b7584057ca77cd082a001398bc5ef2202e12b50bd86687f3a75ba3a6b028d14c7ae3d1a21d868cb756b
SSDEEP 192:nypn8tHu9PJrvYN5QZ2aX3/R5xsq9iqg3c0rta6aLnp2:nypn8tHuPvYN51aXvR5xsq4rwnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

genresLoc.plist

Path C:\Program Files\iTunes\iTunes.Resources\ar.lproj\genresLoc.plist
Size 236B
SHA256 2950ef6f4409f89b8513f2bb787f9070c2983b698b35b678088c59cd83246bce
MD5 093deba2a9db087a0cb01a676bff1c9b
SHA1 9c7d3070d1fef593731dacdde8cf38e7f96962ab
SHA512 dc3860ac3d87ad8f28988b2c7e694721757a43367ce6a1333205cf335de1c29e739a8468a70bc305a60c4d0587aa062fe01f3762d608c9bc4d76867f2d381c1b
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\cs.lproj\[email protected]
Size 5KB
SHA256 ebdb9147c9b509b923fbb4e1e7903c84f67b42542b0055b2f8356a16c456191f
MD5 236216d5b66e7e9f48715b953b465c56
SHA1 7ad8425770aeb398922005b2649c4764c5b6dc5f
SHA512 6da4821957d52ef729cee2c6436f75b8581b702efeced430e99abc81be11f8cd2f2b2c374a88d68ee177b46b0cf34f723341a78d642dd4c81a8b5f09e8c77bd1
SSDEEP 96:qOiB7Gv6/36yu2nwXe/82sD8NMf5h/oXSKEM8ziX94NJX2/etiwnjgWb/pR:qOyMIzwXe0Jo2/AXFETGy2yjHbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

iTunesExtraGridView.png

Path C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraGridView.png
Size 4KB
SHA256 a33f1e4d73943a77e6471143d263aaa53a871f7534e27435beeea19e75c82fbb
MD5 94eae9dc7a205de2ee0a17effa21b60c
SHA1 54f23cb71ac3a62680bd22a3b2b8ed5c6c86d5a4
SHA512 5601cb432d92697a630dfa9c5403b7ff1210f517c51eb84a4036d7c14192af287eb86782a8036b0da72ff39f827d118d276a43cfdc0019f40b85147948d3d99c
SSDEEP 96:u1cCvTH8tehB8VftrjZz8GvxFWDQG8EEWWjfIf4j:u+CrHf8/3FG8EMj24j
MD5 SHA1 SHA512 SSDEEP

Submit Download

iTunesExtraListView.png

Path C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraListView.png
Size 3KB
SHA256 b21d24670a44bea7c5c86c2b87d356e66006cfeaebb8e6b7d4ebf07974ac3f66
MD5 5e93c7b6af1f907359091cd0c629b3dd
SHA1 4aba4ecd7b1b5d7937e7c7faaf7ac1629c0394cc
SHA512 492683e196bceb4f80d2bf07dc9031fd8f1667b0d8e3da877df1666bc419276bde0a6af8a1dd983a0b5594d5e0143eeda09ad2b87378cd221fbdb3e45291772c
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\da.lproj\[email protected]
Size 1KB
SHA256 b58b3ac76194b282833d971e2e2379cb25e7149f29f4a585e9405daf810a3d50
MD5 b8f2462ffc91bd1956cb2607c1c9df31
SHA1 b4d4a46fd481f23268fce6b63496e753ec1c8a25
SHA512 6814101aaa72a241e4f9d37594c666016a36bd4d5e5ef50623e23590ccf94bac80d2b8c062213b557ebbef5e007fe0400ed9c84422df8f5a5486d2c9bc4516c2
MD5 SHA1 SHA512

Submit Download

CleanLyrics.png

Path C:\Program Files\iTunes\iTunes.Resources\el.lproj\CleanLyrics.png
Size 3KB
SHA256 66e1fc581446d80a7f64afeae19273cef7d6a10001e3e7d3127ade5842c754ff
MD5 357922d796c4ab56acb274ec1c89ed4b
SHA1 4f29801424d33877426dc21cf02bdbabaa321120
SHA512 e0c7b23cec3ba61f83ba3a9675ce078d4fd36fed08f8e1c20be6e9b7891c1d4175e5ceca9ec3797419b22806d82d86fa4fbad314565d000a36fbe92905c9e36a
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\en.lproj\[email protected]
Size 20KB
SHA256 065261151f732d9f8391b0bfc00e71d3dd8e47c84331aa94b58e295782d74a30
MD5 498055b7ec8f362e71a988ff8c79b517
SHA1 4b28c12932e86c68c7acea45303be3900bf987ea
SHA512 0b7c4dd87fed1ec01b14334e129ac43c598c30a1141bc9831f7b0ad106704072112b36ff4688520d675eb72652ef6a1dc349c95f55f6a59a245c5c151771f0f7
SSDEEP 384:gOWOLv5qDDvDl0Fe9nH0vJPDz6gQrfcEf82sG4b53j8/uVL0D9z1Fyc20k3xGAij:g/O9eB0iCZHcw9R5Q/Q4Dj8r0k3xGAij
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\[email protected]
Size 4KB
SHA256 57b642737825507373c0b192e3431f7a15848c1fb061b51b262b8d2438551e43
MD5 59d4281f0f7f665c809f2a68434999ff
SHA1 1c71204e311646a1b367860c0de11ea5e60e06ed
SHA512 e38edd4b53f950b8c3202552d38a6a56ee726a239527a1aec064b9a3a66f06a3aced67c0b6bc3c240994d006d8dbd5f2e2ec67bdd4e76c181e9331891d1d0154
SSDEEP 96:9OiB7Gv6/36yu2nwXe/82sD8NMfd+iaWePzZeYDAfw:9OyMIzwXe0Jo2fe7Ze4AI
MD5 SHA1 SHA512 SSDEEP

Submit Download

iPhone License.rtf

Path C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhone License.rtf
Size 46KB
SHA256 b636c8c51b01fd142af1134448763dc526041f3fbf635e841b0c2882254d64f4
MD5 cb4f512972b12e3b783e89704cccea3f
SHA1 e64cd7091224e3449e15e4ea664aef256534183c
SHA512 8b9abc21f291f53ae89b16f1cd9403bb881f9fa9140cb919e0fd5f4ef8544dca0359b7d5e45f54e3ff74eeccd4d9f0b62494992a58c6e230e4467015a1092988
SSDEEP 768:adLByUn1AWAJTS373Rq2DLFhIu/Mym52dzq1W6FqJh3F6mk3zkumKMoUZlC7HX3l:ydnCQmIZKjpMh4HFRzshwdMyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ViewLineItemRatingE.png

Path C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE.png
Size 538B
SHA256 2ece6d0b0fc97dd6deacfdbaef44458a4b96e43319c78cb74c55d4f7ea79d9b6
MD5 30aa67b32a3542874bcc88e146e17b46
SHA1 6d86b94d2c71ae27504ce8b3ad000fa4ef532a6b
SHA512 dfd082a54a13c5d2fdfa66ee9db8c893bbc6b32108308727665267f0a9e9fa9610c174082c0ca7a34832cbba768a1e2d8f6218b4c5a538a328a6159be05f3cc3
MD5 SHA1 SHA512

Submit Download

ViewLineItemRatingE_dark.png

Path C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE_dark.png
Size 222B
SHA256 c5c8219de48b954849bf19b716dbba8358c66b02836417d8d729dd2a672935c0
MD5 ef859a036759f6f29c3dc14928a75c76
SHA1 45f8c4450757f2ec653ee0845f5ce497b6832598
SHA512 93aae547f72edf6c466b4f6c1a43f7f0fe0393cc7f7ea87818b462a4938cd86903017a12cf4eb1f3e05492b312e8826c5fea1935388a168e1f0278cbf3fb505d
MD5 SHA1 SHA512

Submit Download

genresLoc.plist

Path C:\Program Files\iTunes\iTunes.Resources\fr.lproj\genresLoc.plist
Size 218B
SHA256 a0f0336ccbb2964f1b6534fc1a59a04896bc104473812ce0f407496648eaa93c
MD5 17d011dc9b1de5a0dbcbe11f5dfa4dda
SHA1 22b3182f41bc4a322f162832b4dfa92a46a71859
SHA512 99193d05842ff4debac4d1c1ae772d3fa6424f5c097eea557095a9bbbcec044a18c3557afb1d2f474a2b86db7a8ce24d44d2b70d1c5a989258ad9f70d6561452
MD5 SHA1 SHA512

Submit Download

TextStyles.plist

Path C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\TextStyles.plist
Size 41KB
SHA256 503b82910c0a98e3509cdf590dfa8f722ef149390b260068675fae09c3cf12ef
MD5 7f9f90998dbb72a12f12464fffd40997
SHA1 01a41b41e92271eea01f31b208a2c2b47b496b59
SHA512 7c293a39681c386002107aeb852c15ec8b4acea037f8abcef601cc76380f3487f421d267a6ae856df90b10fe8d032852c3650d5feb36f675a524163314e23a98
SSDEEP 192:XKEuqsilw51LKFneHIV3VjoQsLqfOqx8OR1IWbxksPKeIGOytW/mC:hhl+sC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ViewLineItemUnsubscribe.png

Path C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\ViewLineItemUnsubscribe.png
Size 9KB
SHA256 59a9ffdd81daf97ceb9e66f1e29b292dcf78373eef8df94038df3845d3e6d5a5
MD5 001e313e3be5e546cb50d86cb65dec8c
SHA1 e7feac3aa8b53b2670077ae0254a2900ac579467
SHA512 26329e02aba9b0ed9295dcdc0834a7b2a75aa05843365490ae0d86f787159967943a8040ab425c10266523e15308c6c52673cd2ac5db7073369bd76c0777278f
SSDEEP 192:KoONgOLPXsAYnyIKZpUm5yr3U64B66qCAJKNHbKV0zrZSTN:3OWOLv5qNKTUm5yr3U64vpHbFzC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ViewLineItemiTunesExtras.png

Path C:\Program Files\iTunes\iTunes.Resources\he.lproj\ViewLineItemiTunesExtras.png
Size 797B
SHA256 2f0e9c34845db2353f8798bbd7ec23ef4fc151cd61b3383b0a3280b7de78309c
MD5 59ecde9c26c45850d5d42fefd0a2fad5
SHA1 6bca0dc1fb62c293f30bd7880d91cf96835ed4e9
SHA512 9b9744414188aacbace2bfa37561266f7aa6426c6e61bece4990601f0a57c7c41302dcefe1757e3da86947baac2ebb06c266f18108448ccee41d205680822994
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\he.lproj\[email protected]
Size 5KB
SHA256 6529e898923292f4163ad09594682cb7fa1c32c6c71baac0e4405d9996dda509
MD5 8875b575ec840a83ede84ca27762761b
SHA1 7463b50c8483598dc6ae4889633a11edfcd3a5ad
SHA512 9af764d681309781353504d270d78ee59798154c94292e8eb73b07e78f077a52cecc9523ee088d68fc08de353541c6ed34fb2d73eabd1316e638485ceec6a6bd
SSDEEP 96:V1cCvTH8tehB8VftrjZz8Gv97z/9JXOJUOS0htCcnGSKdxDAsLZWwQr9m9g:V+CrHf8/B7zVpYJSEDKYs0wgE2
MD5 SHA1 SHA512 SSDEEP

Submit Download

RatingCaution.png

Path C:\Program Files\iTunes\iTunes.Resources\hi.lproj\RatingCaution.png
Size 3KB
SHA256 138d6ca25775eee1f0ea7001f694a5b286224372aa168a09578a1a9af7eb76bd
MD5 22b6a916115477a43ce634ea820a6304
SHA1 a34138e73bae3a62d745171d62f9f05a6dc07276
SHA512 97502dcec76353fd69ffabf398b53777bde50d08cc998a6213410596fc42eade86f717eef60bea0d5a4f193fbdd18b33f09fe360b043246b9c96d3316c7a0347
MD5 SHA1 SHA512

Submit Download

ViewLineItemSubscribe.png

Path C:\Program Files\iTunes\iTunes.Resources\hi.lproj\ViewLineItemSubscribe.png
Size 8KB
SHA256 a9ccdc7553e6cf9095d3760e88a3c9f76c0817ea6596337f21ae748828ce3532
MD5 d4eda1881d75dbd2b0d9336e9a5108da
SHA1 fa2264a591a47e42b7cd581b9e0a3ada33874746
SHA512 4a953a46684569c02fa447f46ebc5d8c8445a045703f36cc17df708eb53b2c324bf83c4c71a72f35d96f4655e5159b919f4eb631df598d4888d40a73d675f527
SSDEEP 192:foONgOLPXsAYnEO9uvc4NkRQIzy3vJ/eBiwV9vYWgS:QOWOLv5qE2wRIUhe9jJgS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\hi.lproj\[email protected]
Size 28KB
SHA256 946361d40f1b68a0cc29004ad4f55522c648023004e6adc9975e90b6e382657c
MD5 7676be0b698ae5a36b25772f547142bf
SHA1 4f5ab9344fc8cc6de692bce6881878185b96bd4b
SHA512 09f77f33a281a5d4ab712b2f43f01da729085cbc27a973c8f34e3fe0cab1fc515f9dbc45ef35ed9d0a04aa76cf26e98d0c78e8b1805f12560e2866239bb9248c
SSDEEP 768:kG7W5mxjrq8v7zAy6TmEheQFKtLkrhiZrjAXeWrz8Uimk7:/8mxn1Pz6T3DFKtFbCcmk7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\hr.lproj\[email protected]
Size 302B
SHA256 5501b7a0c2af99684fb58c1acd227fe53bf07f4028382aca136607ed9459fc8a
MD5 5132ff3c2935630e2f54ccc9a360b742
SHA1 58a0b7d8667d625d8e0c9267bfbab88551c6524a
SHA512 816d16f9b37c52f97a64a5a1f4c4b6c1bd2705231703416c7713212e1cca2753e3bc5e3352439a0cebc89a5ba0de584edd1183603cd387e7c7fdea1f023b1f85
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\hu.lproj\[email protected]
Size 3KB
SHA256 ce8aa4cf4ded795fbf1c10fc881978746ce6c76f13accf566e7ba0e98f5af774
MD5 02185d025965988b87c6b4748cdcd745
SHA1 e110b97b7d669361a0f2a2cc38c4a62f3d5deeab
SHA512 f1b6617eff4a584a760c24423226c844e2ceec8df8023bc9a53da69b18f76d2226ad24d0d1b2bf61cb2da9711caf4c23ff7905298edb309cf771cca1797a2c48
MD5 SHA1 SHA512

Submit Download

ColumnWidths.plist

Path C:\Program Files\iTunes\iTunes.Resources\id.lproj\ColumnWidths.plist
Size 18KB
SHA256 bf81225b2c30aabab43beb74142693ba800af85f88025446aaed2dcfd5068ffa
MD5 8490f8bf0576147ba7cd139446e6cf20
SHA1 48a557825885bea1a6afcb662b07113e99a20136
SHA512 86f0896fa6ad25a9550cbb3d0746eb413c86832986165e0824eadd917bb902b1f13c9aa60db78d477c3c5921fb7fe1465025765429b6a5a7e638da8063487753
SSDEEP 96:Cyiu72zdQKTSQKXKl2h42I042udQKdZQKtSQVqSQK2SQKIiQS72CSQK772DSQKnT:X1i3E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\id.lproj\[email protected]
Size 5KB
SHA256 f03209b2a8826502acf29e9769c73e1fabb923f4ac11057299cf8fea57a13def
MD5 11b4d45789544050871f75c0fb3b5e3b
SHA1 3362722a15fdd5a67d0c7e1c643c64a3630e89df
SHA512 51854f9a9961224dac3fab303d2e39e0a30d3f52b9d5e561dc07c69950733e6a9c6f585e001a3f9453fe0a7932a74e9b53fea0e87a691787cd11cb009017a794
SSDEEP 96:BOiB7Gv6/36yu2nwXe/82sD8NMfY6uImeKDimJ9EgRlIIWrzDYdGjaITXTv:BOyMIzwXe0Jo2YumedmJ9EgSHYEv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ViewLineItemRatingC.png

Path C:\Program Files\iTunes\iTunes.Resources\it.lproj\ViewLineItemRatingC.png
Size 261B
SHA256 5c751b7f4b96d07b22971ea4977566ed88c3297ab7d0b2853e7e9baec00be1a7
MD5 71062ebf3a5a9b5c578387aabb2e7fd3
SHA1 410d43bb43f7ddc7ee7cc225963303326485bc0a
SHA512 0ad45440a3e77a4ea2d1ebc8531c91fcd663e596a90f5cdf1d0a57384c54d988c0759dff51f5231d973f9886c80c16feecfc16da84579a0cad53ba70b984a865
MD5 SHA1 SHA512

Submit Download

ViewLineItemRatingC_dark.png

Path C:\Program Files\iTunes\iTunes.Resources\ms.lproj\ViewLineItemRatingC_dark.png
Size 241B
SHA256 befb8ccb14ff090ad56345786c9f367a8cb2d14516ccb52dcda123df5e5dfbe4
MD5 b52bc951d0c8f8dae4329368388dbb76
SHA1 ae408ee6f2d946aaddb8be466f7de2b99c7c4c58
SHA512 144de7bcef6fc1be493229c84c2038e2c6b6719c5ceba95d7abbc14539c5222a3bd1e65eb00e0c0f3bfbe6e0be4ddbc9d2876dcfdb9f1b3372cd3361d7f58d98
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\nb.lproj\[email protected]
Size 948B
SHA256 f1b5cce0aece4f65441bb7cbbf86155ad2d4e90b8bbba8252de985ae02d751a5
MD5 c6beffb1568071b2fab6f19bb9c875c2
SHA1 137ada0e83cce6b784a8d4f345430c28d61944a3
SHA512 a1e811646642fbfd11ae794e7c764a3bff39e285f1724deddbf9ed516cfa7929e8ce10611b9d0cc11f6c1944728f4aedca99df5badc72f2878209c3d24b28758
MD5 SHA1 SHA512

Submit Download

SortPrefixes.plist

Path C:\Program Files\iTunes\iTunes.Resources\pl.lproj\SortPrefixes.plist
Size 310B
SHA256 800cb75b9347c5142edc9094c9c829b10b6a280271f19e8ef3b4673a1cc48484
MD5 e4f62c535e191b6d40912f32c60e1eff
SHA1 37203bd8a250fb9b7471e1a4b8b2dd4f727aca2a
SHA512 2b64834f62de68efc971bf59e36d7cc0a29c3e7dc4c2c987ae6840488f6fb94e88ca73276fd0968f2f6b68d427a5f87a97faa0821f0cefb533deab38a58f3630
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\pl.lproj\[email protected]
Size 9KB
SHA256 f533c5ca2a6bdcd1a9c7f757c0c9a17d894b2717c3493bd7ced8f36a722eecc3
MD5 010e5869f100573199acf50905ba17b3
SHA1 da950fbeb52dea27dc393ad4a113422238bd6002
SHA512 83c30c0291ce0540a41f07a6566eab12b784efe5a7a8dabe29dee67fdfdc0e53e89026511476d0abd46a267bda76e179892a249be46619c7b6fd621d1ce753ca
SSDEEP 192:yoONgOLPXsAYn3J6HaGkRz+Oiq5BHgootZosxmaG09G3XPArJbgxK5yXrds6J:vOWOLv5q/GkRC3saosIFPAryx/rdsc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ParentalAdvisory.png

Path C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ParentalAdvisory.png
Size 5KB
SHA256 041204ca5fb90b0d19d0f8b5bae858bf4022d9c794990e8fa4a0bc7eae093ed7
MD5 d947d2a1018ae12438bc118af0a04215
SHA1 c816253a5341d804712b8fe00967cbc887f99907
SHA512 bf7192cd4f137311d4696a0dfcb5fec66df5ad45e301fff3f8d4104163b0c64d8abf2b2d3f4100802f75aa55b435cc890005d5836c1350702473b0359add46a8
SSDEEP 96:Ikfh9sbFFV55/hYIL1Bi/F3xhXk+EgHnU4oLQIAof6gjTtkt43J:XYXV55/hYIZBitBhUbCnU4oEdcuO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ViewLineItemRatingC.png

Path C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemRatingC.png
Size 662B
SHA256 ec0e0c2e51cf0c587bd8cd8842682ed78becd0cdb76ba06cb1c8cc1d98c710c1
MD5 471584f30a8dbce0f8e4ab7a781d3705
SHA1 1d4ec7b6ad3ae1ccd48056c84d05f2d684db85b5
SHA512 b6370cdbf9430cccb041c21641409e43bfd2a1b78836ee38fd0a706f26623ea1cc84e645fe6b501fed06b4222173055c101bee5de2cdd012c0cf5451cd3031d5
MD5 SHA1 SHA512

Submit Download

ViewLineItemiTunesExtras_dark.png

Path C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemiTunesExtras_dark.png
Size 622B
SHA256 096343c9ddc34fead4232f182085ceba66907446657257969f3916ba991eb58d
MD5 589bbd384b604e83cadeba1d59f8fd90
SHA1 ee6fe62fb935e9f1007f31eea754e3cdc315d022
SHA512 369b8d35ee411971f1dfd02fa065ce2badca714a0046cd26d098c15a8f55185178206516a62de59f81bfd285d4a8804a29b64d98f51f4e4a543bdb2eea993736
MD5 SHA1 SHA512

Submit Download

DeviceCapacityBox.png

Path C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\DeviceCapacityBox.png
Size 10KB
SHA256 f930036e7cae52b4022d979fdd6274d8604ca4c7e6f14495223dd78c17bc19a7
MD5 8246496c258d58712c0a972bece0d69a
SHA1 65f4a403895354702552e2769cfe7f480a70ea6f
SHA512 b1dc4bfc186762e414ece274b158f10fefaa86ec373c732c804381733a7c17cd56e27331ca7381e7e9fb795c04a4a09ac75642684f36f99d4c2ae2871dd8d447
SSDEEP 192:whGTF2+n5Dk9Ijn6ICVncfLGUm7C/UWMWFwzPjjllUMWETrj7MDVgp5:H0+n3j3an2G6/UfZPHAMWy7Mpgp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\ro.lproj\[email protected]
Size 1KB
SHA256 dae1592358924b99a4363cf20fc4a6dbcaeffb5af2f7a248a0fb687e95336597
MD5 6cf4cedb6b5148b103fc91a2d057888d
SHA1 23e873c7d60c21248eb9f8381643a295dc4fb12a
SHA512 4847a96925aa568c6d523f84e760b35d0f4abad4b6df70c3ed6003289b776b3327bbc41dda3da96221113e41b0097a2275db5bc562c77117db6c04e4275fc583
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]
Size 25KB
SHA256 efab63103f90135001658bac9c8724da424e81fc05c9385953a7555c6ce1ace3
MD5 784f871663195e678f524f4aefccc28a
SHA1 ee8a70134370ce17ce49bb31e92cff252958d202
SHA512 7e1b0f1f74abd674b09443b835da35b9b1855a0d7ac15e60670c6d3ffa1059fb13ccc579f069e444d073be0da76b65b4dc1d517c2ffef654a99ba9143fda6f7b
SSDEEP 384:rjOhR2PHN1n/k6HXU3RjOtQt4SQOQTdNpfOWpVExByTPFA12ipv/li:rjQROtmEXU3jtPvMdNxpKxUT+2ih/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

MasteredForiTunes.png

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\MasteredForiTunes.png
Size 2KB
SHA256 95f0affa39a202e292a5f630a2524c8de31b6478304e040ef06488d9dd1e9f0a
MD5 67f1b4232079935a9998b0395a6b7c10
SHA1 ac4bfc88ed92cb526720f9cc9b4a377ae6a7a787
SHA512 410e56ec048d2033e7e05202fc09575758d5c5e441146bd89070106108f1332e3ed3b8868238c78f18c0d641898607ecf1c704f51234d741f0693868966b0219
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]
Size 8KB
SHA256 6f231775671c67eaa458a6a2d1405f3e5c52d56882f5620aa435166f4bfb7529
MD5 d9eb252906d8d98e592ef01034a94c76
SHA1 5fd847136846bba1957e2ace9e1d3ec482de2e5a
SHA512 7bd132759532496ca864cfff7ad411ff48e3d2a9ab28e3b50afdabe5782d853da52a09f093b25c0d7c60906ce42ae8a28634df363fc6a435962dfdf3ae9faa71
SSDEEP 192:WYPitmvG8MoxzelQqPJ14rZdGw4m+pcOEg98x8e+gTqqci:Wxd81xzAQqPJ14rZd34HWOEg98x+gTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]
Size 1KB
SHA256 55617519bf037182dc93082300e162933c3771996607aeb605079bb834a182ef
MD5 e85fcfa0b73018404b29d4fa04f047a8
SHA1 2c7ba150c3fd101231563ffec9a7fd5ec5ae02a0
SHA512 141c92030b58dea61e29020b1792cc2a8dafd306af2a9130b105721a026b81a05d0d1621d4a76f6b6e5509dfffd47506885579279b6a098130b542df60b0f884
MD5 SHA1 SHA512

Submit Download

ViewLineItemRatingE.png

Path C:\Program Files\iTunes\iTunes.Resources\tr.lproj\ViewLineItemRatingE.png
Size 226B
SHA256 1c28554bca95dba35ce291c0a42e0810e2ceebe805d63f916b6b7505e057752e
MD5 18109ed593d861bd659055a5bd9db831
SHA1 3b2596e909633ca509e857650d7d7c9693987a4c
SHA512 1b8bb8ce363f7b5db7fe6648f518d0d528cb47bc90f5c80e66d8928b79f7912879b1c35ec6944d9ff91cb70c84547b9e46758cdd315e299453016da3cc24bed9
MD5 SHA1 SHA512

Submit Download

StoreBlankBuyButton.png

Path C:\Program Files\iTunes\iTunes.Resources\vi.lproj\StoreBlankBuyButton.png
Size 3KB
SHA256 51edab4204721531caab3a704e86d54445db4b4ddca70ef2c4b1012fa6bb3d5f
MD5 ceeb4e2a8deb651b69a973f5d671d92f
SHA1 3fff59aa350cdd2cfea69c08b55540b63122bf26
SHA512 9112040b761b90b93e89249986e6e75d55038fc1537293d7eadd02e181effd601ea15aff7a3100cf2c72de610b8b4cfefb433ae8bd75499e4a3dbbccf8410493
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]
Size 386B
SHA256 8acad76c6c4eb0c023664b845a7492adc2e418cefa48aba7e99496125a06e5cf
MD5 ff602a53d097a0d42fae257d6cd2fcac
SHA1 57ed476c7c88b7c231ec9e4d6acbd5c04808d78c
SHA512 a5f0d07314040fdbc614d09e2d38bf87ad0a1286c472f8c7403dd488488124e769d436ec1b01ff1b47825455f03aafadcac5722f4367fcdefb13ec3de0ec8def
MD5 SHA1 SHA512

Submit Download

Path C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]
Size 314B
SHA256 f5f639656493f65e4a5462f6c4e280fdd54a7a4e839c2c0f52c8b5b1840fdab2
MD5 755eb418266342b17633f1615a1882b0
SHA1 df51fddb36717426da15d38f4edd48f74c140364
SHA512 8bd4b9879f1899c2a5e5f9de80897882f262252260c69767365634f9a97e281020176613c58a9d22ffcb510f1cce66dcf26903092c455d7b17f951ba0876f116
MD5 SHA1 SHA512

Submit Download