Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/05/2024, 10:41
240515-mq534sde5y 815/05/2024, 10:29
240515-mjl2nadd29 715/05/2024, 10:22
240515-mefdbach6z 7Analysis
-
max time kernel
75s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
Zulu2021_x64_ru.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
Zulu2021_x64_ru.exe
-
Size
286.0MB
-
MD5
bc34b12d23bb0ece6d8dabb39b3660bd
-
SHA1
92b5b62989f6a8a7e7ee7d2875440f2ed1dfc8e9
-
SHA256
be9abebaebdf278b74184f318cd474b64ef0b95cd3fc09e490c3f785c8b26261
-
SHA512
29885117c1293e0b2da6e92209b996d6bce9e5a85522c6dd4029b47703dad8bfd74b83d8833d20c6afd3b431128a2340c3c3ca554e94e3716a3c7010a2a0ce3f
-
SSDEEP
6291456:xcu6yi759eECcJrCzfLUKw34AuY6QEA6x8D3JrfRqvzhVmAqUum46Jw:xcu6zeEC+rCjLdw3H6QRdD3Jr5qvV49n
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 4572 netsh.exe 4996 netsh.exe 1904 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Zulu2021_x64_ru.exe -
Executes dropped EXE 7 IoCs
pid Process 4464 Zulu2021_x64_ru.exe 3256 Zulu2021.exe 1056 sqlwriter.exe 2908 ZuluOPCService.exe 1368 haspdinst_x64.exe 2968 hasplms.exe 1052 hasplmv.exe -
Loads dropped DLL 31 IoCs
pid Process 4464 Zulu2021_x64_ru.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2240 MsiExec.exe 2240 MsiExec.exe 2240 MsiExec.exe 1056 sqlwriter.exe 8 MsiExec.exe 8 MsiExec.exe 8 MsiExec.exe 8 MsiExec.exe 8 MsiExec.exe 4080 MsiExec.exe 3312 MsiExec.exe 3220 MsiExec.exe 3220 MsiExec.exe 1680 MsiExec.exe 1680 MsiExec.exe 3252 MsiExec.exe 5044 MsiExec.exe 2328 MsiExec.exe 2328 MsiExec.exe 2328 MsiExec.exe 1368 haspdinst_x64.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507023-0B01-11D2-B55D-444553540000}\LocalServer32\ = "\"C:\\Program Files\\ZuluGIS\\Zulu.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B72A-873C-11D3-BF56-D212EB700DCD}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125ED015-16FE-4E3D-90B0-195EFCF6E174}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507349-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\Zb.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0C928-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125073A3-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125073B1-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125ED010-16FE-4E3D-90B0-195EFCF6E174}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\Naladka.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070F1-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507444-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507418-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125074DD-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507129-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluCtrl.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507431-11DD-4DDC-AFDA-3007DB024F4D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B72F-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluChrt.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507504-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250751C-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125ED011-16FE-4E3D-90B0-195EFCF6E174}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B928-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B92C-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\zuluui.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125ED011-16FE-4E3D-90B0-195EFCF6E174}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\Voda.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507123-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507123-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507136-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250712A-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507516-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507522-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507071-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0C939-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507123-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070A8-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507387-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125ED015-16FE-4E3D-90B0-195EFCF6E174}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1250737F-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250708E-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507415-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125074D4-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507136-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250751C-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125ED016-16FE-4E3D-90B0-195EFCF6E174}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125070F1-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125073B1-0B01-11D2-B55D-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250713C-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluCtrl.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B92C-873C-11D3-BF56-D212EB700DCD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070D8-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125074BF-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125074DF-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507133-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507502-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B94D-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507094-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250750C-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507516-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ThreadingModel = "Both" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B72D-873C-11D3-BF56-D212EB700DCD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070B2-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125074DF-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluLib.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507363-0B01-11D2-B55D-444553540000}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\Zb.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B730-873C-11D3-BF56-D212EB700DCD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507511-11DD-4DDC-AFDA-3007DB025F4D}\InprocServer32\ = "C:\\Program Files\\ZuluGIS\\ZuluComNetCtrl.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507025-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125070A4-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe -
resource yara_rule behavioral1/files/0x0007000000023a41-1743.dat upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{6285a7b3-4df9-4b69-a086-a6976bac603e} = "\"C:\\ProgramData\\Package Cache\\{6285a7b3-4df9-4b69-a086-a6976bac603e}\\Zulu2021.exe\" /burn.runonce" Zulu2021.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 65 4684 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: Zulu2021.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: Zulu2021.exe File opened (read-only) \??\T: Zulu2021.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: Zulu2021.exe File opened (read-only) \??\K: Zulu2021.exe File opened (read-only) \??\O: Zulu2021.exe File opened (read-only) \??\Z: Zulu2021.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: Zulu2021.exe File opened (read-only) \??\V: Zulu2021.exe File opened (read-only) \??\W: Zulu2021.exe File opened (read-only) \??\X: Zulu2021.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: Zulu2021.exe File opened (read-only) \??\H: Zulu2021.exe File opened (read-only) \??\I: Zulu2021.exe File opened (read-only) \??\J: Zulu2021.exe File opened (read-only) \??\L: Zulu2021.exe File opened (read-only) \??\Q: Zulu2021.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: Zulu2021.exe File opened (read-only) \??\S: Zulu2021.exe File opened (read-only) \??\Y: Zulu2021.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: Zulu2021.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: Zulu2021.exe File opened (read-only) \??\U: Zulu2021.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\1049\s11ch_sqlncli.chm msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\SET7C14.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\SET7C14.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\akshasp.inf_amd64_50224232b653263d\akshasp.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\akshhl.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D4D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\akshsp53.dll DrvInst.exe File created C:\Windows\SysWOW64\1033\s11ch_sqlncli.chm msiexec.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb.inf haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\hasplms.exe haspdinst_x64.exe File created C:\Windows\System32\DriverStore\Temp\{15f7914a-9782-bb45-aae2-ec2d9c03b6ce}\SET79FE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D2C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_d770553fca0ccaee\akshhl.sys DrvInst.exe File created C:\Windows\SysWOW64\1033\sqlnclir11.rll msiexec.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshasp_sha256.sys haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\hardlock.cat haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{15f7914a-9782-bb45-aae2-ec2d9c03b6ce}\SET7A10.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshhl_sha256.sys haspdinst_x64.exe File created C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D61.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\aksusb.inf DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\hasplmv.exe haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\akshhl.inf_amd64_c0310c7e49015fb9\akshhl33.dll DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb_sha256.cat haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb_sha256.sys haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\hardlock.sys haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\akshhl33.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D4C.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb.cat haspdinst_x64.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\SET7C13.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\akshhl33.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D4D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\akshasp.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D61.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshasp.inf haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\akshasp.inf_amd64_50224232b653263d\akshasp.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\akshhl.inf_amd64_c0310c7e49015fb9\akshhl.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\akshhl.inf_amd64_c0310c7e49015fb9\akshhl.cat DrvInst.exe File created C:\Windows\system32\1049\s11ch_sqlncli.chm msiexec.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb.sys haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb5.dll haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\akshasp.inf_amd64_50224232b653263d\akshsp53.dll DrvInst.exe File created C:\Windows\system32\1033\s11ch_sqlncli.chm msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{15f7914a-9782-bb45-aae2-ec2d9c03b6ce}\akshasp.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_d770553fca0ccaee\akshsp53.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\akshhl.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D5F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\aksclass.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\akshhl.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D4E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_d770553fca0ccaee\akshasp.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{15f7914a-9782-bb45-aae2-ec2d9c03b6ce}\SET79EE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{41dbc795-bf48-8d49-b55c-d2d91abd04e4}\SET7BF1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\aksusb.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_d770553fca0ccaee\akshhl33.dll DrvInst.exe File created C:\Windows\system32\sqlncli11.dll msiexec.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshhl_sha256.inf haspdinst_x64.exe File created C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D4E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cf8006f6-e08a-8f44-9d4c-4cbef6c5bc5a}\SET7D60.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb5_sha256.dll haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{15f7914a-9782-bb45-aae2-ec2d9c03b6ce}\SET79EE.tmp DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0001.zsx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0003.b08 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz_n\Doma.b03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Drain\Sample2\drain2.zx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Simple\Test.b08 msiexec.exe File created C:\Program Files\ZuluGIS\Preset\arcgisonline\World_Shaded_Relief.zww msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz_n\Gaz.zsx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\teplosam.sqlite msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Basic\VODA.d01 msiexec.exe File created C:\Program Files\ZuluGIS\lang\ZuluImpExp.en.lang msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\highway-line.l00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Kvartal\voda.b05 msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\etwcls.mof msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\BOUNDARY-POLYGON.b06 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamNetwork\par.d09 msiexec.exe File created C:\Program Files\ZuluGIS\ReferenceAssemblies\Zulu.Interop.Zb.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamNetwork\Steam.zmp msiexec.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\de.17.0.alp haspdinst_x64.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamNetwork\par.d04 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamNetwork\par.d07 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\QUART.B04 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Teplo\Teplo.d03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Basic\VODA_zt.tl msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqllang.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\teplosam_rezerv.zsx msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\Resources\1049\xesqlpkg.rll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\DOMA.b03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz\Gaz.sqlite msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Sample1\scheme.zrs msiexec.exe File created C:\Program Files\ZuluGIS\zulurep.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\railway-line.b03 msiexec.exe File created C:\Program Files\ZuluGIS\zvstahost.exe msiexec.exe File created C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel LDK\storage\id0\skf hasplms.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\Templates\modellog.ldf msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqlscriptupgrade.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0002.d01 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Teplo.l00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Simple\Test.d13 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Sample1\water supply.d00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\TEPLO\ARM_T_UZ.b05 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Kvartal\DOMA.b10 msiexec.exe File created C:\Program Files\ZuluGIS\lang\Zulu.en.lang msiexec.exe File created C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel LDK\storage\id0\skb hasplms.exe File opened for modification C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel LDK\storage\id0\skg hasplms.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz_v\Gaz.b03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Steam\SteamPipe\par.d11 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\poi-polygon.b04 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Teplo\Teplo.d08 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Hydro\Kvartal\voda.t00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\building-polygon.l00 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Defect\defect_zt.tl msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Nasos\Doma.b01 msiexec.exe File created C:\Program Files\ZuluGIS\politerm.wpf msiexec.exe File created C:\Program Files\ZuluGIS\Examples\OSM\OpenStreetMap\railway-line.b02 msiexec.exe File created C:\Program Files\Common Files\Microsoft Shared\SQL Debugging\ssdebugps.dll msiexec.exe File created C:\Program Files\Microsoft SQL Server\110\Shared\SqlDumper.exe msiexec.exe File created C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\sqlvdi.dll msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Building\FLOOR\0000.b01 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\WaterHammer\Append\append.d03 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Defect\defect.b02 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Drain\Sample2\drain2.b04 msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Drain\Sample2\drain2.sqlite msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Gaz\Gaz_v\Kvartal.zsx msiexec.exe File created C:\Program Files\ZuluGIS\Examples\Thermo\Magistral\Teplo.d03 msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICAF6.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_atl100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\B16AFA1510DA7134A82BE515F2F3087D\11.1.3000\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D msiexec.exe File opened for modification C:\Windows\Installer\MSIE999.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{D2E73B88-A0B8-42EB-A918-488B0F7E0679} msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcr100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140chs.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\e57c34a.msi msiexec.exe File created C:\Windows\assembly\tmp\A3IGWUHK\Zulu.Interop.Zb.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140fra.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140deu.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\e57c340.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIC6AC.tmp msiexec.exe File created C:\Windows\assembly\GACLock.dat msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sort00001000.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D msiexec.exe File opened for modification C:\Windows\Installer\MSIE33A.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140ita.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSICA88.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D msiexec.exe File created C:\Windows\Installer\e57c349.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140jpn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSICB74.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE29D.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140esn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140kor.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSICC03.tmp msiexec.exe File created C:\Windows\assembly\tmp\G2ZBS3WX\Zulu.Interop.Zulu.dll msiexec.exe File created C:\Windows\assembly\tmp\RHYDBOGZ\Zulu.Interop.ZuluComNetOcx.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140rus.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sort00060101.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_atl100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File opened for modification C:\Windows\Installer\e57c345.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140fra.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140rus.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\assembly\tmp\8IBSCECZ\Microsoft.SqlServer.Types.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\B16AFA1510DA7134A82BE515F2F3087D\11.1.3000\F_CENTRAL_msvcr100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140jpn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSI5F98.tmp msiexec.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File created C:\Windows\Installer\e57c351.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC873.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140deu.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\mfc140ita.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\728537BEE9E42DB4A8DA82E2D7ED4B37\10.0.8901\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIC72A.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\88B37E2D8B0ABE249A8184B8F0E76097\11.4.7001\F_CENTRAL_msvcr100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC msiexec.exe File opened for modification C:\Windows\Installer\MSID82C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE399.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags haspdinst_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 haspdinst_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs haspdinst_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 haspdinst_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs haspdinst_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs haspdinst_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID haspdinst_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs haspdinst_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom haspdinst_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags haspdinst_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID haspdinst_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b1010511f65dd1c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005b1010510000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005b101051000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5b101051000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005b10105100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom haspdinst_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ZuluOPCService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ZuluOPCService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 hasplms.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier hasplms.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 hasplmv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier hasplmv.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ZuluOPCService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS hasplms.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer hasplms.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS hasplmv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer hasplmv.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ZuluOPCService.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507376-0B01-11D2-B55D-444553540000}\TypeLib\ = "{12507360-0B01-11D2-B55D-444553540000}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125070C1-0B01-11D2-B55D-444553540000}\TypeLib\ = "{12507020-0B01-11D2-B55D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507463-11DD-4DDC-AFDA-3007DB025F4D}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507495-11DD-4DDC-AFDA-3007DB025F4D}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{30C0C935-873C-11D3-BF56-D212EB700DCD}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507139-0B01-11D2-B55D-444553540000}\Implemented Categories\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507091-0B01-11D2-B55D-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{30C0C936-873C-11D3-BF56-D212EB700DCD}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507431-11DD-4DDC-AFDA-3007DB024F4D}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\SQL Debugging\\ssdebugps.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507495-11DD-4DDC-AFDA-3007DB025F4D}\TypeLib\ = "{12507020-0B01-11D2-B55D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1250747A-11DD-4DDC-AFDA-3007DB025F4D}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZuluLib.PrintLayout\CLSID\ = "{125074DF-11DD-4DDC-AFDA-3007DB025F4D}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D155F381520E1B4B96A20094656D53B\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{83F551D2-0251-4B1E-9BA6-029064655DB3}v8.31.3645.60001\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{30C0B93B-873C-11D3-BF56-D212EB700DCD}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125070A3-0B01-11D2-B55D-444553540000}\ = "IBookmark" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1250708D-0B01-11D2-B55D-444553540000}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1250742A-11DD-4DDC-AFDA-3007DB025F4D}\TypeLib\ = "{12507020-0B01-11D2-B55D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0C962-873C-11D3-BF56-D212EB700DCD}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\VersionIndependentProgID\ = "SQLNCLI11.AdvancedPage" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507061-0B01-11D2-B55D-444553540000}\TypeLib\Version = "a.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125070C6-0B01-11D2-B55D-444553540000}\ProgID\ = "ZuluLib.LabelLayer" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125ED016-16FE-4E3D-90B0-195EFCF6E174} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{30C0B930-873C-11D3-BF56-D212EB700DCD}\ToolboxBitmap32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507055-0B01-11D2-B55D-444553540000} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Zb.ZbDatabase msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{30C0C92E-873C-11D3-BF56-D212EB700DCD}\TypeLib\ = "{30C0C920-873C-11D3-BF56-D212EB700DCD}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507439-11DD-4DDC-AFDA-3007DB024F4D}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Zulu.Chart.6\NotInsertable\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\88B37E2D8B0ABE249A8184B8F0E76097\Sql_LocalDB_Loc = "Sql_LocalDB" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125074C0-11DD-4DDC-AFDA-3007DB025F4D}\ = "IConvertToNetworkParams" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1250708E-0B01-11D2-B55D-444553540000}\ = "ZuluLib.Theme" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{30C0C936-873C-11D3-BF56-D212EB700DCD}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Zulu.Chart.Document.6\NotInsertable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\VersionIndependentProgID\ = "SQLNCLI11.Enumerator" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1250748E-11DD-4DDC-AFDA-3007DB025F4D}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507082-0B01-11D2-B55D-444553540000}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZuluComNetOcx.TaskGaz\ = "ZuluComNetOcx.TaskGaz" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F4CF551-8493-44C9-8D44-32B1DB8877BC}\a.0\0\win64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{D2E73B88-A0B8-42EB-A918-488B0F7E0679}\Version = "11.4.7001.0" Zulu2021.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125074BF-11DD-4DDC-AFDA-3007DB025F4D} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Zb.FieldDef\CurVer\ = "Zb.ZbFieldDef" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B72A-873C-11D3-BF56-D212EB700DCD}\DataFormats\GetSet\0\ = "14,1,64,1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30C0B94D-873C-11D3-BF56-D212EB700DCD}\Version\ = "8.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12507371-0B01-11D2-B55D-444553540000}\TypeLib\Version = "a.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.zrg msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\ = "IHostDebugDebuggerInstance" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507088-0B01-11D2-B55D-444553540000}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125070D8-0B01-11D2-B55D-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1250736B-0B01-11D2-B55D-444553540000}\TypeLib\Version = "a.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\zulu.zprfile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125070B5-0B01-11D2-B55D-444553540000}\ = "ISymbolElement" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{12507071-0B01-11D2-B55D-444553540000} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507522-11DD-4DDC-AFDA-3007DB025F4D}\ = "ZuluComNet ZuluGaz Control" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507095-0B01-11D2-B55D-444553540000}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{12507097-0B01-11D2-B55D-444553540000}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{125074C0-11DD-4DDC-AFDA-3007DB025F4D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\ZuluLib.Project\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12507500-11DD-4DDC-AFDA-3007DB025F4D}\8.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1250738F-0B01-11D2-B55D-444553540000}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12507363-0B01-11D2-B55D-444553540000} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{30C0B720-873C-11D3-BF56-D212EB700DCD}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1250751F-11DD-4DDC-AFDA-3007DB025F4D}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{125ED015-16FE-4E3D-90B0-195EFCF6E174}\ProgID msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 Zulu2021.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Zulu2021.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4684 msiexec.exe 4684 msiexec.exe 4684 msiexec.exe 4684 msiexec.exe 4684 msiexec.exe 4684 msiexec.exe 4684 msiexec.exe 4684 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 468 vssvc.exe Token: SeRestorePrivilege 468 vssvc.exe Token: SeAuditPrivilege 468 vssvc.exe Token: SeBackupPrivilege 2860 srtasks.exe Token: SeRestorePrivilege 2860 srtasks.exe Token: SeSecurityPrivilege 2860 srtasks.exe Token: SeTakeOwnershipPrivilege 2860 srtasks.exe Token: SeBackupPrivilege 2860 srtasks.exe Token: SeRestorePrivilege 2860 srtasks.exe Token: SeSecurityPrivilege 2860 srtasks.exe Token: SeTakeOwnershipPrivilege 2860 srtasks.exe Token: SeShutdownPrivilege 3256 Zulu2021.exe Token: SeIncreaseQuotaPrivilege 3256 Zulu2021.exe Token: SeSecurityPrivilege 4684 msiexec.exe Token: SeCreateTokenPrivilege 3256 Zulu2021.exe Token: SeAssignPrimaryTokenPrivilege 3256 Zulu2021.exe Token: SeLockMemoryPrivilege 3256 Zulu2021.exe Token: SeIncreaseQuotaPrivilege 3256 Zulu2021.exe Token: SeMachineAccountPrivilege 3256 Zulu2021.exe Token: SeTcbPrivilege 3256 Zulu2021.exe Token: SeSecurityPrivilege 3256 Zulu2021.exe Token: SeTakeOwnershipPrivilege 3256 Zulu2021.exe Token: SeLoadDriverPrivilege 3256 Zulu2021.exe Token: SeSystemProfilePrivilege 3256 Zulu2021.exe Token: SeSystemtimePrivilege 3256 Zulu2021.exe Token: SeProfSingleProcessPrivilege 3256 Zulu2021.exe Token: SeIncBasePriorityPrivilege 3256 Zulu2021.exe Token: SeCreatePagefilePrivilege 3256 Zulu2021.exe Token: SeCreatePermanentPrivilege 3256 Zulu2021.exe Token: SeBackupPrivilege 3256 Zulu2021.exe Token: SeRestorePrivilege 3256 Zulu2021.exe Token: SeShutdownPrivilege 3256 Zulu2021.exe Token: SeDebugPrivilege 3256 Zulu2021.exe Token: SeAuditPrivilege 3256 Zulu2021.exe Token: SeSystemEnvironmentPrivilege 3256 Zulu2021.exe Token: SeChangeNotifyPrivilege 3256 Zulu2021.exe Token: SeRemoteShutdownPrivilege 3256 Zulu2021.exe Token: SeUndockPrivilege 3256 Zulu2021.exe Token: SeSyncAgentPrivilege 3256 Zulu2021.exe Token: SeEnableDelegationPrivilege 3256 Zulu2021.exe Token: SeManageVolumePrivilege 3256 Zulu2021.exe Token: SeImpersonatePrivilege 3256 Zulu2021.exe Token: SeCreateGlobalPrivilege 3256 Zulu2021.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4464 Zulu2021_x64_ru.exe 3256 Zulu2021.exe 3256 Zulu2021.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2908 ZuluOPCService.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 832 wrote to memory of 4464 832 Zulu2021_x64_ru.exe 87 PID 832 wrote to memory of 4464 832 Zulu2021_x64_ru.exe 87 PID 832 wrote to memory of 4464 832 Zulu2021_x64_ru.exe 87 PID 4464 wrote to memory of 3256 4464 Zulu2021_x64_ru.exe 91 PID 4464 wrote to memory of 3256 4464 Zulu2021_x64_ru.exe 91 PID 4464 wrote to memory of 3256 4464 Zulu2021_x64_ru.exe 91 PID 4684 wrote to memory of 2272 4684 msiexec.exe 100 PID 4684 wrote to memory of 2272 4684 msiexec.exe 100 PID 4684 wrote to memory of 2240 4684 msiexec.exe 101 PID 4684 wrote to memory of 2240 4684 msiexec.exe 101 PID 4684 wrote to memory of 8 4684 msiexec.exe 103 PID 4684 wrote to memory of 8 4684 msiexec.exe 103 PID 4684 wrote to memory of 4080 4684 msiexec.exe 104 PID 4684 wrote to memory of 4080 4684 msiexec.exe 104 PID 4684 wrote to memory of 4080 4684 msiexec.exe 104 PID 4684 wrote to memory of 3312 4684 msiexec.exe 105 PID 4684 wrote to memory of 3312 4684 msiexec.exe 105 PID 4684 wrote to memory of 3220 4684 msiexec.exe 107 PID 4684 wrote to memory of 3220 4684 msiexec.exe 107 PID 4684 wrote to memory of 3220 4684 msiexec.exe 107 PID 4684 wrote to memory of 1680 4684 msiexec.exe 110 PID 4684 wrote to memory of 1680 4684 msiexec.exe 110 PID 4684 wrote to memory of 3252 4684 msiexec.exe 112 PID 4684 wrote to memory of 3252 4684 msiexec.exe 112 PID 4684 wrote to memory of 5044 4684 msiexec.exe 114 PID 4684 wrote to memory of 5044 4684 msiexec.exe 114 PID 4684 wrote to memory of 5044 4684 msiexec.exe 114 PID 4684 wrote to memory of 2328 4684 msiexec.exe 115 PID 4684 wrote to memory of 2328 4684 msiexec.exe 115 PID 4684 wrote to memory of 2328 4684 msiexec.exe 115 PID 2328 wrote to memory of 1368 2328 MsiExec.exe 116 PID 2328 wrote to memory of 1368 2328 MsiExec.exe 116 PID 4952 wrote to memory of 3748 4952 svchost.exe 118 PID 4952 wrote to memory of 3748 4952 svchost.exe 118 PID 4952 wrote to memory of 1648 4952 svchost.exe 119 PID 4952 wrote to memory of 1648 4952 svchost.exe 119 PID 4952 wrote to memory of 3308 4952 svchost.exe 120 PID 4952 wrote to memory of 3308 4952 svchost.exe 120 PID 2968 wrote to memory of 1052 2968 hasplms.exe 123 PID 2968 wrote to memory of 1052 2968 hasplms.exe 123 PID 2968 wrote to memory of 1052 2968 hasplms.exe 123 PID 1368 wrote to memory of 4572 1368 haspdinst_x64.exe 124 PID 1368 wrote to memory of 4572 1368 haspdinst_x64.exe 124 PID 1368 wrote to memory of 4572 1368 haspdinst_x64.exe 124 PID 1368 wrote to memory of 4996 1368 haspdinst_x64.exe 125 PID 1368 wrote to memory of 4996 1368 haspdinst_x64.exe 125 PID 1368 wrote to memory of 4996 1368 haspdinst_x64.exe 125 PID 1368 wrote to memory of 1904 1368 haspdinst_x64.exe 126 PID 1368 wrote to memory of 1904 1368 haspdinst_x64.exe 126 PID 1368 wrote to memory of 1904 1368 haspdinst_x64.exe 126 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zulu2021_x64_ru.exe"C:\Users\Admin\AppData\Local\Temp\Zulu2021_x64_ru.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\Temp\{C970EB8E-343D-42A8-A6E9-8C1A7CF36EED}\.cr\Zulu2021_x64_ru.exe"C:\Windows\Temp\{C970EB8E-343D-42A8-A6E9-8C1A7CF36EED}\.cr\Zulu2021_x64_ru.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Zulu2021_x64_ru.exe" -burn.filehandle.attached=536 -burn.filehandle.self=5322⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\Temp\{DE48D892-CCDF-4675-9A3D-E1E7371432CA}\.be\Zulu2021.exe"C:\Windows\Temp\{DE48D892-CCDF-4675-9A3D-E1E7371432CA}\.be\Zulu2021.exe" -q -burn.elevated BurnPipe.{94F568FA-F9CC-4BC4-9BD2-91098553A796} {380D76CA-3CC0-49F7-ABE0-C12BF2F22292} 44643⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3256
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:468
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 24A04D72537CADD468DD452866DB5A3B2⤵
- Loads dropped DLL
PID:2272
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DD2FB45E12F98BB318F66D8847F73721 E Global\MSI00002⤵
- Loads dropped DLL
PID:2240
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 53E4922D081EE76CDF3AD8567A6EE32B2⤵
- Loads dropped DLL
PID:8
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6476735163AC8F2925903C0A3C1DE3C8 E Global\MSI00002⤵
- Loads dropped DLL
PID:4080
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B8725E9341029801F2F7636995F84E2D E Global\MSI00002⤵
- Loads dropped DLL
PID:3312
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C131912993B5679522C5FE39E95BE9ED C2⤵
- Loads dropped DLL
PID:3220
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 3BECDE64C7F3DA6146C0EF96641D97692⤵
- Loads dropped DLL
PID:1680
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8158D7D19729DF833EE9A0AA2E179368 E Global\MSI00002⤵
- Loads dropped DLL
PID:3252
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 97DAD6139DEA8CBEF26E07422DB7AB162⤵
- Loads dropped DLL
PID:5044
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 51D5CC66332015257F22CA072B2C3104 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exeC:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe -i -kp -nomsg -32to643⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Sentinel License Manager" program="C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\hasplms.exe"4⤵
- Modifies Windows Firewall
PID:4572
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Sentinel License Manager" program=C:\Windows\system32\hasplms.exe4⤵
- Modifies Windows Firewall
PID:4996
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Sentinel License Manager" dir=in action=allow profile=private,domain program="C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\hasplms.exe" description="Sentinel License Manager"4⤵
- Modifies Windows Firewall
PID:1904
-
-
-
-
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056
-
C:\Program Files\ZuluGIS\ZuluOPCService.exe"C:\Program Files\ZuluGIS\ZuluOPCService.exe" /s1⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\system32\setup\aladdin\hasphl\akshasp.inf" "9" "4d1770e3f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Windows\system32\setup\aladdin\hasphl"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3748
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\system32\setup\aladdin\hasphl\akshhl.inf" "9" "48e7fedb7" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\system32\setup\aladdin\hasphl"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1648
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\system32\setup\aladdin\hasphl\aksusb.inf" "9" "486f4dfd7" "0000000000000160" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\system32\setup\aladdin\hasphl"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3308
-
-
C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\hasplms.exe"C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\hasplms.exe" -run1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\hasplmv.exehasplmv.exe 375152⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
PID:1052
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5e8aeab85cd58915ac39624ea7ef2eb04
SHA1c23ae1bd52aa684b2ddfcb28fd983018039786ce
SHA2561788bd8114a62550e90a0c00b10fe0ee351d1c7f1b075ee8a15d956abc01ae82
SHA512a4aa9ecc9c1020456ca53a0186741f212000df763e16025c3c947b61dcf9350d1f06a278ae899a8b677a0cae564bdd06ac29dd02c7e3dc561b2828684d18bd42
-
Filesize
144KB
MD5446a59513138b8b9ad57a4f47f14df1c
SHA1129904f3ee42091b55f25ee45707275636739526
SHA2567d4f80251404a05697f613f07ba1bf1579035009e121dc5b1afc349d9f396e4d
SHA5124738049be7eda31a95a579d589c2cdaa666242396c362167d786926070c4d644cd74fc40dc8911ce055ae08772b4afa829ac7f3669b7fd5a06d99a67fbb6901c
-
Filesize
366KB
MD56ded2de22be0f5dc35c6bb7999ae02e6
SHA12dce3059b69855f3c0a74bfa753e7a072ac2fa32
SHA256dc917048dd89d07c4fb4d59ee0d435650f8b98e329f6418a62ade52c6981ccf7
SHA512f396fd1336d8b916d8cd480740b7ce82b05e9e008991021056bcfbdbac51f2d70a091880cad45a08e27ebf839a7584490c99de8761492cc7af293d457ac05944
-
Filesize
9KB
MD5326ac8468501511999740709cdb9c378
SHA1986e2803ae5754817515a6ad86a2f203e61f1766
SHA2567e364ab018990ae6994046171565c32a7418808ff27115417014bd22fe673153
SHA512c64dad60d37a91e431e3acd365911953620c4abce94967c46e1bd3b81dc9664c777239c471aa51cafcb4e90b209719fcacefc4323633a781fdb9bf46005e9451
-
Filesize
8.0MB
MD526874e17e31ad96e2b583cb4618fa4b5
SHA144a2dbad345c086191a85038ecd17f941d66f36d
SHA256b7399d78cf5264a72fcd210a62faec28b2118e66155e3c223882ad145e9aa74a
SHA5129f88e278c061040fa024474c220d9b5c5cf64f1871df9c2e9a9b70535f86cbfb3f5b0dbbc3e6675c493c3c31599bd3daf33d5c03e54fd43f61efc260512bb733
-
Filesize
2.5MB
MD5835d5db75f1c8b92ccd38a8c1708ca05
SHA14f0629a4d1e8ec09aaac0b9f7ed6b8c426c8f43c
SHA256ed023898486c7a1093df029362519e31ddd6943902fc47094c8889d83fd1ea2d
SHA5126d000935836dafcfe65183f3846856a36b56c1712ce893812a11eb313f68de21caac5075a5a0a4960615756e9fe77a16cb488674d7018fc0abb84614d556623a
-
Filesize
385KB
MD52b3e731b3ac3f50fc0379b49ed333471
SHA14d9d544b468c621f72eed5a345da5ebc1c51543d
SHA2561e35ab55331fae0a694131482275e7f6cf77cfddb25041c6855183126c3916b9
SHA5128e968e1d74a390014ddeff455b643a32cdfcd277fa08f2b1b4c8d5ca9dd8c086bf1a4b83321d1d046a140136f959b68260a711ad0f0133f38b504a2a05d53c23
-
Filesize
107KB
MD58441e1d4cdae8a41a5dd96c052aa8d43
SHA1c8738e755141fa1a52a8092342479f9ec52ff90f
SHA2564acbd43a522c13a8abec02a1f11e55041c870823935028952a8e071a1bfb8407
SHA512c29e9416a56d6b705412a3007a86f3c471f2a3715e4acd0dbc25c3492b8e32c7d2fb93d9a3b38ca11858a69667a58ccff0626e6d7921812a2586d5a30740b5a9
-
Filesize
1.5MB
MD5a5e4b3ff51cf5b7926d9651908feb666
SHA14ef5d229709e40f3f84e46c3a28341eadbd1a044
SHA25613f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
SHA5120615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
-
Filesize
53KB
MD56573302c5f81eee8954903befeaf0dc3
SHA17f86eddb8da737f95fe650aa1ea017dba267d112
SHA256568bff6c481b0dddc4a0d68df8aee4be704d2883995def17a32f3b7e2985c68c
SHA51218a6e3d30ad25b19631e3a3d894917a4070841a75806146599cb0a29bd11ce35e67386362c5c0d44c589fd69c3b15604c388fd025e06cc2282a54a6332950075
-
Filesize
468KB
MD503c2a9f57ff0a56046c72f6cc8d41ece
SHA1ce34577e048cdc74db4e04737bb660d61c15c757
SHA256f8993b327ec504941cbf20ae3e5aea9b6cee964b905a788b47a0d68be460edbf
SHA51213e7639cbd15da85caa18e650175df5d1f73ffce4cd927635b67ca8e6c492f67a938e8e94b6a9ef3c2a526352ebeff553ebcfcec9e55533a87aa258121984a10
-
Filesize
127KB
MD52e112681b5cf61777fc86d4ff99a9293
SHA14fb920e4b6166c805c9ce9f3ee66fd5966f0d292
SHA256af077ca22268e25833a4aa15e60d64589cba9fb50a7887a1297deb1c71be1803
SHA512e302ad7f54947c2b5705204b5ba0754047ef17b884f1706cfe99e8f4046a42142251732f3a6e9fe12017a536341f8f002a77dbccc97d8dbbe125fa067aa92bb8
-
Filesize
339KB
MD57dd1e153050d338d8480cc48e7e6abe9
SHA1214f0b4991f18979fdb7dd3a1bb9c5d7ebacde92
SHA256318f730fd36230d539c89c9b3e7510fc509377423fadfe59a087fe4a0473dd55
SHA512351180853a047dcdc495b0ed4b25f53780df50680facf4c91adaaa012c42eb13318ec5848291d699a5dbde4fef111ded1f31ddb6974efcd6aee6b95a10fcfe31
-
Filesize
457KB
MD5bacdcfc6cdeaf578bbb559db324f2872
SHA1843f504c83e34c176f2bb68678bd2665c050e230
SHA25654539c5b2259e5fe90c2371600abe4cd3b2e8057fb25ff52f6408e611ddf96c3
SHA5128098a21c133121cfa7a71b0e5b73da0d02f36c5db3fe117f96815763120890642307a2565ec0e15cad148898165bc4ba78346a0332ff75751c4e07a2120ff8b3
-
Filesize
55B
MD50ab8bac388159d1b920aeec7a49c93ef
SHA112205fcafdd935f4c71fcd90fffb50bad3d22565
SHA256b49d2a3d6714a9ce670ee76500f9d44b94e6b6d171150595eb8f285705f291ea
SHA5121e272123fe3dfcc3e7d30120d9f06688532a802b34faf14faed02a33d0eaf35d7a1163a3d94f7d6569e8b43e09ce92325c1785333f2eb96dea31caea110cdeba
-
Filesize
26KB
MD5cc9791ab71953156fdbe2b084a956527
SHA11acb05465f7ce00ea527920e262605fbbd8f3fc7
SHA2562c1e5a602d3223701a298d5b0773398764b5007c3c794fb112c5fee47953511d
SHA512b1cbf53dedab47496836f62267b0787e64288043bb9ee3f05f5885c0479a5899c5b63525d9e201793f87d572cbeddefcc512d309bad6dc9f08e95b1daaf2683c
-
Filesize
65KB
MD5cd315edd9ed6c69231c975b5951fe1fe
SHA10b6724cddf3e8e734342889c0114021f35e62210
SHA256d00fc04f0cef268395b1b70ead71fac3d5ab88dc2d0d4efa246459c1ea3532a2
SHA512a397d12eef734612f08b042650e4974de38c675dce29bb842acd76d3dcd2853e76543a86b3f5be14d5c126a73f1a826ca8ff5603bb01c462665ff0d2d80b1582
-
Filesize
4KB
MD5b7b2d5f279d00305be7272a4e0434b7d
SHA135f7b2211c92259a404ac7ceb0d7b9f032cd12c5
SHA2568ac5b6dc8133f93fd0dfa458c6900feda2d58ccfdb7620bfade5ae706e28ee84
SHA5125510173f8f6a8546c7a9b075482aba5dd0fff5e3d890deba0aa6884f3709969fa78b43b1bd309ab8b120847ce888126b04d8d300d666e5555834ac62212772c6
-
Filesize
22B
MD5ad4936d83feec0c4cd6ded31d0a38142
SHA10e7c4290874abff8f5227d4720d42ec6a84849b1
SHA256254735a72c65fb423e14f978a1b80f64b4c2497caedece0219a4b220a57acf65
SHA512860e57f9c88bff08cf91cafb4b8f31e232f9738c38f53ed0e0065c68e44a2a697c7e2ee0a2e616d709b8cf80f078c1870449e7f1bb555f0a6ce874fade57c721
-
Filesize
7KB
MD5cb5bb50c5e8a16fa17079b9cd9409f75
SHA1be552bcb35726224aa7a3a11b22b71df5acdb074
SHA256403a92f1a110c973518524cb7a047b23be2de7018abce701456284511847811e
SHA51260f12d56c3db2f354315f2e9562f642231311684db84508dc1e2848c50050a133da69643e0454b5ba8bd93cf7dea9b09ff4683a12899ca1f0c83200cfc8a22bf
-
Filesize
8KB
MD582abdb8a01f4597ffab920abac75df7a
SHA176ccf54430958cffe3e4b3bb1043ee6ccb1c373f
SHA25691e91b093b374d082562b709247d2037c99500d968d5a69d3f32c624b0592ec1
SHA5123a0e60a85451e891ab4e5b261a0550801cd8875889e6b4e0d3de78d955da1eedb57fd4d8d7bb969462ab7f6a14775c6573a541d8517bbb7aeeca78d2482d0726
-
Filesize
4B
MD5f2dd0dedb2c260419ece4a9e03b2e828
SHA10aaf76f425c6e0f43a36197de768e67d9e035abb
SHA25626b25d457597a7b0463f9620f666dd10aa2c4373a505967c7c8d70922a2d6ece
SHA512fecd7b408089255b3467dc1f7231cc6388c9e1c65dcaa5e50f3b460235d18bc44033b08184018b65ac013fdae68c0088381644a6302b9d89e468f57ff9a005dd
-
C:\ProgramData\SafeNet Sentinel\Sentinel LDK\70af041f-044c-2c98-5524-44f71b9cfc73\.434e4631\.gfh6chl6
Filesize120B
MD5c5aac43fb24c5143bf1dd5956064dc4f
SHA1c89d4914516ef9d9fa641bca6ce45654c1cf64c6
SHA256832ecf20094a288153f09b2426552fc5f743e03c320eae373c80e12e1299eccb
SHA512f118d8d63dd9b38246109390a1bc2a679b6bd500ea65a5e2694542de641156db218a6f9cd378a9a2f0b3aa3d02779681694616c10c63492cc3f30678870c64a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Filesize532B
MD528c706f0975e0f74df11e90da1531559
SHA19085f316e91564e8649553ab4bc9e90d4241eb76
SHA256e54b2e6d5ff6d4cb2e4f77359d64edca8e274fe0a9eaf95c9fb3c39845b7ec20
SHA512925f689fd7c243b3fa8bb72012630ae168d2dd4f54495d83b87583d669172877252ba69d890c72ed1132149c9e3871351a26b5e9c64e4f6d6fb2076177f29445
-
Filesize
5KB
MD53bbd25e1271daecb94afae78163d3fcd
SHA1ddd5278c150ed7f66b819dbf219988837b27b8ec
SHA2563e5faf75e58b4168577647a7bb247234a57186103677da9b3b07818e46fb43db
SHA5125fa96d60336f6bbfc64284c1f6c6fafa5f6cc46524a09be3b06dc71cd1b2cbdab8c25ddbecdc1036b823962d4b0a3974ef0e2f05fd49dbe4ced97a5371514adf
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Users\Admin\AppData\Local\Temp\ZuluGIS 2021 Инженерные Расчеты_(64 бит)_20240515104246_000_localdb_x64.log
Filesize1KB
MD5b1b78761a1a849a08922127804556d35
SHA14c8ee806c656498bdd58f44ee083da403ac49570
SHA256cbbb07d598568f495b557d2944e7f125f1cc92754dcae17bf7be2b2bafe56e30
SHA512ddc83b79771927dfc8703124c39aaab669d13e3cee9029fc0dc181ed2f1134ba745dddb63f6929450a5b4ddbbf29bded2ca76e6d2a0f7bf527fd969698f4fbaa
-
C:\Users\Admin\AppData\Local\Temp\ZuluGIS 2021 Инженерные Расчеты_(64 бит)_20240515104246_001_sqlncli_x64.log
Filesize1KB
MD5b067d4709ba18a645a48b996b79a59bc
SHA16da16c6eda85c7d5f27fc506101bbb819eec4f67
SHA2562cea7606c680e02e1fb17b49e209f7d9980152cb46336d788f22d0d9cb1f4a5a
SHA5125658f0fe24dae4d078f8c7074a60031fba88b61cac8e86a4668365c0faa28b1a55be7d43a431bd2aebaf2ca581675a784d1e41c996df4d92cfb1b62f078f2359
-
C:\Users\Admin\AppData\Local\Temp\ZuluGIS 2021 Инженерные Расчеты_(64 бит)_20240515104246_002_Zulu2021.msi.log
Filesize83KB
MD59dedd28dc2bd04291326f38ac6f2a93d
SHA1aa9597f28257b968f4010049f7e4d9ad9a10f0a7
SHA256cd7dbe826d82a3adb24615a47810d80b1c459fa13c16d158ce7b1fd07236715a
SHA512135fe7432c4be2b3462d2aca533ac7057e1b7ec5c536fdeb74317cd52d2b5913856ad1d4dd9ddf4c050bc1930028395374618c6713eb3733789811b9ecddd283
-
Filesize
9.9MB
MD597305b68d7254bb5a6186a6d222867e2
SHA1a05b9f0921ed2b1cea76ecbe8941fecb7eed40fa
SHA2565104ac66229fa14afdd475c40fa5b5519ce0f860600fb4ec3ac3fa12aa2a0911
SHA5122a2f529074a861687a4201e9799612fd89ceec94e0370c065f08b05918d6d9c3f1a25d367a066457ae108ee43617aec29b50bea39bcb3eb1f16df8280879530d
-
Filesize
154KB
MD5b2e2c24ebce4f188cf28b9e1470227f5
SHA19de61721326d8e88636f9633aa37fcb885a4babe
SHA256233f5e43325615710ca1aa580250530e06339def861811073912e8a16b058c69
SHA512343ea590c7f6b682b3b3e27fd4ab10ffeded788c08000c6dd1e796203f07bf9f8c65d64e9d4b17ce0da8eb17aaf1bd09c002359a89a7e5ab09cf2cb2960e7354
-
Filesize
99KB
MD55ff85536c392f340fc5f1bb164f59934
SHA133492bbfcadfce18da7283e2e8fd15cd07ffefde
SHA25600c16418c2caa6dd12037e3e8e816c52e6378cf4cebde0a85800307f9c70f755
SHA51276b0dfe029f815ec2697479b4617307e436d38bf90055f995e617ef77e370bdf6fef04e18778e73800669a92476efca4c945ce6c2889076e6b7e0083f32e5651
-
Filesize
479KB
MD58f06d5baa6bd0b19a62c04acad5d9802
SHA1b14b4fad9cc2c931ccbb47140163e860d2b60dd1
SHA2562bce639fbd49a230207fd25a91c56dec1b4352a0633ebfc597a9a60beebfc1cb
SHA51249439d573f83d59399b5637c5f93f9af7343f5cdea1509e1fcd82305d57303fa571a3993173ad58a051b1def11f6a0fde9891ee9456c3bc2c2e121b3fe4b2f16
-
Filesize
418KB
MD54039644b083836605f30a93ef79eabd9
SHA1f20bfe23eb877bad4636d282d50bdee114e1e99d
SHA2569206001da97b5a87725276ee0824d4fa4f4fedbe3ee8f5e373dd7f95bde73c90
SHA512b365e3e07d6ca8c3ce634ce4e0584a5a22448e33d78ad85ee90294e958796f4970d5e28e60751e2367887b1e8dab7785428dbee76be5b04578888ea4b64bf462
-
Filesize
599KB
MD514c0a5067237625e936c77a87216b16c
SHA11f41844aa5ef0a51b852f2b958b8aad6c698ad59
SHA25636dd361b2db6bf72405869b02b8b6fd9bd0673be7df454ec79456a8dc0ef4b37
SHA51296df5f06fa8568194399e8411e8823d90331a7ad23c2e185fea3b0fdb4a4428be72233fe79e90365005b221c59d4878f4f6d99e60113954835e5a3043f3211cd
-
Filesize
50KB
MD5fa433515594a2e6fbee5106da583ee22
SHA1db400631b8f4990060837bf7fede9c8b386bf257
SHA256dbe7150d73b1187b7b1463133869d0478598d4e00dd19f06a3471f4186829286
SHA512c1be5bba3339af5c1067002b99366f8a25f85849ffbbf21cac1f177a345f2aace1ccf5fa0d5b81aabeffa146884d35e6ada76d0ee29de38cfd61002718251e82
-
Filesize
62KB
MD56d3940505d9764a918fa37bf1b9cf29c
SHA15f81d446adf0ec4f9d87dbbd2a1aeb1ee845e50c
SHA2567db93f9e42285a52db3801fd5e72e4cbbe17b1577b25b1ba3dd400f3c492451e
SHA512c9871b010f1aa24a5ad294f49c9fe0d99a1ee01b7c6fcbf2e501ae0e1787f6bf498e9d09d3804fc352704bf2359b5d737877ca11be8adadc1703eba154b9a18e
-
Filesize
10KB
MD538673a91bf3005e935743820ecd3388d
SHA133ed0b61a2508642eb7e1cd3188c0ec2b0d628fb
SHA256cef12287ee84642d86e9f04d6c84ff4da2688dfc1894e2fa415e5b65a0447419
SHA512a184c7c26a6ffc2258f9d944f394c0e9b1d1c913364c39ec625f6a3809af55ff407fd1d0fb3b728abfdaff5a5619f03e5dc7c5ce39c2f6bbee4d538895707c32
-
Filesize
67KB
MD5a3426e49b6b1eb58f4f046afb256936d
SHA1a77cce1c8041965c5595fd35b10153c036af4474
SHA25685495dee1626aa27ae070570d96a7fc86ca2a91c5acfcf7d6c6a80ddc41dc516
SHA512cfb8c056670f6e4cedd0ac80a57e57b467c26df3eab6051aa96bcdbb10e502d91dbf8c1f50df39e3677eaf162c4d97b77c1e5de2b33573ccbefcc8c23f6c24c5
-
Filesize
72KB
MD566a94efb994e44a0c5accdee389e4717
SHA17a72ba06631d5d298b337c9872254199b4135f94
SHA2566e400f7ed133e5e3bdd3530df1c2f3667a12ba8da705cc7c46f140cdd3186b22
SHA512b7647fd0f86f35238ad0e0833852d3b5dd4cd519c4a3621f80c15a76cccd443c599d4bebd4b758066be6d299f25cb5ac6a78f231656ada573a75cb761bf85a49
-
Filesize
10KB
MD5bbff4a9f14e8964ab272d0446a3835d0
SHA16580ad2be69007d4f6e212332a850db4d5c2ec5a
SHA2568431ba8040142d37ec6391167c572ace9bfc15052b566b3dae10821d5956a9b1
SHA5120424e0142ab39192780740eb63ab35e327050ec853e455d0bc93b443ca7a9078b99ee0e9ee49c29d064076963b8d643f5a592ac86c35b47472e4d0813b1873ab
-
Filesize
66KB
MD50be5df679bb57ed4f50d226b78f96dcf
SHA15ee995d7c27ffb82cf078c14b0c62ced46b1be6e
SHA25671313a6bdfd77671011bb96061592f49cff772a80338b1214d3e43c61a633a90
SHA51276068628523416759193fb62490ca56f1347c6256b61f597475d0b1b93b2be7053157f81855afeea679fd4820b21f7d73d2074f8c9c2b837aa64f179843c16f9
-
Filesize
273KB
MD541b078d16d192cab252fc150e8efbcd2
SHA1a112ed4a2642129a05715d4b96ff6b91105caf47
SHA256891f1654167d391f3d3dabf53760b4db97268e5ee702f58f1effb28be6e70b9f
SHA512bb3de5d50ba349e6b12842be742d91ea0d792cdeafc1f961464910d3631d290a523d3282f485ec5e461409747b2939cb77cd37a9be2cf7baae03e5fdf901ab7b
-
Filesize
30KB
MD5223f3bd99036491136bad70308a67093
SHA1f2a5ab2ede23c0ddf2aaf637942f048296b5805a
SHA256507af60f34aee00e1233d011b573a0eb643f1145839f1d72f655608b9ba861e9
SHA51296ba856afd751902733ed29ecd6b4fba9fbecd403e6c225529ff0cc2a35eb2754b43b22c68a7ddceb2f2015d00ed7155d8d4ed603fd0a6b171f00a1c1131641d
-
Filesize
12KB
MD50a92fc21879c759cacae77bc7382f007
SHA1c5fcf3b73c0bffcb5861aa85be5c63a99285cead
SHA2565b2b6b0562e186831377eb8362a77ccd88188fb79591836828179c4eda2a4e2b
SHA512ae8e34b68619688061534f4680ccc66f1df22c5bb1016a7fe62366e621881675e28b250dc2e100a02090d097b5abb942414f087ecfa2ce19485948b0306a16e0
-
Filesize
306KB
MD56cce6abd7a4e7468e571263912100154
SHA189ff0b8347f1a06d51482f9bf92ea0e0deec6741
SHA2566f181f410335f6b780a68c6926f3298e8c53ad2ed5e19e78dd47825ab0193798
SHA51209e46371c9ef759db2acb4eb82425866674e546ace6dd42da9ee2c7881f37220f35db6e6de77fe06279d93f75a2fa0e2dc3061c4b25c3d65246a61795447d883
-
Filesize
83KB
MD5bebc1105751fc357bf994e5358fd2ad6
SHA1bf60a9acd8ed36faf183345810f741a7487399a7
SHA256e5258c182f1e1c87ff5d1ee98b662713218141c5b39ab1a827bc2ab121fd6add
SHA512b47205f6e9795316f5469a470d1c6490a997a5b6df81b5b65fa3660eccdb152547c4aae8d80d9579c20c250794396dc7ac82a15f282bbeca936c65465266ea7b
-
Filesize
2KB
MD5559b1c2472f9be7042120255c5694512
SHA11a49e023b332bbffd41ba9a4eeaaa0311fc01f64
SHA2564991041da3a8512e31b05cba3fc0828cfa5ef239db85e0ee42092e6d5b327723
SHA512e2fbea390fad9ed588da38a848117cc87435bc60c551ae63ad4e8034838d97364246ff6c2ae9cb25ba03b7833c3d158bd47de53affb21490a348fc8e3f9b2764
-
Filesize
2KB
MD5e8f366a288a2c82f806f1661795f277b
SHA1c9f7195fde4b19c2554debfafe4e3b0f69d08b62
SHA256d774a41afa1eac88e577bb82b0e641d5e76b96b5d19d261889fb4fa4a98165c3
SHA512c0b6fa666f3d63f018d158b3e52b2cf21693b86d8e39d118b207ed489c20973bc3c0f37f4f59dcb04ca9d76b123905b1e86c478b45fb9938bec8778573518042
-
Filesize
2KB
MD5d574e62f43a3f77525b60f4ef4588f41
SHA1d4c2be23d20f7139a71825819e9d9b4e29f65c39
SHA2566969442e55c5bc825c2ca3b917b131768c91337a1729c9d6e098162f30cf79f4
SHA512279e6a72771d82c35dc958c741c5f4efbc17a17930a5cd3997139ea8ea794a2d59cc58a176febe398f3b698ce50ac2355032e28753e831cca95e6e3faeca3c87
-
Filesize
201KB
MD548f5fd0e76cc410b525f23ec8968357b
SHA1e65bf34f3fbd2a35f0baf9a840fedd60ec327b3f
SHA256587d166830beb63866394c3738c40931958cb1703b3be3dc035f8913ce3c816b
SHA5129f4932e0159ac0a864c8cc77c027270aacef6789dac6669ed6a7b0d4e4e25584c420b1d48d47a2093c64395ec620e31736c2161628d01c0f3a7108a4e8a9b162
-
Filesize
577KB
MD59b0fad51efad983c4da36029b22066ae
SHA12094a7f5a7e64798506cc69cb147c6f12ac52607
SHA2565b3b9ad249bd7e87442ec1a2334112aa2f2d5992c55ae853df4f5172da49619c
SHA512481a19bc947e1f74224f182cd53997754d5599481a90c187950c937dc093e5f9601c6fea90a51ab46141b6eb6fb62c405b6a39cdd04513d714e95a6d73615973
-
Filesize
7KB
MD509b709e42189d3828bb32e129fddc03a
SHA156e95370abd0a3bbed837fca54f179665ee070e8
SHA2564ebe86e1e02fdada37afbf3c8475dcd26470ac72e1aca3f924165e0ff6349a73
SHA5122c4b563ba98a89868952e5977e8dfe1e88c13e0cf43321a353fed9ed19ddb8243b0cdd8ce192e0f56ee2d04b30d5edbb41f820f7f391aab8cd9ea4fb43b165e3
-
Filesize
184KB
MD5fe7e0bd53f52e6630473c31299a49fdd
SHA1f706f45768bfb95f4c96dfa0be36df57aa863898
SHA2562bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
SHA512feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c
-
Filesize
23.6MB
MD51d72ded047ab7f9e751e04269f89a90d
SHA12a3f33d5fbdf11a3a168fb3619c0c4e405f02a2d
SHA256c4a1b4a839bd00e9fd6ef102e9578e86eb8cd891aa738f9ccd2d0763859503bb
SHA5124fe671fdc42d3cde243c5d7ac9ac96f80a43c1dd54996770371c8b2db3578bd6fe569bd197def92e36f90932fc91d78ba5830e0a3bf27c7dac56a2e61d0bea54
-
Filesize
35.3MB
MD5f90ef1223a29d9db02f7f1bb26bcda4f
SHA126866cef4faf5f61bcc3483c990ea7ab3e93b83e
SHA256de3c6fb29d67fd3055e87eb2bc52e391c4cc24a336d1c0d3ce2da73eac9c5361
SHA512b45b54a884f513aaf22d86cc132508d31250fe1f70697bf47d6f2b65b58874f7b383fff8b4f390201b7040a4a8257dc22c4e1d9f739b73eaf9191c5008472815
-
Filesize
4.9MB
MD530c58829b62e192840cbfcff625c3ba2
SHA10b43c1b0673376f09d8c9bc84fa33c79e5083228
SHA256b43d920abaf28d15cc6cf61547d72b3e91feb8500f71823c8e4f0946bb7a0591
SHA51286582ea5581493ad6c6bee5cb24c869fcc2ba86e3cffe038e1b542822d4a6678a086ea637a39682576251d15ad95d2044165d307a269ac3fc397f82c63a3d1cc
-
Filesize
76KB
MD53ebe952f07904814305a73a56059e8b3
SHA11efeec3baa460f6adaf66e5b50da467250c12264
SHA2566567dda8040a3f5ff80da0abfcc3da79aa3f1baa2f1b6fed2b1a2972b3ce8f2e
SHA5121a67aeeb1e9918c1946ede4f9180c60930c500b8f5b075a967e90414b9562acb41573f16473e02142ee30e1b1609d5b4b3cedd6cdc3ee6cf7e2cc7d3ccaf38d9
-
Filesize
32KB
MD5cbad6fba57bc41375684ec089888afaa
SHA1b0b7dfd8c86f449246679788e7acaaca0557e41d
SHA25691f8ee3f524de0b14aef8361c865572f06d7f581a59bebc1c53cc200617c98d2
SHA5124b7a7d6fe2f0ea79b42f56bb36368d78deea8f523caa8d89f47131566d52bbb8c878a9c2b05a5054cc4a992d945bc815e35386d2d7d2f2f78804f3fe5e2060c6
-
Filesize
66KB
MD5fb1fe2c24c49b997dc7b532b377c6a3e
SHA132cc3fc7676b040fad015503c4afd86f38fd88eb
SHA25680cf5c403685ad312264ffe575d02b517fc36efab078617affd94585f31e2856
SHA512c0b76106071698ab510c7fb5b1055f659157720eee6bcd3a045213662367bd6458658552afdc09d7dd22b8a778b7ee2421087e5d4fa6510a454a42ce881e5cad
-
Filesize
84KB
MD5048b2e906fcad2df0add7ccc3d1a2089
SHA1681bea2e19403ecdf672ebe287ce42659f90b9dd
SHA25641a8d04c4e94acfe476b1682484dc25ea945de50a9441f8d82137664b9edcfeb
SHA5124612f8dfaec46a2be1b9771cb3f583b812e20c9efe062a0efab05989bb897dfa931dd5f82e21b575e57052ab8a321cdb1385f089bc64a1e7db8f7d9a7392f755
-
Filesize
267KB
MD53ef5bfa6f792cc1f1e06f14edec912fb
SHA16344b23d9c0404f8570f08c937a8859dc7013f69
SHA256e1444b60ef632adecdb6ba3ae1d3ee2308eaefb6e77cb363eaea3517aa84e3ef
SHA51229ab02918376122c60c662581c62acce636c0b1750d8d272a0a0d4e9631b476620cf83aa96cc76f29241b3ee137d33e1d00496b1ad832f2e0da68c3676438aee
-
Filesize
67KB
MD5ee3b181e8e7c5baafb697cc89ac7eb85
SHA1bcc743a2e312db2a2f2a1ccd75dfc53bb3e961ef
SHA256e72ad7c3d7fe1968e7b718e9ef2f11fde64cc8fd8d0801b16ce3d51853170840
SHA512f92d2fd8ef918cdbac3f9cd472181a7e71ac9abc71842a79bdf043fc7c0a48da932b5f0ee914c1e5ebac8b75de52c281b11addd09c78974431f574f97baea2dc
