25b28905a81406a5edbf482f7f3ee4831a8641d32d29dceda5d1eb3e8d534c08

Analysis

max time kernel
151s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iTunes64Setup.exe
Size 193.4MB
Sample260920-1rtncsen9z
SHA256 25b28905a81406a5edbf482f7f3ee4831a8641d32d29dceda5d1eb3e8d534c08
MD5 42eb641b18ef0493a19f901a973b69cc
SHA1 db14cefd09acb78d1c0e8573308067acce9dfaf7
SHA512 0198c9c74e2681508d301012e939d2a73c8660cd85771f7bd813dfa6d5ecbc7dd0f0b9c17bd1fb64c154b9f9fb59ee0ad203ae43a8f534cb51c56d15a3e57bad
SSDEEP 3145728:mPRwI5YMdwrKNDKRjc/fTncHneoFhKGI9UhU/OCQXv/UwrcSwcKXahJryUM4:pk+roKRo/fTncH7FFU/OxU8cSw7aTyU
TLSH
T1FBA83384F1B05E57F6AF7230204E29A5FA19DC53293428FB7A63D7481E0B3821EB675D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper = "\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""	msiexec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3016	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\WrappedPromise.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\NavigationItemTypes.svg	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nl.lproj\StorePreOrderButton.png	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\German.lproj\AVCFError.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\Canvas3D.svg	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\SpreadsheetCSSStyleDeclarationEditor.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\it.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nb.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es_419.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\DatabaseUserQueryErrorView.js	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.resources\Info.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\LocalizableStringsMap.plist	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\CodeMirrorRegexMode.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hi.lproj\CleanLyrics.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ro.lproj\iPad License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\Path.svg	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en.lproj\CleanLyrics.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\ViewLineItemiTunesExtras.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\SpreadsheetRulesStyleDetailsPanel.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ro.lproj\genresLoc.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nl.lproj\StoreGetButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\ViewLineItemRatingC.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ms.lproj\iTunesLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\zh_CN.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\th.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\MediaTimeline.js	msiexec.exe
File created	C:\Program Files\iTunes\CoreMedia.resources\AVExportBitRate.plist	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\CPUUsageCombinedView.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\iPod touch License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\EventBreakpointTreeElement.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\ColumnWidths.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\he.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nl.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ObjectTreeMapEntryTreeElement.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\ViewLineItemRatingE.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\uk.lproj\PrintingTemplates\05.AlbumList.SongsByAlbum.xml	msiexec.exe
File created	C:\Program Files\iTunes\ColorSync.resources\Profiles\Sepia Tone.icc	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hr.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ca.lproj\StoreRentButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es.lproj\PrintingTemplates\03.Playlist.DatesPlayed.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\genresLoc.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es_419.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\uk.lproj\AVCFError.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\TextEditor.css	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ComputedStyleDetailsPanel.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\DetailsSectionRow.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pl.lproj\PrintingTemplates\16.Media.PlainPaper.DS.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ro.lproj\PrintingTemplates\05.AlbumList.SongsByAlbum.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\Slider.css	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\RulesStyleDetailsSidebarPanel.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\NetworkInstrument.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr.lproj\PrintingTemplates\14.Insert.LargePlaylistBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\External\CodeMirror\runmode.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\BackForwardArrows.svg	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\it.lproj\StoreRentButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es.lproj\StoreBuyButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\[email protected]	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFE347B3EE613D1DA2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8731.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF66D0B43C99720378.TMP	msiexec.exe
File created	C:\Windows\Installer\{2A63AD0D-9135-4B2D-8095-296BBE33F93E}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86E2.tmp	msiexec.exe
File created	C:\Windows\Installer\e5955db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A0D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF52F4624100449D7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A144E0F5615821B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI324D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5278.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\{A1147B7D-734A-49BD-A6CA-E41E2B4B7B8F}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF252.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B87FA37B479820A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI904E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5955de.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\e5955dc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{2A63AD0D-9135-4B2D-8095-296BBE33F93E}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1147B7D-734A-49BD-A6CA-E41E2B4B7B8F}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDE90CF06303B6A0A.TMP	msiexec.exe
File created	C:\Windows\Installer\{2A63AD0D-9135-4B2D-8095-296BBE33F93E}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76F2.tmp	msiexec.exe
File created	C:\Windows\Installer\{A1147B7D-734A-49BD-A6CA-E41E2B4B7B8F}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\{2A63AD0D-9135-4B2D-8095-296BBE33F93E}\iTunes.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{2A63AD0D-9135-4B2D-8095-296BBE33F93E}\iTunes.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF64569EC39168C5D9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI902E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\e5955d7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65D9.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{A1147B7D-734A-49BD-A6CA-E41E2B4B7B8F}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\e5955dc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0B9.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A63AD0D-9135-4B2D-8095-296BBE33F93E}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9164E5F56F770BF3.TMP	msiexec.exe
File created	C:\Windows\Installer\e5955d7.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI132A.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D7B7411AA437DB946AAC4EE1B2B4B7F8\20.0.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\{2A63AD0D-9135-4B2D-8095-296BBE33F93E}\RichText.ico	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
3600	SetupAdmin.exe
4852	AppleMobileDeviceService.exe
4416	iTunesHelper.exe
4292	iTunesHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
248	MsiExec.exe
248	MsiExec.exe
248	MsiExec.exe
248	MsiExec.exe
248	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
1276	MsiExec.exe
1276	MsiExec.exe
1276	MsiExec.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
1412	MsiExec.exe
1412	MsiExec.exe
1412	MsiExec.exe
1412	MsiExec.exe
1412	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
4492	MsiExec.exe
4492	MsiExec.exe
5152	MsiExec.exe
1412	MsiExec.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
248	MsiExec.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4416	iTunesHelper.exe
4292	iTunesHelper.exe
4292	iTunesHelper.exe
4292	iTunesHelper.exe
4292	iTunesHelper.exe
4292	iTunesHelper.exe
4292	iTunesHelper.exe
4292	iTunesHelper.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupAdmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\Environment	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Apple Inc.	AppleMobileDeviceService.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Apple Inc.\ASL\filenames\asl.log = "asl.175521_20Sep26.log"	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Apple Inc.\ASL	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1CF95A1C-55FE-4F45-A2D3-85AC6C504A73}\ = "IITEncoder"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aax	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.itdb	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpg	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.itms\OpenWithProgIds\iTunes.itms	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itals\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4p	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5846EB78-317E-4B6F-B0C3-11EE8C8FEEF2}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4v\shell\open\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /open \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D0DA36A25319D2B4085992B6EB339FE3	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipsw\ = "Apple Device Software Update File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mp3\shell\play\ = "&Play"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.wave\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\itsradio\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A504DED-A0B5-465A-8A94-50E20D7DF692}\TypeLib\ = "{9E93C96F-CF0D-43F6-8BA8-B807A3370712}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.aif\DefaultIcon\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\",-132"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunesAdmin.iTunesAdmin.1\ = "iTunesAdmin Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7B7411AA437DB946AAC4EE1B2B4B7F8\ProductIcon = "C:\\Windows\\Installer\\{A1147B7D-734A-49BD-A6CA-E41E2B4B7B8F}\\Installer.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{3D8DE381-6C0E-481F-A865-E2385F59FA43}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell\open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.itls\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4v	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iTunes.exe\ = "iTunes Music Player"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.ipsw	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.itlp\ = "iTunes LP"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{11E4D223-C650-43F9-AB90-AB3AE4FB38F0}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.rmp\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpg\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}\ = "{031EE060-67BC-460d-8847-E4A7C5E45A27}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{206479C9-FE32-4F9B-A18A-475AC939B479}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.cdda	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.itls\shell\play\ = "&Play"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.m4r\OpenWithProgIds	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{206479C9-FE32-4F9B-A18A-475AC939B479}\ = "IITOperationStatus"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.pls\shell\open\ = "&Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itunesradio\ = "URL:iTunes Radio Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C999F455-C4D5-4AA4-8277-F99753699974}\TypeLib\Version = "1.d"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.itls\EditFlags = 00000100	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m3u\shell\open\ = "&Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpeg\AppUserModelID = "Apple.iTunes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itsradio\shell\open\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itals\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itls\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunesAdmin.iTunesAdminInstallTalkBackVoiceKit\CLSID\ = "{E9D58BF1-0070-4fcd-B722-A0EE5A3ABCD6}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.pls\FriendlyTypeName = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,-12"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.cda\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell\open\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /open \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itsradio\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.AssocProtocol.itvls	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B8DF592B-DE05-49f5-BB21-084F548F12A9}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OutlookChangeNotifier.Connect\ = "Connect Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.itpc	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.wave\shell\open	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\OpenWithProgIds\iTunes.wav	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\iTunes.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4v	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\OpenWithProgIds\iTunes.mpeg	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.pcast\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\itms\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itvls\DefaultIcon\ = "C:\\Program Files\\iTunes\\iTunes.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itms	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B80C6976-50C0-4110-BC85-44EB975CDCA0}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7B7411AA437DB946AAC4EE1B2B4B7F8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP155.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\ = "iTunes.aiff"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4852	AppleMobileDeviceService.exe
4852	AppleMobileDeviceService.exe
1412	MsiExec.exe
1412	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4440	iTunes64Setup.exe
Token: SeIncBasePriorityPrivilege	4440	iTunes64Setup.exe
Token: SeShutdownPrivilege	3016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3016	msiexec.exe
Token: SeSecurityPrivilege	4668	msiexec.exe
Token: SeCreateTokenPrivilege	3016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3016	msiexec.exe
Token: SeLockMemoryPrivilege	3016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3016	msiexec.exe
Token: SeMachineAccountPrivilege	3016	msiexec.exe
Token: SeTcbPrivilege	3016	msiexec.exe
Token: SeSecurityPrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeLoadDriverPrivilege	3016	msiexec.exe
Token: SeSystemProfilePrivilege	3016	msiexec.exe
Token: SeSystemtimePrivilege	3016	msiexec.exe
Token: SeProfSingleProcessPrivilege	3016	msiexec.exe
Token: SeIncBasePriorityPrivilege	3016	msiexec.exe
Token: SeCreatePagefilePrivilege	3016	msiexec.exe
Token: SeCreatePermanentPrivilege	3016	msiexec.exe
Token: SeBackupPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeShutdownPrivilege	3016	msiexec.exe
Token: SeDebugPrivilege	3016	msiexec.exe
Token: SeAuditPrivilege	3016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3016	msiexec.exe
Token: SeChangeNotifyPrivilege	3016	msiexec.exe
Token: SeRemoteShutdownPrivilege	3016	msiexec.exe
Token: SeUndockPrivilege	3016	msiexec.exe
Token: SeSyncAgentPrivilege	3016	msiexec.exe
Token: SeEnableDelegationPrivilege	3016	msiexec.exe
Token: SeManageVolumePrivilege	3016	msiexec.exe
Token: SeImpersonatePrivilege	3016	msiexec.exe
Token: SeCreateGlobalPrivilege	3016	msiexec.exe
Token: SeCreateTokenPrivilege	3016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3016	msiexec.exe
Token: SeLockMemoryPrivilege	3016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3016	msiexec.exe
Token: SeMachineAccountPrivilege	3016	msiexec.exe
Token: SeTcbPrivilege	3016	msiexec.exe
Token: SeSecurityPrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeLoadDriverPrivilege	3016	msiexec.exe
Token: SeSystemProfilePrivilege	3016	msiexec.exe
Token: SeSystemtimePrivilege	3016	msiexec.exe
Token: SeProfSingleProcessPrivilege	3016	msiexec.exe
Token: SeIncBasePriorityPrivilege	3016	msiexec.exe
Token: SeCreatePagefilePrivilege	3016	msiexec.exe
Token: SeCreatePermanentPrivilege	3016	msiexec.exe
Token: SeBackupPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeShutdownPrivilege	3016	msiexec.exe
Token: SeDebugPrivilege	3016	msiexec.exe
Token: SeAuditPrivilege	3016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3016	msiexec.exe
Token: SeChangeNotifyPrivilege	3016	msiexec.exe
Token: SeRemoteShutdownPrivilege	3016	msiexec.exe
Token: SeUndockPrivilege	3016	msiexec.exe
Token: SeSyncAgentPrivilege	3016	msiexec.exe
Token: SeEnableDelegationPrivilege	3016	msiexec.exe
Token: SeManageVolumePrivilege	3016	msiexec.exe
Token: SeImpersonatePrivilege	3016	msiexec.exe
Token: SeCreateGlobalPrivilege	3016	msiexec.exe
Token: SeCreateTokenPrivilege	3016	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3016	msiexec.exe
3016	msiexec.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3016	msiexec.exe
4668	msiexec.exe
248	MsiExec.exe
4792	MsiExec.exe
1276	MsiExec.exe
1412	MsiExec.exe
2928	MsiExec.exe
4492	MsiExec.exe
5152	MsiExec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3016	4440	iTunes64Setup.exe	89
PID 4668 wrote to memory of 248	4668	msiexec.exe	91
PID 248 wrote to memory of 3600	248	MsiExec.exe	93
PID 4668 wrote to memory of 4792	4668	msiexec.exe	94
PID 4668 wrote to memory of 1276	4668	msiexec.exe	95
PID 4668 wrote to memory of 5336	4668	msiexec.exe	102
PID 4668 wrote to memory of 1412	4668	msiexec.exe	104
PID 4668 wrote to memory of 2928	4668	msiexec.exe	105
PID 4668 wrote to memory of 4492	4668	msiexec.exe	106
PID 4668 wrote to memory of 5152	4668	msiexec.exe	107
PID 3016 wrote to memory of 4292	3016	msiexec.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\iTunes64Setup.exe
"C:\Users\Admin\AppData\Local\Temp\iTunes64Setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP155.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Program Files\iTunes\iTunesHelper.exe
    "C:\Program Files\iTunes\iTunesHelper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DBA2965D2C01768BA3C55AA6FEAD3CF4 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Users\Admin\AppData\Local\Temp\IXP155.TMP\SetupAdmin.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP155.TMP\SetupAdmin.exe" /evt EA3E /pid 248 /mon 796 808
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A8DDDCA3FDD86F73FC2396AE9417F6EA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4792
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 703E73572860E93746F0CCF69AB009AB E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1276
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5336
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 15C0AF5C1F1F36777D6236133E3EE984
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6FFCC20886894B9453D00F7CC3AF4B55
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2928
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7F228B326E022E1DA326D97723D6A702 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CC1F9A90C5816B72C819D1E1544CC497 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:5152

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5048

C:\Program Files\iTunes\iTunesHelper.exe
"C:\Program Files\iTunes\iTunesHelper.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5955da.rbs

Path C:\Config.Msi\e5955da.rbs
Size 332KB
SHA256 838fd608e78fb2d1641adb9afdc665e6d127a1b27470d012ce4e5d19e0ffacff
MD5 3443623087fd7245d7e301465dcc50c1
SHA1 3ddf7f5a5d8851d81ab29a40e31dd2b975471291
SHA512 b422ace5874a80bcfe9e8e534529e6113c47bf14519fb8cd87f96bdbd9565ee63a5fd5a0bf1e96077aaa39ef66cf5f5b32345060399c90dc4e770f478bf6bb92
SSDEEP 3072:G01Ep5CKLN4Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+K:G0Jt/kE1jOZy2KL4GBiwQtEa4L2sI
TLSH
T1FE743951A460C0F6F65629703760F5022A69FEBC6F10C4BEC368EF1A1DF0AD0567A6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5955dd.rbs

Path C:\Config.Msi\e5955dd.rbs
Size 1.3MB
SHA256 d7976ecf9382b056f2988a37f9d8bbe2302a084a3c0577771cf5ccda4ac29449
MD5 94e39c5445265d5ab445f89fba6726cb
SHA1 d6439de71daa5ed891b4242ade82b55678a0bfe4
SHA512 b29e390fc8c5051b33a49325d4a9c45e06eaf2b7087e87b1147e11388ae60393a6c009dba6ee83a3b47f09daa1a33869e30be7b05acd2c621a8955363bd8007f
SSDEEP 12288:CBiBVTed9ajBjXZ/ReV+SZ7tx9uKZWc5Em7G:9VsydZ5UIcS
TLSH
T18155BA63D909CBA4EC6A39770381B42C6617C83CCA18643DE74E9B16F8E5FF06AF9451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASL.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\ASL.dll
Size 78KB
SHA256 fc244a5316e5af521f6188115090b5ed22d8ca3f3d7f7bfbd53d0cbbf27ab341
MD5 4fb181e09e6325ab98149215bf5aa63e
SHA1 7f45abb4e51034c540ef3bb3dde1c4b7b9ba9c48
SHA512 edd93632e87f9d84f7bdeca6f6e87f911b02113eaa8fd9d5de2c397dc121ef9874ac5630fcb05a7ca7ca07a8186fc267ec67016a5358c77ffd124130de3fc3e8
SSDEEP 1536:7XuPF2rjwZ5REIoA3WG5iSLf5Kha6+9eWqP7l41kys23hO4:dwTRbHKhp+9eW8l41kysP4
TLSH
T12073395ABFA850B1D153C03CCAD3C646E6B2F1865B3189CF9391831A0F63BE56E3DA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppleMobileDeviceService.exe

Path C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
Size 95KB
SHA256 1da2c34ee30f38beae2492758c9282e14ed36c69513af76768b25ce693f05e4b
MD5 7aaefe8a045172720e1eb704827dcc75
SHA1 10852abf9349c5096975f3e7f58d2e7cec02e7ac
SHA512 5ef988bd4472010de60ae52bad4666ff70f5f4c787bcc6742e2171cbf2ceeb6059458a71d6a3f0e04d406db93abf97e9585daba6820b1cef691219fb785298e6
SSDEEP 1536:Pik5Si0v7Mk2Am25c0uvruT26wlYJQxwXfArioQ+NS0DOQ+8iA:15MArAL5cZvrdlYJfXfArnS0DlD
TLSH
T11CA3065A6B3600E2D07AC039C995961AFEF130E48FF563DF57114A4A4F527E07E38B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppleMobileDeviceService_main.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService_main.dll
Size 231KB
SHA256 4e9ed23db3b85341071943a6c7b455702d994024e74f76fef8b55db3be54c35b
MD5 04713dfbbc84c05c9902e5a578e214d5
SHA1 2f184cf53ea8976714641df294edd62d8c146255
SHA512 64dd8180079238131eae864967ffc693247d1a02c25a75946d261843cdc594db00f9d43b8840614d4fe71177f5444bc09cbb28ee9004bc587030f7490f247130
SSDEEP 6144:mDMfrVq+dzke4cH7lcvjf4jiRfPlTeJx1:mDKh4UlcvjfwyPlT
TLSH
T1B834F947A37A11D5D8B7C1349952B627B872B4688729A3CBCB00A6574F36BF4F63C348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppleVersions.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\AppleVersions.dll
Size 28KB
SHA256 def4e62bdec8ed09b0a6fbe28fd1d9017236a82ae013f850b113e7d9ede295ac
MD5 888382a6b44006c5b81905944d04a3b2
SHA1 bb5260b3daa737025fecb4ee7c4a56a69329dff7
SHA512 e67249c4c22fd80ea508f24bcb03ed72c539ac61a424132a9b08a776edd2cb88c6c70c305a7ec310f22c41cec2c315629055439c8198639acc665c58e4dcd294
SSDEEP 384:VjCW1BR3Z2kPLV0mOQigIMOxmyYBnYPLgTLcDRXaV8JN77hhiq:AOjp9PLymOQbYMyApTgDday3hIq
TLSH
T107D24CCA1F2A5057EFC38DB491E7E61BDD78B2906BE166CF167581012FC2BC13A2925C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFNetwork.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\CFNetwork.dll
Size 1.8MB
SHA256 22d48e85989402243d5a769871db257f41b80046047ad6fe33c6a04b053b344a
MD5 b91de3c9295d400fb3194f3c41ebc70d
SHA1 9e8a4757f67360e1e636f9c71a223132ed493bcd
SHA512 e2b5761e622966bbc57f76733d090f4adee4ffe03b747559f5db1ab96531722e78a087aa5f55025ce7cba8b931a4841a93e02c84cfd8b64ba94e81138b2885c9
SSDEEP 49152:2fy6oooL3YlmoTsCKna0MDdup5eZOq1yTak:AsLqzKGupmCak
TLSH
T11E856C27A3341276D23BC47EC5536B42D2B174026791F6EF0698CA945F237E232BDB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreFoundation.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\CoreFoundation.dll
Size 2.1MB
SHA256 5fda9c96ee55d54e9bef2d3ea0c8102a3269b73742388ab07a030a9756145b7e
MD5 5f4ec9c2c1cfa04d012c1b43d791f029
SHA1 66905957255241f79273c960e7745050eaca15ae
SHA512 2171f8893a32a67e8f4034ca1c470f6e83fa052a85639c530f27a2e4986553e08306e7305726dd42cf728942c0da4b4565ab197d7e4dac2169f1014f49f4c646
SSDEEP 49152:PkpS1i3IAyQRAXn+yMr+Ox4NX16XjDy4tToIhbo85e7qCXWSn0jyUdo5IpmMEZum:k8i3I8AXn+yMr+Ox4NX16umbo85e7qCZ
TLSH
T18CA55B1DA79411A5C3BF95BE814B0B0BD2B47816077153CB02A0C6892F7BBE7273E75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFCharacterSetBitmaps.bitmap

Path C:\Program Files\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\CFCharacterSetBitmaps.bitmap
Size 424KB
SHA256 abaa23c79ee3ad152875f3f68a7c57fb3a70cdd9536884f896ce70ba86eb70e7
MD5 714a4d047d00f16c28e33759cf6abff3
SHA1 f04b92b9bb6ab7de4a601a4cc9875ba8071c91a6
SHA512 241e62e42f3c6988994f3b0e84f3934fb5c728fa5ea69e7c96e87f5d50165f2f8ea1c3c014e9c32c38289280e74e944e3ab13a3be981b5a7f405b7ded04a8d21
SSDEEP 192:jU0Jo0svZXUnmqdV1QDfCLQdLDnftBLkxM9JymAhgnnhHH83H8n2tb:DoROmqREfhRLk+jAhIn9c3cn2b
TLSH
T12F945407B241FCC6EC1449740C8FDAF8D2A1BD21EE01469B3AA0F75E3AF3255AB87565
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Info.plist

Path C:\Program Files\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\Info.plist
Size 1KB
SHA256 2d4a9e1a4b85dfc33b0393fe0a24f838f9d91771977a430d046d910227fc4935
MD5 5596ffca74c5aace74655135b7cbdef5
SHA1 062b0eeb23e8bd5841afc93681db96dc5c5168c9
SHA512 27b5bd9416296a16557d6b64ebff3d4ae99065038fd4e5082af1955737e4127b95b5089aa72eb8139d73a43f2f2b9c64a44c9e1fe6754914ebad2760ce06e3f1
TLSH
T1A4113AF40164755958C617B70682610A45D862CE6C3122FAFDCDA7689F0F80653F2BF4
MD5 SHA1 SHA512 TLSH

Submit Download

MobileDevice.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\MobileDevice.dll
Size 3.8MB
SHA256 929e4c3582eede3cde35eabb31ad8211defcd425448fd75b5353073d6bd46812
MD5 349d6fe8668ede1da3f6420fbed03209
SHA1 a2492fc0198f09b404827a22ed1eb9aa28c4e1c2
SHA512 a1a6c8e20578dd7ccea660e21c896f394e16853885401b760ad5323dfa30d6591ecbc644e546526701af176426ce8dc42667cc41de725518334a00156191b8c9
SSDEEP 98304:juq5ZKg0AHbaVorxLIhlT+c3TrjmnYzts+vbdbjHW1:jRaetLIhlT+cTrjmnYztj
TLSH
T1E6168C1BA3A810A9D577C17CC6974717D6B270682321A7CB06A4C69D2F33BFA273E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YSCrashDump.DLL

Path C:\Program Files\Common Files\Apple\Mobile Device Support\YSCrashDump.DLL
Size 45KB
SHA256 44e81cf4b0733898441c84ac65c05c3d3c028b42a46abbadd9f899b290f5e922
MD5 60388bb22e35f5b3b080c5126da4b8a3
SHA1 bfc477544ce3b0416644ef2fdaa1e853b0a51a98
SHA512 52519bec5f591fb1ecc737d11a8f4ef803f83da516ca5eeccc4f3ab023ce13fa0978439fa7dc115566ae154a0b7c8ee7c3b24a1042226c5b2beddf55ff78e360
SSDEEP 768:8gySLwM05PLQbLW0bFScYJk08fdQQUtCJ9UA/riRGp9E+ZrL1EWVoSfp9E+8iROE:8gpLEBLOLjbgcYJk0rtkR/rioQ+ZX1rP
TLSH
T138238F9627692081EDA39C38D5F2D567EDB1B5A5AFA111EF4330840A2F533C07738F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudt62.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\icudt62.dll
Size 25.9MB
SHA256 374302eff32578d3d412332d3d50478fa770566d24d056e3c5bfb2019503a1bb
MD5 f99eeeab85f45e61c0b538b35dc01063
SHA1 6e008639fe0a477cc4ccc01fa0d36d2e4b292fbb
SHA512 239685c607ed67d46edc7a43d0c477550a19c1b25600b96cd4c77850f8d365cee9fce06538e77b8f7051d8de90da2617292d22044fbf39a2bc6bef37a9fb4c85
SSDEEP 393216:TzPHuzieNZBQF0diXUxKmfJcIWlj3gUl2n1g9WbknRymDS/auO47Tt9r0PohFry0:nUieNbN
TLSH
T14757084266FB4DD0FEF7AE319AF663634567BD027E30844D51042B3B6D373A09A61B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libdispatch.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\libdispatch.dll
Size 102KB
SHA256 385a7961ffa20718f30768efcf85fc9f7d67b86dbd9d4591bbefdf69f7165aad
MD5 72805ed1349e2e76421881568a8d7a02
SHA1 3a30d8db3113f45e520ae6e2ea9f9c197861c3f8
SHA512 de2ad650652e654e20e27bf55d7532dc35f29e95492169bfb8a1bdd7ec8f1f120e279f8098e1e7771859f6536eb4f8aed094894dccdde6da2910c4752c3352d9
SSDEEP 1536:ZlRgMbiF7drF9Z9HBbJ/Qdbs3wMLGjoMKyKqvG10MT1uoNyoO6ftaWClaxAtesLq:ZlFbozJ/JwMCDADJ3xiIsL6KeKI
TLSH
T1D4A37BEE36680058E97790BDC3A6AA4AF272B45007215BCF067483961F67FD16D7E338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libicuin.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\libicuin.dll
Size 2.3MB
SHA256 ba770ced35ce16468b278e07f85175be4cdc78158d85e3acf1a3f2e834d8c177
MD5 1eb9ed6b90831685af199a9480ffebfe
SHA1 18e7b798a36dbe04d5964d670bfe4d6e066d5caa
SHA512 8e780ba76c9c82ca4b3e5dfdf6f17db58b501abc2ac47b3b2815641f08ec25ed6a6c8d0ed105a421fb1e0a864c2875752510e43beab6720fea3cd85bcb8e42a9
SSDEEP 24576:C9x2x1dGmSPUEAae5f4WEk5KBrS+o+G4r2/34KRfYybO:HdGmSPUEATikk0+7Xz+q
TLSH
T144B55C5BBF65D162C166C23CC8D7410AE6B7F0394B629FCB0259074D2F23BE15AB9368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libicuuc.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\libicuuc.dll
Size 1.5MB
SHA256 d7f4db0fcea1086da4ff27d147f47c32e367f237b6fb807a548971132bbdbf66
MD5 d92a2a91263f2163057e54b9acfc0605
SHA1 62c42367346159840ea9f8e651a4b5ec627bf79e
SHA512 f6c4b39cf12344bafe272ef763963340ec5ed41654ceaeb575b2e6f51013b2fb980aa93d87493920f11606ce8915b8a86af26cd772be5923ab8bb2f57340eda7
SSDEEP 24576:DBAcN0NecPEWgJPUec73XFY/hEGCGrFTpWiM:D2kcPEWgc1QKaM
TLSH
T1A5757C47F66B9089C26FE3BCD4B74705E7B378654F21CADB2664462A3E03BD4067A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

objc.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\objc.dll
Size 231KB
SHA256 82e2a33dd8a44f48a684a87ba8bbd6b5126edb7e87f18ba1279c09a5e12073f2
MD5 277abb137376a7aaad701f2795d64ea9
SHA1 065c9c2371bd9645f02a3c387a78af77c4df25e1
SHA512 0564d7372beb2b437813726b1b50dff37b2f12dcdef5382cdad8328e2d4d6ada0fc687ce2dfb747fa5e24d2ac52b9bc95a102f597f1c03acd3fc005ade176ec0
SSDEEP 3072:Y5hOL2PSf1tP7FyjKs5liEYc46en3JewPOIvekrsb4KVksMc39nyPuir9:YeUS7P7Yms5IbBnZPO4ek+VksMT9
TLSH
T1B5344B8D729814A5FBAB507CC9A29503D2B274252760D7CF02B4C3B61F27FEE663A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pthreadVC2.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\pthreadVC2.dll
Size 93KB
SHA256 6abafd58fb7b5c0450bc411342e2e83fc98f73b68ee8da3d8695b131d40facdd
MD5 bcef1bf5c4bfe7ec96177f8d573f7513
SHA1 3a3ae4dea406f46b54f358ac3a2d25f4f15efc98
SHA512 05f2d0295cca9bd7703e4738189925fa844dfa7ec314d18025cbdba9f81cc6065bfeb16f4b566af75d264453a8f33df3db98834f98a4234aed2c9d457017b7d9
SSDEEP 1536:QEY0hxzK1gYW6fRfiH/p5kWG5Rd4H3hV4:fY0hxe1gNORfiH/p5kWG5Rd4r4
TLSH
T12C935A8A373810F7E6A7C47D81E24355C273B10157628BCF96B4C6A21E5BBD26E3E349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files\Common Files\Apple\Mobile Device Support\zlib1.dll
Size 93KB
SHA256 c90da799fdd677c1854d609b84a76a2624feb5b855dfb97488e6db7967b8d7b0
MD5 047648e2fb7bf17228a27f15a9c07fe2
SHA1 50f4278e1254742927882bd5d191ae408b3e32fb
SHA512 7eb9df1cbb6c70015477e8fe3fab6414aced334a1993577c842a1faa37645c10c1bebb39c9d58522230a5ad6dc7322695cf2238a2c91e62ae31063e5701c97c3
SSDEEP 1536:CQjzoFuLoongX1rcuwfUuS2uyiLHIOQIOgmjSuDkiTJdQq3hYh:/zoFuLoggFguwe2HiLpGgSSuDkiTJdQv
TLSH
T19A936C8A267522A2DAF78174A1E2965EDB35B41047905BCF469C97A00F13BD03F3A3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Localizable.strings

Path C:\Program Files\iTunes\CFNetwork.resources\en_GB.lproj\Localizable.strings
Size 22KB
SHA256 47be7f1aea7eba3fe98080713b1c4414ed5018aee75ee7f6453ae2ff95aa76c0
MD5 11d00b701160c1244899bc1647e3b756
SHA1 866c9acf31291a1459e6719dff2764af41eddde0
SHA512 f1e8727fa33b70bd146d71aa782ef8000b6824c06b936b7584057ca77cd082a001398bc5ef2202e12b50bd86687f3a75ba3a6b028d14c7ae3d1a21d868cb756b
SSDEEP 192:nypn8tHu9PJrvYN5QZ2aX3/R5xsq9iqg3c0rta6aLnp2:nypn8tHuPvYN51aXvR5xsq4rwnY
TLSH
T13CB2BF1153FD5A08FAF3BF0899B9A8504E377C5A6976C72C52940C1E19B2F84CE66337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genresLoc.plist

Path C:\Program Files\iTunes\iTunes.Resources\ar.lproj\genresLoc.plist
Size 236B
SHA256 2950ef6f4409f89b8513f2bb787f9070c2983b698b35b678088c59cd83246bce
MD5 093deba2a9db087a0cb01a676bff1c9b
SHA1 9c7d3070d1fef593731dacdde8cf38e7f96962ab
SHA512 dc3860ac3d87ad8f28988b2c7e694721757a43367ce6a1333205cf335de1c29e739a8468a70bc305a60c4d0587aa062fe01f3762d608c9bc4d76867f2d381c1b
TLSH
T1C5D0A7991A44A8AE00C05BC74B2AD11A5390D3569DB1286D54E29CD59B070A673146BE
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\cs.lproj\[email protected]
Size 5KB
SHA256 ebdb9147c9b509b923fbb4e1e7903c84f67b42542b0055b2f8356a16c456191f
MD5 236216d5b66e7e9f48715b953b465c56
SHA1 7ad8425770aeb398922005b2649c4764c5b6dc5f
SHA512 6da4821957d52ef729cee2c6436f75b8581b702efeced430e99abc81be11f8cd2f2b2c374a88d68ee177b46b0cf34f723341a78d642dd4c81a8b5f09e8c77bd1
SSDEEP 96:qOiB7Gv6/36yu2nwXe/82sD8NMf5h/oXSKEM8ziX94NJX2/etiwnjgWb/pR:qOyMIzwXe0Jo2/AXFETGy2yjHbH
TLSH
T195C19EE6A1C76B414D4C3D0F5A33780F72BAD42698AD6C200039D62E5A661A35C99C75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iTunesExtraGridView.png

Path C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraGridView.png
Size 4KB
SHA256 a33f1e4d73943a77e6471143d263aaa53a871f7534e27435beeea19e75c82fbb
MD5 94eae9dc7a205de2ee0a17effa21b60c
SHA1 54f23cb71ac3a62680bd22a3b2b8ed5c6c86d5a4
SHA512 5601cb432d92697a630dfa9c5403b7ff1210f517c51eb84a4036d7c14192af287eb86782a8036b0da72ff39f827d118d276a43cfdc0019f40b85147948d3d99c
SSDEEP 96:u1cCvTH8tehB8VftrjZz8GvxFWDQG8EEWWjfIf4j:u+CrHf8/3FG8EMj24j
TLSH
T1EFA18EFC9EE9412DBF0CC6E1C5514AA673235B90CA5294E981AD1B4302B9AC050F8AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iTunesExtraListView.png

Path C:\Program Files\iTunes\iTunes.Resources\cs.lproj\iTunesExtraListView.png
Size 3KB
SHA256 b21d24670a44bea7c5c86c2b87d356e66006cfeaebb8e6b7d4ebf07974ac3f66
MD5 5e93c7b6af1f907359091cd0c629b3dd
SHA1 4aba4ecd7b1b5d7937e7c7faaf7ac1629c0394cc
SHA512 492683e196bceb4f80d2bf07dc9031fd8f1667b0d8e3da877df1666bc419276bde0a6af8a1dd983a0b5594d5e0143eeda09ad2b87378cd221fbdb3e45291772c
TLSH
T1C3717CFCAE6D312EB98887AEC1705A9972B153C1DEE229D4807C26974174941D0E4BB3
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\da.lproj\[email protected]
Size 1KB
SHA256 b58b3ac76194b282833d971e2e2379cb25e7149f29f4a585e9405daf810a3d50
MD5 b8f2462ffc91bd1956cb2607c1c9df31
SHA1 b4d4a46fd481f23268fce6b63496e753ec1c8a25
SHA512 6814101aaa72a241e4f9d37594c666016a36bd4d5e5ef50623e23590ccf94bac80d2b8c062213b557ebbef5e007fe0400ed9c84422df8f5a5486d2c9bc4516c2
TLSH
T11721B7EF4352445CABF936AD513690EE5A32BA891239000D6A5A5F3B867501C0BAD2C6
MD5 SHA1 SHA512 TLSH

Submit Download

CleanLyrics.png

Path C:\Program Files\iTunes\iTunes.Resources\el.lproj\CleanLyrics.png
Size 3KB
SHA256 66e1fc581446d80a7f64afeae19273cef7d6a10001e3e7d3127ade5842c754ff
MD5 357922d796c4ab56acb274ec1c89ed4b
SHA1 4f29801424d33877426dc21cf02bdbabaa321120
SHA512 e0c7b23cec3ba61f83ba3a9675ce078d4fd36fed08f8e1c20be6e9b7891c1d4175e5ceca9ec3797419b22806d82d86fa4fbad314565d000a36fbe92905c9e36a
TLSH
T11E818F1F6A9C0407D4E68309CE187725E5BE43F1C607D915C4294EBBC6644AAE83A66F
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\en.lproj\[email protected]
Size 20KB
SHA256 065261151f732d9f8391b0bfc00e71d3dd8e47c84331aa94b58e295782d74a30
MD5 498055b7ec8f362e71a988ff8c79b517
SHA1 4b28c12932e86c68c7acea45303be3900bf987ea
SHA512 0b7c4dd87fed1ec01b14334e129ac43c598c30a1141bc9831f7b0ad106704072112b36ff4688520d675eb72652ef6a1dc349c95f55f6a59a245c5c151771f0f7
SSDEEP 384:gOWOLv5qDDvDl0Fe9nH0vJPDz6gQrfcEf82sG4b53j8/uVL0D9z1Fyc20k3xGAij:g/O9eB0iCZHcw9R5Q/Q4Dj8r0k3xGAij
TLSH
T14892E1D23E82CB8EC2211B89AF7F5F011A11465A53ADAD7B2B48B0C8FFD654744B8C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\[email protected]
Size 4KB
SHA256 57b642737825507373c0b192e3431f7a15848c1fb061b51b262b8d2438551e43
MD5 59d4281f0f7f665c809f2a68434999ff
SHA1 1c71204e311646a1b367860c0de11ea5e60e06ed
SHA512 e38edd4b53f950b8c3202552d38a6a56ee726a239527a1aec064b9a3a66f06a3aced67c0b6bc3c240994d006d8dbd5f2e2ec67bdd4e76c181e9331891d1d0154
SSDEEP 96:9OiB7Gv6/36yu2nwXe/82sD8NMfd+iaWePzZeYDAfw:9OyMIzwXe0Jo2fe7Ze4AI
TLSH
T1ED918D8E044E2195DE0B3C095043EC7E75B7DD41C48666F38BF5DA994CF99B91DE4421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iPhone License.rtf

Path C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iPhone License.rtf
Size 46KB
SHA256 b636c8c51b01fd142af1134448763dc526041f3fbf635e841b0c2882254d64f4
MD5 cb4f512972b12e3b783e89704cccea3f
SHA1 e64cd7091224e3449e15e4ea664aef256534183c
SHA512 8b9abc21f291f53ae89b16f1cd9403bb881f9fa9140cb919e0fd5f4ef8544dca0359b7d5e45f54e3ff74eeccd4d9f0b62494992a58c6e230e4467015a1092988
SSDEEP 768:adLByUn1AWAJTS373Rq2DLFhIu/Mym52dzq1W6FqJh3F6mk3zkumKMoUZlC7HX3l:ydnCQmIZKjpMh4HFRzshwdMyh
TLSH
T1FA23E63FBB0117B116C203D13A07ADD9F727813C77AA5D919878824C17B1E68937B6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ViewLineItemRatingE.png

Path C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE.png
Size 538B
SHA256 2ece6d0b0fc97dd6deacfdbaef44458a4b96e43319c78cb74c55d4f7ea79d9b6
MD5 30aa67b32a3542874bcc88e146e17b46
SHA1 6d86b94d2c71ae27504ce8b3ad000fa4ef532a6b
SHA512 dfd082a54a13c5d2fdfa66ee9db8c893bbc6b32108308727665267f0a9e9fa9610c174082c0ca7a34832cbba768a1e2d8f6218b4c5a538a328a6159be05f3cc3
TLSH
T11CF026E792501CB5DD5DDB035EF75F176B31112CDC3581E62522DD1CEDAB1051840347
MD5 SHA1 SHA512 TLSH

Submit Download

ViewLineItemRatingE_dark.png

Path C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE_dark.png
Size 222B
SHA256 c5c8219de48b954849bf19b716dbba8358c66b02836417d8d729dd2a672935c0
MD5 ef859a036759f6f29c3dc14928a75c76
SHA1 45f8c4450757f2ec653ee0845f5ce497b6832598
SHA512 93aae547f72edf6c466b4f6c1a43f7f0fe0393cc7f7ea87818b462a4938cd86903017a12cf4eb1f3e05492b312e8826c5fea1935388a168e1f0278cbf3fb505d
TLSH
T1F8D0A7E3B15254ABC746547500112212EDE760120A2C8C8D0F4DA4282CA8B04B842A46
MD5 SHA1 SHA512 TLSH

Submit Download

genresLoc.plist

Path C:\Program Files\iTunes\iTunes.Resources\fr.lproj\genresLoc.plist
Size 218B
SHA256 a0f0336ccbb2964f1b6534fc1a59a04896bc104473812ce0f407496648eaa93c
MD5 17d011dc9b1de5a0dbcbe11f5dfa4dda
SHA1 22b3182f41bc4a322f162832b4dfa92a46a71859
SHA512 99193d05842ff4debac4d1c1ae772d3fa6424f5c097eea557095a9bbbcec044a18c3557afb1d2f474a2b86db7a8ce24d44d2b70d1c5a989258ad9f70d6561452
TLSH
T16AD023451644EC6F00C05BCB172ED1465390F3969CF1146D54D15CD15F070A653042FE
MD5 SHA1 SHA512 TLSH

Submit Download

TextStyles.plist

Path C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\TextStyles.plist
Size 41KB
SHA256 503b82910c0a98e3509cdf590dfa8f722ef149390b260068675fae09c3cf12ef
MD5 7f9f90998dbb72a12f12464fffd40997
SHA1 01a41b41e92271eea01f31b208a2c2b47b496b59
SHA512 7c293a39681c386002107aeb852c15ec8b4acea037f8abcef601cc76380f3487f421d267a6ae856df90b10fe8d032852c3650d5feb36f675a524163314e23a98
SSDEEP 192:XKEuqsilw51LKFneHIV3VjoQsLqfOqx8OR1IWbxksPKeIGOytW/mC:hhl+sC7
TLSH
T12A1345F65E047F9A8DCD05201BE9980A05D7A6DCCCF210FBF9928A35B854F4B91F4A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ViewLineItemUnsubscribe.png

Path C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\ViewLineItemUnsubscribe.png
Size 9KB
SHA256 59a9ffdd81daf97ceb9e66f1e29b292dcf78373eef8df94038df3845d3e6d5a5
MD5 001e313e3be5e546cb50d86cb65dec8c
SHA1 e7feac3aa8b53b2670077ae0254a2900ac579467
SHA512 26329e02aba9b0ed9295dcdc0834a7b2a75aa05843365490ae0d86f787159967943a8040ab425c10266523e15308c6c52673cd2ac5db7073369bd76c0777278f
SSDEEP 192:KoONgOLPXsAYnyIKZpUm5yr3U64B66qCAJKNHbKV0zrZSTN:3OWOLv5qNKTUm5yr3U64vpHbFzC
TLSH
T1E712B0AD34497FDC4B0266DB1584D80658A483785154A3D55FEEC37A82ED3A4FF03968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ViewLineItemiTunesExtras.png

Path C:\Program Files\iTunes\iTunes.Resources\he.lproj\ViewLineItemiTunesExtras.png
Size 797B
SHA256 2f0e9c34845db2353f8798bbd7ec23ef4fc151cd61b3383b0a3280b7de78309c
MD5 59ecde9c26c45850d5d42fefd0a2fad5
SHA1 6bca0dc1fb62c293f30bd7880d91cf96835ed4e9
SHA512 9b9744414188aacbace2bfa37561266f7aa6426c6e61bece4990601f0a57c7c41302dcefe1757e3da86947baac2ebb06c266f18108448ccee41d205680822994
TLSH
T1F201CAE9318474E4352D86EB45E30751FCFF5927BC794ACF4149A42D5E25310E881F80
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\he.lproj\[email protected]
Size 5KB
SHA256 6529e898923292f4163ad09594682cb7fa1c32c6c71baac0e4405d9996dda509
MD5 8875b575ec840a83ede84ca27762761b
SHA1 7463b50c8483598dc6ae4889633a11edfcd3a5ad
SHA512 9af764d681309781353504d270d78ee59798154c94292e8eb73b07e78f077a52cecc9523ee088d68fc08de353541c6ed34fb2d73eabd1316e638485ceec6a6bd
SSDEEP 96:V1cCvTH8tehB8VftrjZz8Gv97z/9JXOJUOS0htCcnGSKdxDAsLZWwQr9m9g:V+CrHf8/B7zVpYJSEDKYs0wgE2
TLSH
T138C17DB8BE1C217D6E0CD365401019E93536A3C58AE791DE707F13F3C66594560E8663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RatingCaution.png

Path C:\Program Files\iTunes\iTunes.Resources\hi.lproj\RatingCaution.png
Size 3KB
SHA256 138d6ca25775eee1f0ea7001f694a5b286224372aa168a09578a1a9af7eb76bd
MD5 22b6a916115477a43ce634ea820a6304
SHA1 a34138e73bae3a62d745171d62f9f05a6dc07276
SHA512 97502dcec76353fd69ffabf398b53777bde50d08cc998a6213410596fc42eade86f717eef60bea0d5a4f193fbdd18b33f09fe360b043246b9c96d3316c7a0347
TLSH
T1F3614C1B6561E400D4AC0B1A860C3264D1AF47F1CB0B96685008AAFBD7AB457DD3A7FB
MD5 SHA1 SHA512 TLSH

Submit Download

ViewLineItemSubscribe.png

Path C:\Program Files\iTunes\iTunes.Resources\hi.lproj\ViewLineItemSubscribe.png
Size 8KB
SHA256 a9ccdc7553e6cf9095d3760e88a3c9f76c0817ea6596337f21ae748828ce3532
MD5 d4eda1881d75dbd2b0d9336e9a5108da
SHA1 fa2264a591a47e42b7cd581b9e0a3ada33874746
SHA512 4a953a46684569c02fa447f46ebc5d8c8445a045703f36cc17df708eb53b2c324bf83c4c71a72f35d96f4655e5159b919f4eb631df598d4888d40a73d675f527
SSDEEP 192:foONgOLPXsAYnEO9uvc4NkRQIzy3vJ/eBiwV9vYWgS:QOWOLv5qE2wRIUhe9jJgS
TLSH
T18712BF74A8087ECAE6971C671AA6E6A0A4CBD35B9640D7DC44C2CE2014D42FD167C8AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\hi.lproj\[email protected]
Size 28KB
SHA256 946361d40f1b68a0cc29004ad4f55522c648023004e6adc9975e90b6e382657c
MD5 7676be0b698ae5a36b25772f547142bf
SHA1 4f5ab9344fc8cc6de692bce6881878185b96bd4b
SHA512 09f77f33a281a5d4ab712b2f43f01da729085cbc27a973c8f34e3fe0cab1fc515f9dbc45ef35ed9d0a04aa76cf26e98d0c78e8b1805f12560e2866239bb9248c
SSDEEP 768:kG7W5mxjrq8v7zAy6TmEheQFKtLkrhiZrjAXeWrz8Uimk7:/8mxn1Pz6T3DFKtFbCcmk7
TLSH
T1C6D2E1AB522809B5BCA8C8D442CF437D91CDE7647D2D20C5A1E39C75BEA5FEC60C32A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\hr.lproj\[email protected]
Size 302B
SHA256 5501b7a0c2af99684fb58c1acd227fe53bf07f4028382aca136607ed9459fc8a
MD5 5132ff3c2935630e2f54ccc9a360b742
SHA1 58a0b7d8667d625d8e0c9267bfbab88551c6524a
SHA512 816d16f9b37c52f97a64a5a1f4c4b6c1bd2705231703416c7713212e1cca2753e3bc5e3352439a0cebc89a5ba0de584edd1183603cd387e7c7fdea1f023b1f85
TLSH
T10DE0E7B2C1005F6CC4D14572017388C4E73FB97117159D5C1D0FED001F4410965585C1
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\hu.lproj\[email protected]
Size 3KB
SHA256 ce8aa4cf4ded795fbf1c10fc881978746ce6c76f13accf566e7ba0e98f5af774
MD5 02185d025965988b87c6b4748cdcd745
SHA1 e110b97b7d669361a0f2a2cc38c4a62f3d5deeab
SHA512 f1b6617eff4a584a760c24423226c844e2ceec8df8023bc9a53da69b18f76d2226ad24d0d1b2bf61cb2da9711caf4c23ff7905298edb309cf771cca1797a2c48
TLSH
T1B4817ECBD8F008BC70AE3464545D09E7153D84A88CFA1C7C22A74D77B053F408996D0E
MD5 SHA1 SHA512 TLSH

Submit Download

ColumnWidths.plist

Path C:\Program Files\iTunes\iTunes.Resources\id.lproj\ColumnWidths.plist
Size 18KB
SHA256 bf81225b2c30aabab43beb74142693ba800af85f88025446aaed2dcfd5068ffa
MD5 8490f8bf0576147ba7cd139446e6cf20
SHA1 48a557825885bea1a6afcb662b07113e99a20136
SHA512 86f0896fa6ad25a9550cbb3d0746eb413c86832986165e0824eadd917bb902b1f13c9aa60db78d477c3c5921fb7fe1465025765429b6a5a7e638da8063487753
SSDEEP 96:Cyiu72zdQKTSQKXKl2h42I042udQKdZQKtSQVqSQK2SQKIiQS72CSQK772DSQKnT:X1i3E
TLSH
T182822DF1DE4C1EA59888092152A4C44E51CF7EEC8EF520F7A9B3C972B844F4366FA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\id.lproj\[email protected]
Size 5KB
SHA256 f03209b2a8826502acf29e9769c73e1fabb923f4ac11057299cf8fea57a13def
MD5 11b4d45789544050871f75c0fb3b5e3b
SHA1 3362722a15fdd5a67d0c7e1c643c64a3630e89df
SHA512 51854f9a9961224dac3fab303d2e39e0a30d3f52b9d5e561dc07c69950733e6a9c6f585e001a3f9453fe0a7932a74e9b53fea0e87a691787cd11cb009017a794
SSDEEP 96:BOiB7Gv6/36yu2nwXe/82sD8NMfY6uImeKDimJ9EgRlIIWrzDYdGjaITXTv:BOyMIzwXe0Jo2YumedmJ9EgSHYEv
TLSH
T171B18ED918471FB58C0A3C19492BFE1B7979C55294BE3C7299FDDB55407C9288DC8C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ViewLineItemRatingC.png

Path C:\Program Files\iTunes\iTunes.Resources\it.lproj\ViewLineItemRatingC.png
Size 261B
SHA256 5c751b7f4b96d07b22971ea4977566ed88c3297ab7d0b2853e7e9baec00be1a7
MD5 71062ebf3a5a9b5c578387aabb2e7fd3
SHA1 410d43bb43f7ddc7ee7cc225963303326485bc0a
SHA512 0ad45440a3e77a4ea2d1ebc8531c91fcd663e596a90f5cdf1d0a57384c54d988c0759dff51f5231d973f9886c80c16feecfc16da84579a0cad53ba70b984a865
TLSH
T1D5D095C34614F55FC90F563549E2554DBB3A8D61161B0D48A52AD46E6F487C2DDC0790
MD5 SHA1 SHA512 TLSH

Submit Download

ViewLineItemRatingC_dark.png

Path C:\Program Files\iTunes\iTunes.Resources\ms.lproj\ViewLineItemRatingC_dark.png
Size 241B
SHA256 befb8ccb14ff090ad56345786c9f367a8cb2d14516ccb52dcda123df5e5dfbe4
MD5 b52bc951d0c8f8dae4329368388dbb76
SHA1 ae408ee6f2d946aaddb8be466f7de2b99c7c4c58
SHA512 144de7bcef6fc1be493229c84c2038e2c6b6719c5ceba95d7abbc14539c5222a3bd1e65eb00e0c0f3bfbe6e0be4ddbc9d2876dcfdb9f1b3372cd3361d7f58d98
TLSH
T100D0975319206AE3E0C696330C1A2ADCBE76243B0626298C0E0ED02CDE00B4CAB82622
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\nb.lproj\[email protected]
Size 948B
SHA256 f1b5cce0aece4f65441bb7cbbf86155ad2d4e90b8bbba8252de985ae02d751a5
MD5 c6beffb1568071b2fab6f19bb9c875c2
SHA1 137ada0e83cce6b784a8d4f345430c28d61944a3
SHA512 a1e811646642fbfd11ae794e7c764a3bff39e285f1724deddbf9ed516cfa7929e8ce10611b9d0cc11f6c1944728f4aedca99df5badc72f2878209c3d24b28758
TLSH
T14F11C87204B2CE9055C204170FBAD599DA168BF458E76737500AAEF3F9ED9026474381
MD5 SHA1 SHA512 TLSH

Submit Download

SortPrefixes.plist

Path C:\Program Files\iTunes\iTunes.Resources\pl.lproj\SortPrefixes.plist
Size 310B
SHA256 800cb75b9347c5142edc9094c9c829b10b6a280271f19e8ef3b4673a1cc48484
MD5 e4f62c535e191b6d40912f32c60e1eff
SHA1 37203bd8a250fb9b7471e1a4b8b2dd4f727aca2a
SHA512 2b64834f62de68efc971bf59e36d7cc0a29c3e7dc4c2c987ae6840488f6fb94e88ca73276fd0968f2f6b68d427a5f87a97faa0821f0cefb533deab38a58f3630
TLSH
T13FE072840A0CBC2E0CC416830BB9906C03C2C3AE8CB000FEF5E34C99AE0B1516370AAE
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\pl.lproj\[email protected]
Size 9KB
SHA256 f533c5ca2a6bdcd1a9c7f757c0c9a17d894b2717c3493bd7ced8f36a722eecc3
MD5 010e5869f100573199acf50905ba17b3
SHA1 da950fbeb52dea27dc393ad4a113422238bd6002
SHA512 83c30c0291ce0540a41f07a6566eab12b784efe5a7a8dabe29dee67fdfdc0e53e89026511476d0abd46a267bda76e179892a249be46619c7b6fd621d1ce753ca
SSDEEP 192:yoONgOLPXsAYn3J6HaGkRz+Oiq5BHgootZosxmaG09G3XPArJbgxK5yXrds6J:vOWOLv5q/GkRC3saosIFPAryx/rdsc
TLSH
T1FF12BF32756F32A01B377A0F4E24CE0209950662913527FD2AE51E32A5CF886B1D9C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParentalAdvisory.png

Path C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ParentalAdvisory.png
Size 5KB
SHA256 041204ca5fb90b0d19d0f8b5bae858bf4022d9c794990e8fa4a0bc7eae093ed7
MD5 d947d2a1018ae12438bc118af0a04215
SHA1 c816253a5341d804712b8fe00967cbc887f99907
SHA512 bf7192cd4f137311d4696a0dfcb5fec66df5ad45e301fff3f8d4104163b0c64d8abf2b2d3f4100802f75aa55b435cc890005d5836c1350702473b0359add46a8
SSDEEP 96:Ikfh9sbFFV55/hYIL1Bi/F3xhXk+EgHnU4oLQIAof6gjTtkt43J:XYXV55/hYIZBitBhUbCnU4oEdcuO
TLSH
T1D2B18E13D9228016C5B41B25D32C6624A49683F38443E24FB42C677B9AB24F2FF1676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ViewLineItemRatingC.png

Path C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemRatingC.png
Size 662B
SHA256 ec0e0c2e51cf0c587bd8cd8842682ed78becd0cdb76ba06cb1c8cc1d98c710c1
MD5 471584f30a8dbce0f8e4ab7a781d3705
SHA1 1d4ec7b6ad3ae1ccd48056c84d05f2d684db85b5
SHA512 b6370cdbf9430cccb041c21641409e43bfd2a1b78836ee38fd0a706f26623ea1cc84e645fe6b501fed06b4222173055c101bee5de2cdd012c0cf5451cd3031d5
TLSH
T1FF0183C785D26067C2DA9F3FBF65F28284704533E8A43D14205DA3F0AA48A57CC8C558
MD5 SHA1 SHA512 TLSH

Submit Download

ViewLineItemiTunesExtras_dark.png

Path C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemiTunesExtras_dark.png
Size 622B
SHA256 096343c9ddc34fead4232f182085ceba66907446657257969f3916ba991eb58d
MD5 589bbd384b604e83cadeba1d59f8fd90
SHA1 ee6fe62fb935e9f1007f31eea754e3cdc315d022
SHA512 369b8d35ee411971f1dfd02fa065ce2badca714a0046cd26d098c15a8f55185178206516a62de59f81bfd285d4a8804a29b64d98f51f4e4a543bdb2eea993736
TLSH
T130F002D119C4899FCC647536216AC3A2796B8117EA7D945CA5E0D0565D1B538CC8B503
MD5 SHA1 SHA512 TLSH

Submit Download

DeviceCapacityBox.png

Path C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\DeviceCapacityBox.png
Size 10KB
SHA256 f930036e7cae52b4022d979fdd6274d8604ca4c7e6f14495223dd78c17bc19a7
MD5 8246496c258d58712c0a972bece0d69a
SHA1 65f4a403895354702552e2769cfe7f480a70ea6f
SHA512 b1dc4bfc186762e414ece274b158f10fefaa86ec373c732c804381733a7c17cd56e27331ca7381e7e9fb795c04a4a09ac75642684f36f99d4c2ae2871dd8d447
SSDEEP 192:whGTF2+n5Dk9Ijn6ICVncfLGUm7C/UWMWFwzPjjllUMWETrj7MDVgp5:H0+n3j3an2G6/UfZPHAMWy7Mpgp5
TLSH
T1C522B07DA2915E701F0C8A8058B9A635613EC9D15FBAF8D42C6F688C3C7B0D5D43D5D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\ro.lproj\[email protected]
Size 1KB
SHA256 dae1592358924b99a4363cf20fc4a6dbcaeffb5af2f7a248a0fb687e95336597
MD5 6cf4cedb6b5148b103fc91a2d057888d
SHA1 23e873c7d60c21248eb9f8381643a295dc4fb12a
SHA512 4847a96925aa568c6d523f84e760b35d0f4abad4b6df70c3ed6003289b776b3327bbc41dda3da96221113e41b0097a2275db5bc562c77117db6c04e4275fc583
TLSH
T19631080EF8798443C3519664BB97A154FC2CC2911F3EAA38DCAEE217CD91B9349C4BD1
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]
Size 25KB
SHA256 efab63103f90135001658bac9c8724da424e81fc05c9385953a7555c6ce1ace3
MD5 784f871663195e678f524f4aefccc28a
SHA1 ee8a70134370ce17ce49bb31e92cff252958d202
SHA512 7e1b0f1f74abd674b09443b835da35b9b1855a0d7ac15e60670c6d3ffa1059fb13ccc579f069e444d073be0da76b65b4dc1d517c2ffef654a99ba9143fda6f7b
SSDEEP 384:rjOhR2PHN1n/k6HXU3RjOtQt4SQOQTdNpfOWpVExByTPFA12ipv/li:rjQROtmEXU3jtPvMdNxpKxUT+2ih/Q
TLSH
T12AC2E123E8F939332106B1E259CFDC6117D64DDDE485B22D2E8BA0F7A207391B66D852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasteredForiTunes.png

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\MasteredForiTunes.png
Size 2KB
SHA256 95f0affa39a202e292a5f630a2524c8de31b6478304e040ef06488d9dd1e9f0a
MD5 67f1b4232079935a9998b0395a6b7c10
SHA1 ac4bfc88ed92cb526720f9cc9b4a377ae6a7a787
SHA512 410e56ec048d2033e7e05202fc09575758d5c5e441146bd89070106108f1332e3ed3b8868238c78f18c0d641898607ecf1c704f51234d741f0693868966b0219
TLSH
T18D512C0298739DDFC29541730AE954716A35D571761991B6A7239581A389CABF03CF03
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]
Size 8KB
SHA256 6f231775671c67eaa458a6a2d1405f3e5c52d56882f5620aa435166f4bfb7529
MD5 d9eb252906d8d98e592ef01034a94c76
SHA1 5fd847136846bba1957e2ace9e1d3ec482de2e5a
SHA512 7bd132759532496ca864cfff7ad411ff48e3d2a9ab28e3b50afdabe5782d853da52a09f093b25c0d7c60906ce42ae8a28634df363fc6a435962dfdf3ae9faa71
SSDEEP 192:WYPitmvG8MoxzelQqPJ14rZdGw4m+pcOEg98x8e+gTqqci:Wxd81xzAQqPJ14rZd34HWOEg98x+gTF
TLSH
T1F702BF52E1146F006F4A13AFA0F496622DEF1761E204393C7BA16094E9846C2758B9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\sv.lproj\[email protected]
Size 1KB
SHA256 55617519bf037182dc93082300e162933c3771996607aeb605079bb834a182ef
MD5 e85fcfa0b73018404b29d4fa04f047a8
SHA1 2c7ba150c3fd101231563ffec9a7fd5ec5ae02a0
SHA512 141c92030b58dea61e29020b1792cc2a8dafd306af2a9130b105721a026b81a05d0d1621d4a76f6b6e5509dfffd47506885579279b6a098130b542df60b0f884
TLSH
T12D2108DFC9565316818112125BF33CE1F7AC90100E90FDA46E10C84BA4146BFDBA7A8D
MD5 SHA1 SHA512 TLSH

Submit Download

ViewLineItemRatingE.png

Path C:\Program Files\iTunes\iTunes.Resources\tr.lproj\ViewLineItemRatingE.png
Size 226B
SHA256 1c28554bca95dba35ce291c0a42e0810e2ceebe805d63f916b6b7505e057752e
MD5 18109ed593d861bd659055a5bd9db831
SHA1 3b2596e909633ca509e857650d7d7c9693987a4c
SHA512 1b8bb8ce363f7b5db7fe6648f518d0d528cb47bc90f5c80e66d8928b79f7912879b1c35ec6944d9ff91cb70c84547b9e46758cdd315e299453016da3cc24bed9
TLSH
T11DD097E38148A93BC20E6A1E00E3420DAF36942153390D84B058D02B480874891622B0
MD5 SHA1 SHA512 TLSH

Submit Download

StoreBlankBuyButton.png

Path C:\Program Files\iTunes\iTunes.Resources\vi.lproj\StoreBlankBuyButton.png
Size 3KB
SHA256 51edab4204721531caab3a704e86d54445db4b4ddca70ef2c4b1012fa6bb3d5f
MD5 ceeb4e2a8deb651b69a973f5d671d92f
SHA1 3fff59aa350cdd2cfea69c08b55540b63122bf26
SHA512 9112040b761b90b93e89249986e6e75d55038fc1537293d7eadd02e181effd601ea15aff7a3100cf2c72de610b8b4cfefb433ae8bd75499e4a3dbbccf8410493
TLSH
T1F2815C27A411042895E9471ACA287A25D06E13E1C94F947CD00C4BBFD3784D5FB2D77B
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]
Size 386B
SHA256 8acad76c6c4eb0c023664b845a7492adc2e418cefa48aba7e99496125a06e5cf
MD5 ff602a53d097a0d42fae257d6cd2fcac
SHA1 57ed476c7c88b7c231ec9e4d6acbd5c04808d78c
SHA512 a5f0d07314040fdbc614d09e2d38bf87ad0a1286c472f8c7403dd488488124e769d436ec1b01ff1b47825455f03aafadcac5722f4367fcdefb13ec3de0ec8def
TLSH
T10BE0AB4289A18498C68301A7722621109EBB5D1193BA3C48961DC708510524E41A2722
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\zh_CN.lproj\[email protected]
Size 314B
SHA256 f5f639656493f65e4a5462f6c4e280fdd54a7a4e839c2c0f52c8b5b1840fdab2
MD5 755eb418266342b17633f1615a1882b0
SHA1 df51fddb36717426da15d38f4edd48f74c140364
SHA512 8bd4b9879f1899c2a5e5f9de80897882f262252260c69767365634f9a97e281020176613c58a9d22ffcb510f1cce66dcf26903092c455d7b17f951ba0876f116
TLSH
T199E07DAA22007DECD40A933741A348F0E632C422B97549DBB465E42D5E2870D8599308
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\[email protected]
Size 416B
SHA256 0775705d7637f7173ec31f22e324af8160b43d4cc6a47a2f199b3751963252b5
MD5 e14f8e390a9c489b10eb23306d27824a
SHA1 e33831e12fa5092ca15e7d8af7b01afed996b30c
SHA512 63c3e261ea445de5d7eaab326e0168db054b4d953e81f89f16446a1ef5170a96aa32db5d7cf42181f990a8028e9a67764885a6d94f74d1d1c9910dcebc4f8a4d
TLSH
T134E023406788385EE304362A2997480CB8B2059161695C6C145BFC2C1524F8C44A5701
MD5 SHA1 SHA512 TLSH

Submit Download

iTunes.exe

Path C:\Program Files\iTunes\iTunes.exe
Size 37.1MB
SHA256 c69e719cd3f2f9374e71c954a6de87002b6988af65129943983a2f17490dd73c
MD5 d8ab57178e4743ffc37399aa8d9b8bad
SHA1 3bcae089da7fdf7de8cc2e5013b1344bb1ee0172
SHA512 350b214ea60a50bda92de9d71902f69769e0d8a431efa10b6a61429d709cedc09abc1f13a11520b8ee6621119edab5a81219f7173f5761f6957d27de166f880a
SSDEEP 393216:WNuc94NEbcgMf/IrgOQy3R2LsdEtmooIT27bJoEj2+UY3QBy6iZBt9o:WGybJon+fz9o
TLSH
T12F877C9362A104D1E095C0BACE2AD813DBB178BA1731C7CF0590F9AB5FB79F15DBA211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iTunes.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk
Size 1KB
SHA256 8bf268799649fea384b79fb8105c83e039007c21970203910dcda77e04ef6ea8
MD5 e937805caa9d388524227fa9fe3d0fd3
SHA1 cd9d957bb5c5d1d197e4b54f6aea4bc31ff151ac
SHA512 31e80b67d627798f8c7919590058a722a7654fd475ebe0460afdbb5e7eb6f54c94b8b0ceb422871a7dae3c80bd51eb009e3d995e131416575d2260129f4548d4
TLSH
T1E441C15D7AC51737E3F27B3D2AB1452596237C07F9204F2D45CA418418A0550ACB9EBA
MD5 SHA1 SHA512 TLSH

Submit Download

iTunes.lnk~RFe5a9210.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk~RFe5a9210.TMP
Size 1KB
SHA256 d47bb238be7f55d7fffc2e8f81bc60c50164d519ccd2ee2cac35ac18bb19d2bc
MD5 2b1eb848ed77f5ec2a551518eb0952e0
SHA1 28b0ac4db074d6e44f03daba921d5a706d746f40
SHA512 83b50ebb31da5a00e7d08d2f464871316c29cc24af1daf1a6355b69da25d1aac518b3334f71a440ad8063ac34279dde90dd28482bb52cff9a88d601c8cf19fcd
TLSH
T11531D05D6AC50B37E3F2BB3D2AB1452597337C03F9204F2D46CA418414A0990BCB9EBA
MD5 SHA1 SHA512 TLSH

Submit Download

AppleMobileDeviceSupport64.msi

Path C:\Users\Admin\AppData\Local\Temp\IXP155.TMP\AppleMobileDeviceSupport64.msi
Size 32.8MB
SHA256 b4ce042947e9d72c0d7eb2d0d719408d45c932694ee0920680db0dc638d79adb
MD5 0647e26a36e8f28ddb1b1ef9f21733b4
SHA1 5cfe32e79a36433dd87425195ddc07fb23ad7580
SHA512 d8b1329082d3251508d2338b1a0ac7fe06fdb27e10f2b6612de2ed64c77de4ea4958d9d4b84612c2c88c845617965c7049bbe1c2eb890f15190d10d8443f6a30
SSDEEP 786432:3aqI/TbZYhB/TdjiAvLgxUukUHD+C+qKnuM35R+z0wDX6v9yQ:3JILbZYvxjik2UukQ+T3z+zn4
TLSH
T176773301BA52C9BBDA9F1274885BEB284377DD24EB61C50F6158F6190DF33E012FA64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupAdmin.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP155.TMP\SetupAdmin.exe
Size 162KB
SHA256 f43dc49da5dea16d1d58cab0983657b8ed60b4514905be62f7cd1e95fc7f0da2
MD5 89dcc52378ad700aaa4083fae914cfb4
SHA1 139475bd57e9ba1732caf01181886bd9e169252a
SHA512 1c033d667be29a278092c12484b5efb14843b8e30deeb1bd4cc17543647456f81011545672651f9f894767315fc4a050d4b2f6c9dd76eae9d011013f5f112d16
SSDEEP 3072:2Njy1wujBE+BJ6kqX6IipaNpQOX8/IZXGO5fsiUjDz24woW:z1nH6kxIi6QOA02iUPz2p
TLSH
T1D1F37C01F9D08032E87769302974DA758A3DFD704F649ADB73CC55BAAF202C1AA35A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI300F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI300F.tmp
Size 206KB
SHA256 ed6c5b33d79f640fdf002905f500df0be242dc5e7346ac333d456789ee4d9254
MD5 10a28b8b03793b479d77ab534c307019
SHA1 08ac05620accf3c11dbbad9e27ac8bf9d0768d10
SHA512 702fdade14c96ca2c64ec79c5a3c3d1fb3561fdb00f93c845d4994cac9ebb3348e631bda6ff3272926d7db52db1381e4d1e5b78e4d9618022f300685b0ab328c
SSDEEP 3072:1aoiAjTGzelK8Fxws9LaQcSgMNn8hCQ/Qc0rv+ip21Uvt4OYyo:1Xiq2oBFOGbhNpEio1Uq
TLSH
T1EA246C55B7E500BAEC73963489A35606EA727C051B70DADF0360437ADF2B7D0A93EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5A0D.tmp

Path C:\Windows\Installer\MSI5A0D.tmp
Size 137KB
SHA256 2443a7966803dbdf1bd0863ac7b2fbf9b86ba4b3c340515e511c18087bb4a2d2
MD5 ba0cd9b41a8f0f87e1925855f386b471
SHA1 e4bf39f6241f640636cb54ee56400c9f10345d6a
SHA512 437b25805a9da06d1575579afbf1a6fb7fd7c9ba1c35c71bd566a7ca8a77beed46a99018a71c938419ba585935c5990b958878f328b411f95f990b01db78b83d
SSDEEP 3072:frnybbBcg24OoAnBa2u8N3tcqn0vg2CVSWEijaQj3H5oC:biOgOoADuWcKsC0FQj
TLSH
T137D39D11B9D0C432D4AF1C381874DA315F7E7930DF6099DB7398427A5FB02D1AE3AA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI71C1.tmp

Path C:\Windows\Installer\MSI71C1.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI904E.tmp

Path C:\Windows\Installer\MSI904E.tmp
Size 149KB
SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
MD5 8eabeadadc6d03c9807787af28381b65
SHA1 b5015709fb98a8a849a0440c54c07c394e89bc59
SHA512 18ddec2d28640108faf5a4b9878cc0e6224fdc6ee26bd9fcfc2c972d0ea82a21468181c6fcc3413a99e2a9bc070e71d41c998528a324eee93ee1b59351b6f037
SSDEEP 3072:CJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPu:CJdLT1jXZ/H1dRxt
TLSH
T171E3AE01B1D08072DABF193A5434DA725F3FB9209F508ADB53988A7D9E702C09E76B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-466-0x0000021F4B2F0000-0x0000021F4B324000-memory.dmp

Download