Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/05/2024, 10:41
240515-mq534sde5y 815/05/2024, 10:29
240515-mjl2nadd29 715/05/2024, 10:22
240515-mefdbach6z 7Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
Zulu2021_x64_ru.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
Zulu2021_x64_ru.exe
-
Size
286.0MB
-
MD5
bc34b12d23bb0ece6d8dabb39b3660bd
-
SHA1
92b5b62989f6a8a7e7ee7d2875440f2ed1dfc8e9
-
SHA256
be9abebaebdf278b74184f318cd474b64ef0b95cd3fc09e490c3f785c8b26261
-
SHA512
29885117c1293e0b2da6e92209b996d6bce9e5a85522c6dd4029b47703dad8bfd74b83d8833d20c6afd3b431128a2340c3c3ca554e94e3716a3c7010a2a0ce3f
-
SSDEEP
6291456:xcu6yi759eECcJrCzfLUKw34AuY6QEA6x8D3JrfRqvzhVmAqUum46Jw:xcu6zeEC+rCjLdw3H6QRdD3Jr5qvV49n
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation Zulu2021_x64_ru.exe -
Executes dropped EXE 3 IoCs
pid Process 636 Zulu2021_x64_ru.exe 4304 Zulu2021.exe 1120 sqlwriter.exe -
Loads dropped DLL 25 IoCs
pid Process 636 Zulu2021_x64_ru.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 4192 MsiExec.exe 4192 MsiExec.exe 4192 MsiExec.exe 1120 sqlwriter.exe 3204 MsiExec.exe 3204 MsiExec.exe 3204 MsiExec.exe 3204 MsiExec.exe 3204 MsiExec.exe 2284 MsiExec.exe 4584 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 1284 MsiExec.exe 1284 MsiExec.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507509-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125070D2-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250748A-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507349-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\Zb.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070F1-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250744D-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507223-0B01-11D2-B55D-444553540000}\LocalServer32\ = "\"C:\\Program Files\\ZuluGIS\\Zulu.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507025-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250709A-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250709C-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507522-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125073A3-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\Zb.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B72F-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluChrt.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507502-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507349-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507129-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B959-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\zuluui.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070C6-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070D0-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B730-873C-11D3-BF56-D212EB700DCD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250746E-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507136-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507431-11DD-4DDC-AFDA-3007DB024F4D}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0C937-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B72D-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070E7-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250713C-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250712B-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507094-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070A8-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070C0-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070B8-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507123-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250713C-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B72F-873C-11D3-BF56-D212EB700DCD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507094-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0C962-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluImpExp.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250744D-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125073B8-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507454-11DD-4DDC-AFDA-3007DB025F4D}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B928-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B92C-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250744B-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507363-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\Zb.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125070E7-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507363-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507139-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507520-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\SQL Debugging\\ssdebugps.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070A0-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070A4-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507023-0B01-11D2-B55D-444553540000}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507090-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507475-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507363-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507454-11DD-4DDC-AFDA-3007DB025F4D}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507436-11DD-4DDC-AFDA-3007DB024F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507520-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125070B2-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507418-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125073B8-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{6285a7b3-4df9-4b69-a086-a6976bac603e} = "\"C:\\ProgramData\\Package Cache\\{6285a7b3-4df9-4b69-a086-a6976bac603e}\\Zulu2021.exe\" /burn.runonce" Zulu2021.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: Zulu2021.exe File opened (read-only) \??\H: Zulu2021.exe File opened (read-only) \??\X: Zulu2021.exe File opened (read-only) \??\K: Zulu2021.exe File opened (read-only) \??\P: Zulu2021.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: Zulu2021.exe File opened (read-only) \??\L: Zulu2021.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: Zulu2021.exe File opened (read-only) \??\N: Zulu2021.exe File opened (read-only) \??\U: Zulu2021.exe File opened (read-only) \??\Y: Zulu2021.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: Zulu2021.exe File opened (read-only) \??\O: Zulu2021.exe File opened (read-only) \??\Q: Zulu2021.exe File opened (read-only) \??\V: Zulu2021.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: Zulu2021.exe File opened (read-only) \??\T: Zulu2021.exe File opened (read-only) \??\Z: Zulu2021.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: Zulu2021.exe File opened (read-only) \??\J: Zulu2021.exe File opened (read-only) \??\R: Zulu2021.exe File opened (read-only) \??\S: Zulu2021.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: Zulu2021.exe -
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\sqlncli11.dll msiexec.exe File created C:\Windows\system32\sqlncli11.dll msiexec.exe File created C:\Windows\system32\SqlServerSpatial110.dll msiexec.exe File created C:\Windows\SysWOW64\1033\s11ch_sqlncli.chm msiexec.exe File created C:\Windows\SysWOW64\1049\s11ch_sqlncli.chm msiexec.exe File created C:\Windows\system32\1049\s11ch_sqlncli.chm msiexec.exe File created C:\Windows\system32\1049\sqlnclir11.rll msiexec.exe File created C:\Windows\system32\1033\s11ch_sqlncli.chm msiexec.exe File created C:\Windows\SysWOW64\1033\sqlnclir11.rll msiexec.exe File created C:\Windows\SysWOW64\1049\sqlnclir11.rll msiexec.exe File created C:\Windows\system32\1033\sqlnclir11.rll msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz_n\Doma.zsx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamDevices\par.d02 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamPipe\par.d02 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamNetwork\par.d12 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\water-polygon.b05 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0002.b07 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\building-polygon.d00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz_v\Gaz.zx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\teplosam.b06 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Drain\Sample2\drain2_zt.tl msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz\Gaz.l00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz_v\Doma.b01 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Ctp\grafik5.pzc msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamDevices\par.b03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamDevices\par.d11 msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\XPStar.dll msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\License Terms\License_SqlLocalDB_1033.txt msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Drain\Sample1\drain_zt.n01 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Quart.b03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\water-polygon.b08 msiexec.exe File created C:\Program Files\ZuluGIS\Plug-Ins\Politerm\ZuluHydro.plugin msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\Templates\mastlog.ldf msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Nasos\Doma.zx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamNetwork\Steam.zmp msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Thermogram\teplo.d09 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Nasos\teploNS.d04 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Kvartal\voda.d00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Sample1\water supply.d03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Thermogram\building.b04 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Quart.b01 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Teplo\Teplo.b04 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\teplosam.b08 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Simple\Test.zsx msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\opends60.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0001.b02 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\teplosam_rezerv.zx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Kvartal\voda.lnn msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0003.b08 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\poi-polygon.zx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz\Gaz.d03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Thermogram\teplo.b00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Teplo\Teplo.d00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Kvartal\voda.b03 msiexec.exe File created C:\Program Files\ZuluGIS\lang\ZuluImpExp.en.lang msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\BOUNDARY-POLYGON.sqlite msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\highway-line.zx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\building-polygon.b09 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\FLOOR.ZMP msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\railway-line.b07 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Ctp\seti_Len.d10 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Basic\VODA.b08 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Kvartal\voda.d10 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0001.b03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\TEPLO\ARM_T_UZ.b08 msiexec.exe File created C:\Program Files\ZuluGIS\Plug-Ins\Politerm\ZuluThermo.plugin msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\ru\sqlaccess.resources.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\landuse-polygon.b02 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Simple\Test.b06 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Thermogram\building.t00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamDevices\Objects.zmp msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Ctp\seti_Len.b01 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Thermogram\thermogram.zrs msiexec.exe File created C:\Program Files\ZuluGIS\zscript.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0002.d00 msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{EB735827-4E9E-4BD2-8AAD-282E7DDEB473}\Company.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIE57E.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140enu.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{EB735827-4E9E-4BD2-8AAD-282E7DDEB473}\Company.ico msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcp100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140kor.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140fra.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_atl100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File opened for modification C:\Windows\Installer\MSIEB0F.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140enu.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{51AFA61B-AD01-4317-8AB2-5E512F3F80D7}\ARPIco msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140cht.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\SourceHash{D2E73B88-A0B8-42EB-A918-488B0F7E0679} msiexec.exe File created C:\Windows\assembly\tmp\7T96PTE8\Zulu.Interop.zuluui.dll msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D msiexec.exe File opened for modification C:\Windows\Installer\MSICD7A.tmp msiexec.exe File created C:\Windows\assembly\tmp\CQZC9T09\Zulu.Interop.Zulu.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D msiexec.exe File opened for modification C:\Windows\Installer\MSIDC52.tmp msiexec.exe File opened for modification C:\Windows\Installer\{D2E73B88-A0B8-42EB-A918-488B0F7E0679}\ARPIco msiexec.exe File opened for modification C:\Windows\Installer\MSIC787.tmp msiexec.exe File created C:\Windows\assembly\tmp\ZRCRDVEM\Microsoft.SqlServer.Types.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIDB77.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE3D5.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\B16AFA1510DA7134A82BE515F2F3087D msiexec.exe File opened for modification C:\Windows\Installer\MSIA8E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140esn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIC7E6.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140ita.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\e57c4c7.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001 msiexec.exe File opened for modification C:\Windows\Installer\MSI9C4B.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcr100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140cht.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sort00060101.dll msiexec.exe File created C:\Windows\assembly\tmp\CDG4G37G\Zulu.Interop.Zb.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140ita.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIC67C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICCAC.tmp msiexec.exe File created C:\Windows\Installer\{D2E73B88-A0B8-42EB-A918-488B0F7E0679}\ARPIco msiexec.exe File created C:\Windows\assembly\tmp\OSC31135\Zulu.Interop.ZuluComNetOcx.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140chs.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIE65A.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57c4d1.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140fra.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140jpn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000073c7eb973396fb40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000073c7eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900073c7eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d073c7eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000073c7eb900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507025-0B01-11D2-B55D-444553540000}\ = "ZuluLib.Layer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZuluLib.ExcludeSymbolsParams\ = "ZuluLib.ExcludeSymbolsParams" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507377-0B01-11D2-B55D-444553540000}\ = "IZbTableRefs" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0C962-873C-11D3-BF56-D212EB700DCD}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\zulu.zrsfile\shell\open\ddeexec msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507139-0B01-11D2-B55D-444553540000}\Version msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125070E5-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507139-0B01-11D2-B55D-444553540000}\Implemented Categories\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30C0B73C-873C-11D3-BF56-D212EB700DCD}\TypeLib\Version = "8.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1250750A-11DD-4DDC-AFDA-3007DB025F4D}\ = "IZCNPiezoCtrl" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507080-0B01-11D2-B55D-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125070B3-0B01-11D2-B55D-444553540000}\ = "ISymbolElements" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZuluLib.PrintLayout\CLSID\ = "{125074DF-11DD-4DDC-AFDA-3007DB025F4D}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.Chart.Document.7\NotInsertable\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\ = "SQLNCLI11 Enumerator" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125070D7-0B01-11D2-B55D-444553540000}\TypeLib\ = "{12507020-0B01-11D2-B55D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507349-0B01-11D2-B55D-444553540000}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507524-11DD-4DDC-AFDA-3007DB025F4D}\TypeLib\ = "{12507500-11DD-4DDC-AFDA-3007DB025F4D}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6285a7b3-4df9-4b69-a086-a6976bac603e}\Dependents\{6285a7b3-4df9-4b69-a086-a6976bac603e} Zulu2021.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{125070DB-0B01-11D2-B55D-444553540000} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507384-0B01-11D2-B55D-444553540000}\ = "IZbForms" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\zulu.zrpfile\shell\open\ddeexec\ifexec msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zulu.ztmfile\DefaultIcon\ = "\"C:\\Program Files\\ZuluGIS\\Zulu.exe\",8" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B92C-873C-11D3-BF56-D212EB700DCD}\Version\ = "8.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507073-0B01-11D2-B55D-444553540000}\TypeLib\Version = "a.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1250737C-0B01-11D2-B55D-444553540000}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125073B8-0B01-11D2-B55D-444553540000}\ProgID\ = "Zb.ZbBlob" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30C0C927-873C-11D3-BF56-D212EB700DCD}\ = "ILegendCtrlEvents" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30C0B71B-873C-11D3-BF56-D212EB700DCD}\ = "ICurveSets" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.Chart.PpgChartGrid\CurVer\ = "Zulu.Chart.PpgChartGrid" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZuluLib.ZPoint\ = "ZuluLib.ZPoint" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125074DB-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507348-0B01-11D2-B55D-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250750F-11DD-4DDC-AFDA-3007DB025F4D}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125070E6-0B01-11D2-B55D-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507093-0B01-11D2-B55D-444553540000}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507413-11DD-4DDC-AFDA-3007DB025F4D} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250751C-11DD-4DDC-AFDA-3007DB025F4D} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B92C-873C-11D3-BF56-D212EB700DCD}\Version msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1250702C-0B01-11D2-B55D-444553540000}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507391-0B01-11D2-B55D-444553540000}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B928-873C-11D3-BF56-D212EB700DCD}\Control msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250747B-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125073A3-0B01-11D2-B55D-444553540000} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.Report.MapLegend\ = "Zulu.Report.MapLegend" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0C939-873C-11D3-BF56-D212EB700DCD} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B730-873C-11D3-BF56-D212EB700DCD}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507026-0B01-11D2-B55D-444553540000} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507481-11DD-4DDC-AFDA-3007DB025F4D} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507099-0B01-11D2-B55D-444553540000}\TypeLib\ = "{12507020-0B01-11D2-B55D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125074DD-0B01-11D2-B55D-444553540000}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0C928-873C-11D3-BF56-D212EB700DCD}\ToolboxBitmap32\ = "C:\\Program Files\\ZuluGIS\\zulurep.dll, 248" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507122-0B01-11D2-B55D-444553540000}\TypeLib\ = "{12507120-0B01-11D2-B55D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B930-873C-11D3-BF56-D212EB700DCD}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.b05\ = "zulu.b0xfile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZuluOcx.ZuluCommDlg.1\CLSID\ = "{12507136-0B01-11D2-B55D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12507220-0B01-11D2-B55D-444553540000}\a.0\ = "ZuluGIS 2021 Application" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\zulu.zlfile\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30C0B71A-873C-11D3-BF56-D212EB700DCD}\ = "ICurveSet" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B72A-873C-11D3-BF56-D212EB700DCD}\DataFormats\GetSet\1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\ProgID\ = "MSSQL.VDI.Client.2" msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4312 msiexec.exe 4312 msiexec.exe 4312 msiexec.exe 4312 msiexec.exe 4312 msiexec.exe 4312 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2132 vssvc.exe Token: SeRestorePrivilege 2132 vssvc.exe Token: SeAuditPrivilege 2132 vssvc.exe Token: SeShutdownPrivilege 4304 Zulu2021.exe Token: SeIncreaseQuotaPrivilege 4304 Zulu2021.exe Token: SeSecurityPrivilege 4312 msiexec.exe Token: SeCreateTokenPrivilege 4304 Zulu2021.exe Token: SeAssignPrimaryTokenPrivilege 4304 Zulu2021.exe Token: SeLockMemoryPrivilege 4304 Zulu2021.exe Token: SeIncreaseQuotaPrivilege 4304 Zulu2021.exe Token: SeMachineAccountPrivilege 4304 Zulu2021.exe Token: SeTcbPrivilege 4304 Zulu2021.exe Token: SeSecurityPrivilege 4304 Zulu2021.exe Token: SeTakeOwnershipPrivilege 4304 Zulu2021.exe Token: SeLoadDriverPrivilege 4304 Zulu2021.exe Token: SeSystemProfilePrivilege 4304 Zulu2021.exe Token: SeSystemtimePrivilege 4304 Zulu2021.exe Token: SeProfSingleProcessPrivilege 4304 Zulu2021.exe Token: SeIncBasePriorityPrivilege 4304 Zulu2021.exe Token: SeCreatePagefilePrivilege 4304 Zulu2021.exe Token: SeCreatePermanentPrivilege 4304 Zulu2021.exe Token: SeBackupPrivilege 4304 Zulu2021.exe Token: SeRestorePrivilege 4304 Zulu2021.exe Token: SeShutdownPrivilege 4304 Zulu2021.exe Token: SeDebugPrivilege 4304 Zulu2021.exe Token: SeAuditPrivilege 4304 Zulu2021.exe Token: SeSystemEnvironmentPrivilege 4304 Zulu2021.exe Token: SeChangeNotifyPrivilege 4304 Zulu2021.exe Token: SeRemoteShutdownPrivilege 4304 Zulu2021.exe Token: SeUndockPrivilege 4304 Zulu2021.exe Token: SeSyncAgentPrivilege 4304 Zulu2021.exe Token: SeEnableDelegationPrivilege 4304 Zulu2021.exe Token: SeManageVolumePrivilege 4304 Zulu2021.exe Token: SeImpersonatePrivilege 4304 Zulu2021.exe Token: SeCreateGlobalPrivilege 4304 Zulu2021.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 636 Zulu2021_x64_ru.exe 4304 Zulu2021.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3848 wrote to memory of 636 3848 Zulu2021_x64_ru.exe 90 PID 3848 wrote to memory of 636 3848 Zulu2021_x64_ru.exe 90 PID 3848 wrote to memory of 636 3848 Zulu2021_x64_ru.exe 90 PID 636 wrote to memory of 4304 636 Zulu2021_x64_ru.exe 97 PID 636 wrote to memory of 4304 636 Zulu2021_x64_ru.exe 97 PID 636 wrote to memory of 4304 636 Zulu2021_x64_ru.exe 97 PID 4312 wrote to memory of 3252 4312 msiexec.exe 109 PID 4312 wrote to memory of 3252 4312 msiexec.exe 109 PID 4312 wrote to memory of 4192 4312 msiexec.exe 110 PID 4312 wrote to memory of 4192 4312 msiexec.exe 110 PID 4312 wrote to memory of 3204 4312 msiexec.exe 112 PID 4312 wrote to memory of 3204 4312 msiexec.exe 112 PID 4312 wrote to memory of 2284 4312 msiexec.exe 113 PID 4312 wrote to memory of 2284 4312 msiexec.exe 113 PID 4312 wrote to memory of 2284 4312 msiexec.exe 113 PID 4312 wrote to memory of 4584 4312 msiexec.exe 114 PID 4312 wrote to memory of 4584 4312 msiexec.exe 114 PID 4312 wrote to memory of 4940 4312 msiexec.exe 115 PID 4312 wrote to memory of 4940 4312 msiexec.exe 115 PID 4312 wrote to memory of 4940 4312 msiexec.exe 115 PID 4312 wrote to memory of 1284 4312 msiexec.exe 127 PID 4312 wrote to memory of 1284 4312 msiexec.exe 127 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zulu2021_x64_ru.exe"C:\Users\Admin\AppData\Local\Temp\Zulu2021_x64_ru.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\Temp\{523AC4B4-2D26-4712-8432-3B9F9D6383C0}\.cr\Zulu2021_x64_ru.exe"C:\Windows\Temp\{523AC4B4-2D26-4712-8432-3B9F9D6383C0}\.cr\Zulu2021_x64_ru.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Zulu2021_x64_ru.exe" -burn.filehandle.attached=532 -burn.filehandle.self=5402⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\Temp\{A418D533-86D0-45DC-B96A-63817B0C4733}\.be\Zulu2021.exe"C:\Windows\Temp\{A418D533-86D0-45DC-B96A-63817B0C4733}\.be\Zulu2021.exe" -q -burn.elevated BurnPipe.{FB64F5F9-522C-4013-BFF2-B7BF0CC9E686} {D9BA17B2-6A4E-441E-A46E-324E860144A4} 6363⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4304
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:2280
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4DFC5364D70C6CD97E60BC30CE98D9172⤵
- Loads dropped DLL
PID:3252
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F62D86D03DD118D5018BB44094930285 E Global\MSI00002⤵
- Loads dropped DLL
PID:4192
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CDA48919025ADACF09A9C6C484705F6B2⤵
- Loads dropped DLL
PID:3204
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B60A0474D5888E9A81C0D47DEEB12CDA E Global\MSI00002⤵
- Loads dropped DLL
PID:2284
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 75F6D89E9799038DACCEA5636DF38276 E Global\MSI00002⤵
- Loads dropped DLL
PID:4584
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 289BC5E2EFC81134DDA86FCB1DB11656 C2⤵
- Loads dropped DLL
PID:4940
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 495448F6A0F82329631B920934339F0C2⤵
- Loads dropped DLL
PID:1284
-
-
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD52d95feea240be7a43fe33c1e817fa86f
SHA1c0eb648c804f3a89e1f0f8712e54fac669a8469b
SHA256ff9a30f5e4a241b5f0f01d345038a071eb980417788b3b0308f842999c76dba7
SHA512dfb9bbd34fa13d4bc0e51e4079755ee6a973b2f390f1b6e4c2403633f197036f42d98107f99940d783fc130adfa4127dfce27f9a7da359b447bc7216d332a5a9
-
Filesize
144KB
MD5b571f29221a9c8cc889e5ec887dfc61e
SHA12ca34785a86588fa40189e657ef47d73a31a4e88
SHA256fbe345cfcc924662faf2bbc626deaa45e843ec4f00e69a1f66b1b92db9031bd9
SHA5129c87676c0171132e095858349bdac9c560bf1b14ec81a2ed7fd22744f61f3fb23d1ab42618587cf7528498ca717abcfc3ac175000b8c110be14e3bf56daf2b4a
-
Filesize
385KB
MD52b3e731b3ac3f50fc0379b49ed333471
SHA14d9d544b468c621f72eed5a345da5ebc1c51543d
SHA2561e35ab55331fae0a694131482275e7f6cf77cfddb25041c6855183126c3916b9
SHA5128e968e1d74a390014ddeff455b643a32cdfcd277fa08f2b1b4c8d5ca9dd8c086bf1a4b83321d1d046a140136f959b68260a711ad0f0133f38b504a2a05d53c23
-
Filesize
107KB
MD58441e1d4cdae8a41a5dd96c052aa8d43
SHA1c8738e755141fa1a52a8092342479f9ec52ff90f
SHA2564acbd43a522c13a8abec02a1f11e55041c870823935028952a8e071a1bfb8407
SHA512c29e9416a56d6b705412a3007a86f3c471f2a3715e4acd0dbc25c3492b8e32c7d2fb93d9a3b38ca11858a69667a58ccff0626e6d7921812a2586d5a30740b5a9
-
Filesize
1.5MB
MD5a5e4b3ff51cf5b7926d9651908feb666
SHA14ef5d229709e40f3f84e46c3a28341eadbd1a044
SHA25613f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
SHA5120615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
-
Filesize
53KB
MD56573302c5f81eee8954903befeaf0dc3
SHA17f86eddb8da737f95fe650aa1ea017dba267d112
SHA256568bff6c481b0dddc4a0d68df8aee4be704d2883995def17a32f3b7e2985c68c
SHA51218a6e3d30ad25b19631e3a3d894917a4070841a75806146599cb0a29bd11ce35e67386362c5c0d44c589fd69c3b15604c388fd025e06cc2282a54a6332950075
-
Filesize
468KB
MD503c2a9f57ff0a56046c72f6cc8d41ece
SHA1ce34577e048cdc74db4e04737bb660d61c15c757
SHA256f8993b327ec504941cbf20ae3e5aea9b6cee964b905a788b47a0d68be460edbf
SHA51213e7639cbd15da85caa18e650175df5d1f73ffce4cd927635b67ca8e6c492f67a938e8e94b6a9ef3c2a526352ebeff553ebcfcec9e55533a87aa258121984a10
-
Filesize
127KB
MD52e112681b5cf61777fc86d4ff99a9293
SHA14fb920e4b6166c805c9ce9f3ee66fd5966f0d292
SHA256af077ca22268e25833a4aa15e60d64589cba9fb50a7887a1297deb1c71be1803
SHA512e302ad7f54947c2b5705204b5ba0754047ef17b884f1706cfe99e8f4046a42142251732f3a6e9fe12017a536341f8f002a77dbccc97d8dbbe125fa067aa92bb8
-
Filesize
339KB
MD57dd1e153050d338d8480cc48e7e6abe9
SHA1214f0b4991f18979fdb7dd3a1bb9c5d7ebacde92
SHA256318f730fd36230d539c89c9b3e7510fc509377423fadfe59a087fe4a0473dd55
SHA512351180853a047dcdc495b0ed4b25f53780df50680facf4c91adaaa012c42eb13318ec5848291d699a5dbde4fef111ded1f31ddb6974efcd6aee6b95a10fcfe31
-
Filesize
457KB
MD5bacdcfc6cdeaf578bbb559db324f2872
SHA1843f504c83e34c176f2bb68678bd2665c050e230
SHA25654539c5b2259e5fe90c2371600abe4cd3b2e8057fb25ff52f6408e611ddf96c3
SHA5128098a21c133121cfa7a71b0e5b73da0d02f36c5db3fe117f96815763120890642307a2565ec0e15cad148898165bc4ba78346a0332ff75751c4e07a2120ff8b3
-
Filesize
55B
MD50ab8bac388159d1b920aeec7a49c93ef
SHA112205fcafdd935f4c71fcd90fffb50bad3d22565
SHA256b49d2a3d6714a9ce670ee76500f9d44b94e6b6d171150595eb8f285705f291ea
SHA5121e272123fe3dfcc3e7d30120d9f06688532a802b34faf14faed02a33d0eaf35d7a1163a3d94f7d6569e8b43e09ce92325c1785333f2eb96dea31caea110cdeba
-
Filesize
26KB
MD5cc9791ab71953156fdbe2b084a956527
SHA11acb05465f7ce00ea527920e262605fbbd8f3fc7
SHA2562c1e5a602d3223701a298d5b0773398764b5007c3c794fb112c5fee47953511d
SHA512b1cbf53dedab47496836f62267b0787e64288043bb9ee3f05f5885c0479a5899c5b63525d9e201793f87d572cbeddefcc512d309bad6dc9f08e95b1daaf2683c
-
Filesize
65KB
MD5cd315edd9ed6c69231c975b5951fe1fe
SHA10b6724cddf3e8e734342889c0114021f35e62210
SHA256d00fc04f0cef268395b1b70ead71fac3d5ab88dc2d0d4efa246459c1ea3532a2
SHA512a397d12eef734612f08b042650e4974de38c675dce29bb842acd76d3dcd2853e76543a86b3f5be14d5c126a73f1a826ca8ff5603bb01c462665ff0d2d80b1582
-
Filesize
4KB
MD5b7b2d5f279d00305be7272a4e0434b7d
SHA135f7b2211c92259a404ac7ceb0d7b9f032cd12c5
SHA2568ac5b6dc8133f93fd0dfa458c6900feda2d58ccfdb7620bfade5ae706e28ee84
SHA5125510173f8f6a8546c7a9b075482aba5dd0fff5e3d890deba0aa6884f3709969fa78b43b1bd309ab8b120847ce888126b04d8d300d666e5555834ac62212772c6
-
Filesize
22B
MD5ad4936d83feec0c4cd6ded31d0a38142
SHA10e7c4290874abff8f5227d4720d42ec6a84849b1
SHA256254735a72c65fb423e14f978a1b80f64b4c2497caedece0219a4b220a57acf65
SHA512860e57f9c88bff08cf91cafb4b8f31e232f9738c38f53ed0e0065c68e44a2a697c7e2ee0a2e616d709b8cf80f078c1870449e7f1bb555f0a6ce874fade57c721
-
Filesize
7KB
MD5cb5bb50c5e8a16fa17079b9cd9409f75
SHA1be552bcb35726224aa7a3a11b22b71df5acdb074
SHA256403a92f1a110c973518524cb7a047b23be2de7018abce701456284511847811e
SHA51260f12d56c3db2f354315f2e9562f642231311684db84508dc1e2848c50050a133da69643e0454b5ba8bd93cf7dea9b09ff4683a12899ca1f0c83200cfc8a22bf
-
Filesize
8KB
MD582abdb8a01f4597ffab920abac75df7a
SHA176ccf54430958cffe3e4b3bb1043ee6ccb1c373f
SHA25691e91b093b374d082562b709247d2037c99500d968d5a69d3f32c624b0592ec1
SHA5123a0e60a85451e891ab4e5b261a0550801cd8875889e6b4e0d3de78d955da1eedb57fd4d8d7bb969462ab7f6a14775c6573a541d8517bbb7aeeca78d2482d0726
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Users\Admin\AppData\Local\Temp\ZuluGIS 2021 Инженерные Расчеты_(64 бит)_20240515103808_000_localdb_x64.log
Filesize1KB
MD5d355704a9600f28346506412b2ecf144
SHA1346c1d72f9245b0b4fcd954f7dc5f78ffe036de2
SHA2561b3022aea12ae545684a8812a6c043b428fc07d928fcaee3b6a3860904eefac0
SHA512c17806bcd4ea3cd3ed1d96e7052969d98540667aa97332c7a49b485a62bb45f6287fee7d8068f4696810fc4cfc1134d0a098b10112275810802afcf19a3f1c86
-
C:\Users\Admin\AppData\Local\Temp\ZuluGIS 2021 Инженерные Расчеты_(64 бит)_20240515103808_001_sqlncli_x64.log
Filesize1KB
MD5863200abaa1a8715f2062a91c8c33fe4
SHA1692948ad7634fe79ed6a10c71d20373b515bedbd
SHA2560d6b27192a05b34bd18eee940ef29c004416393cd347df5b899c32f6e62db1be
SHA5120665d1ef4f4ab1dcb0d331f4ccc245ccf58ab64f9879c429aa4dedaa23aa3645cc491a6f9e8d83499ca84a8cc69176957e7353b2e92cfd5edb8096f31deb4705
-
C:\Users\Admin\AppData\Local\Temp\ZuluGIS 2021 Инженерные Расчеты_(64 бит)_20240515103808_002_Zulu2021.msi.log
Filesize83KB
MD55f350129be82cc82c57e7db3e9aa9243
SHA1deb68f932c5f838e09b783ec55de434e6e5528ea
SHA256c7d0b880ffd89430f9793ffc11b27e86d584c356d3e84333c9a82236b6420341
SHA51279562939d089d7c664977d072e4ec61354d000185523bb4c3318645ea4ae50597e48e10bd862a6800bbfe3bd546ebda4deba788c973984804e27de4e7550e536
-
Filesize
99KB
MD55ff85536c392f340fc5f1bb164f59934
SHA133492bbfcadfce18da7283e2e8fd15cd07ffefde
SHA25600c16418c2caa6dd12037e3e8e816c52e6378cf4cebde0a85800307f9c70f755
SHA51276b0dfe029f815ec2697479b4617307e436d38bf90055f995e617ef77e370bdf6fef04e18778e73800669a92476efca4c945ce6c2889076e6b7e0083f32e5651
-
Filesize
479KB
MD58f06d5baa6bd0b19a62c04acad5d9802
SHA1b14b4fad9cc2c931ccbb47140163e860d2b60dd1
SHA2562bce639fbd49a230207fd25a91c56dec1b4352a0633ebfc597a9a60beebfc1cb
SHA51249439d573f83d59399b5637c5f93f9af7343f5cdea1509e1fcd82305d57303fa571a3993173ad58a051b1def11f6a0fde9891ee9456c3bc2c2e121b3fe4b2f16
-
Filesize
418KB
MD54039644b083836605f30a93ef79eabd9
SHA1f20bfe23eb877bad4636d282d50bdee114e1e99d
SHA2569206001da97b5a87725276ee0824d4fa4f4fedbe3ee8f5e373dd7f95bde73c90
SHA512b365e3e07d6ca8c3ce634ce4e0584a5a22448e33d78ad85ee90294e958796f4970d5e28e60751e2367887b1e8dab7785428dbee76be5b04578888ea4b64bf462
-
Filesize
599KB
MD514c0a5067237625e936c77a87216b16c
SHA11f41844aa5ef0a51b852f2b958b8aad6c698ad59
SHA25636dd361b2db6bf72405869b02b8b6fd9bd0673be7df454ec79456a8dc0ef4b37
SHA51296df5f06fa8568194399e8411e8823d90331a7ad23c2e185fea3b0fdb4a4428be72233fe79e90365005b221c59d4878f4f6d99e60113954835e5a3043f3211cd
-
Filesize
50KB
MD5fa433515594a2e6fbee5106da583ee22
SHA1db400631b8f4990060837bf7fede9c8b386bf257
SHA256dbe7150d73b1187b7b1463133869d0478598d4e00dd19f06a3471f4186829286
SHA512c1be5bba3339af5c1067002b99366f8a25f85849ffbbf21cac1f177a345f2aace1ccf5fa0d5b81aabeffa146884d35e6ada76d0ee29de38cfd61002718251e82
-
Filesize
62KB
MD56d3940505d9764a918fa37bf1b9cf29c
SHA15f81d446adf0ec4f9d87dbbd2a1aeb1ee845e50c
SHA2567db93f9e42285a52db3801fd5e72e4cbbe17b1577b25b1ba3dd400f3c492451e
SHA512c9871b010f1aa24a5ad294f49c9fe0d99a1ee01b7c6fcbf2e501ae0e1787f6bf498e9d09d3804fc352704bf2359b5d737877ca11be8adadc1703eba154b9a18e
-
Filesize
577KB
MD59b0fad51efad983c4da36029b22066ae
SHA12094a7f5a7e64798506cc69cb147c6f12ac52607
SHA2565b3b9ad249bd7e87442ec1a2334112aa2f2d5992c55ae853df4f5172da49619c
SHA512481a19bc947e1f74224f182cd53997754d5599481a90c187950c937dc093e5f9601c6fea90a51ab46141b6eb6fb62c405b6a39cdd04513d714e95a6d73615973
-
Filesize
7KB
MD509b709e42189d3828bb32e129fddc03a
SHA156e95370abd0a3bbed837fca54f179665ee070e8
SHA2564ebe86e1e02fdada37afbf3c8475dcd26470ac72e1aca3f924165e0ff6349a73
SHA5122c4b563ba98a89868952e5977e8dfe1e88c13e0cf43321a353fed9ed19ddb8243b0cdd8ce192e0f56ee2d04b30d5edbb41f820f7f391aab8cd9ea4fb43b165e3
-
Filesize
184KB
MD5fe7e0bd53f52e6630473c31299a49fdd
SHA1f706f45768bfb95f4c96dfa0be36df57aa863898
SHA2562bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
SHA512feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c
-
Filesize
23.6MB
MD51d72ded047ab7f9e751e04269f89a90d
SHA12a3f33d5fbdf11a3a168fb3619c0c4e405f02a2d
SHA256c4a1b4a839bd00e9fd6ef102e9578e86eb8cd891aa738f9ccd2d0763859503bb
SHA5124fe671fdc42d3cde243c5d7ac9ac96f80a43c1dd54996770371c8b2db3578bd6fe569bd197def92e36f90932fc91d78ba5830e0a3bf27c7dac56a2e61d0bea54
-
Filesize
35.3MB
MD5f90ef1223a29d9db02f7f1bb26bcda4f
SHA126866cef4faf5f61bcc3483c990ea7ab3e93b83e
SHA256de3c6fb29d67fd3055e87eb2bc52e391c4cc24a336d1c0d3ce2da73eac9c5361
SHA512b45b54a884f513aaf22d86cc132508d31250fe1f70697bf47d6f2b65b58874f7b383fff8b4f390201b7040a4a8257dc22c4e1d9f739b73eaf9191c5008472815
-
Filesize
4.9MB
MD530c58829b62e192840cbfcff625c3ba2
SHA10b43c1b0673376f09d8c9bc84fa33c79e5083228
SHA256b43d920abaf28d15cc6cf61547d72b3e91feb8500f71823c8e4f0946bb7a0591
SHA51286582ea5581493ad6c6bee5cb24c869fcc2ba86e3cffe038e1b542822d4a6678a086ea637a39682576251d15ad95d2044165d307a269ac3fc397f82c63a3d1cc
