40ee1df774131155ebec51544bb714442e52102b44c3009fe8f2198b82a86394

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/06/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cloudflare_WARP_2026.4.1390.0.msi
Size 49.8MB
Sample260621-g1ee9acy21
SHA256 40ee1df774131155ebec51544bb714442e52102b44c3009fe8f2198b82a86394
MD5 8870ff1e8a17dc3bb2d6f26bf4bd3206
SHA1 3b40088617d6df0e74e5727e8711d2d06abe7d03
SHA512 816e6b6944c9ca126e7789e6ec870ae2ba589afcfeb37845d1e285c77c8c7070cbc1191b1b0b963d1b71c0919226093db99a2ab3be3fa380c2b0b4e74bd0f25f
SSDEEP 1572864:sg8oO/C18bfcStE7br/J0QvYbhykzoxf/lwOKKjy:sJEraQAVzoxf+OKr
TLSH
T1F6B733C5B1711C79E897443582B687709A7B3C68674294CB8624B45EBF336F0E2BE783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4236	Cloudflare WARP.exe
4228	warp-svc.exe

Loads dropped DLL 48 IoCs

pid	Process
3880	MsiExec.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
4316	MsiExec.exe
1948	rundll32.exe
1948	rundll32.exe
1948	rundll32.exe
1948	rundll32.exe
1948	rundll32.exe
4316	MsiExec.exe
4652	rundll32.exe
4652	rundll32.exe
4652	rundll32.exe
4652	rundll32.exe
4652	rundll32.exe
4316	MsiExec.exe
2036	rundll32.exe
2036	rundll32.exe
2036	rundll32.exe
2036	rundll32.exe
2036	rundll32.exe
4316	MsiExec.exe
4280	rundll32.exe
4280	rundll32.exe
4280	rundll32.exe
4280	rundll32.exe
4280	rundll32.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe
4228	warp-svc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CloudflareWARP = "C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe"	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	892	msiexec.exe
6	892	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4228	warp-svc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\json\warp_animation_disconnected.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\expand.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-magic-firewall-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-no-stop-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-router-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-user-add-member-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\rust_bridge.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-caret-up-1-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-weibo-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-slow-snail-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-face-sad-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-security-shield-protection-2-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-weibo-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-process-flow-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-security-crawler-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_ui\lib\fonts\GoogleSansCode-VariableFont_wght.ttf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-auto-rag-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-benefits-healthcare-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-regional-services-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-reliability-timer-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-internet-globe-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\flutter_windows.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-arrow-external-link-2-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-spectrum-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-collapse-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-corner-down-right-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-device-tablet-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-security-bots-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\caret-right-2.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\fonts\MaterialIcons-Regular.otf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-airplane-paper-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-benefits-parental-leave-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-caret-double-left-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-caret-reorder-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-internet-globe-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_ui\fonts\GoogleSansCode-VariableFont_wght.ttf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\install-vpn.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-warp-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-performance-routing-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-benefits-paid-vacation-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-challenges.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\concrt140.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attention-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-security-application-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-graduation-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-home-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-numeric-1-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-thumbs-down-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\checkbox-unselected.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\search-icon.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\tray_icons\pdfs\connected.pdf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-hamburger-2-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-icard-view-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\json\warp_animation_transition_connecting_paused.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-server-database-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\crashpad_wer.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-code-branch-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-documentation-logs-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-share-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-workers-for-platform-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloud-hybrid-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-magic-transit-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-feedback-outline.svg	msiexec.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC93B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA990C5C517545DD7BF058789E97ACC78B\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA842176889346394A0936287B574D0692\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA04606A6E0D45260A94EB4459D5C49942\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBA52.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC457.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA04606A6E0D45260A94EB4459D5C49942\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA990C5C517545DD7BF058789E97ACC78B\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\{9E49837E-2971-413F-9587-119FA819E572}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA842176889346394A0936287B574D0692\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA842176889346394A0936287B574D0692\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA990C5C517545DD7BF058789E97ACC78B\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\e58b88d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b88d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA842176889346394A0936287B574D0692\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC552.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA04606A6E0D45260A94EB4459D5C49942\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID3EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC252.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA842176889346394A0936287B574D0692\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA990C5C517545DD7BF058789E97ACC78B\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA990C5C517545DD7BF058789E97ACC78B\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\{9E49837E-2971-413F-9587-119FA819E572}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA842176889346394A0936287B574D0692\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA04606A6E0D45260A94EB4459D5C49942\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA990C5C517545DD7BF058789E97ACC78B\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA04606A6E0D45260A94EB4459D5C49942\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA04606A6E0D45260A94EB4459D5C49942\System.ServiceProcess.ServiceController.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{9E49837E-2971-413F-9587-119FA819E572}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4656	sc.exe
4956	sc.exe
1852	sc.exe
764	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
892	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\", 1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\ = "URL:com.cloudflare.warp Protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d70f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a0400000001000000100000002edae4397f9c8f37d1709f2617513a8e2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100000400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1664	rundll32.exe
1664	rundll32.exe
876	msiexec.exe
876	msiexec.exe
2036	rundll32.exe
2036	rundll32.exe
4228	warp-svc.exe
4228	warp-svc.exe
4228	warp-svc.exe
4228	warp-svc.exe
4228	warp-svc.exe
4228	warp-svc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	892	msiexec.exe
Token: SeSecurityPrivilege	876	msiexec.exe
Token: SeCreateTokenPrivilege	892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	892	msiexec.exe
Token: SeLockMemoryPrivilege	892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	892	msiexec.exe
Token: SeMachineAccountPrivilege	892	msiexec.exe
Token: SeTcbPrivilege	892	msiexec.exe
Token: SeSecurityPrivilege	892	msiexec.exe
Token: SeTakeOwnershipPrivilege	892	msiexec.exe
Token: SeLoadDriverPrivilege	892	msiexec.exe
Token: SeSystemProfilePrivilege	892	msiexec.exe
Token: SeSystemtimePrivilege	892	msiexec.exe
Token: SeProfSingleProcessPrivilege	892	msiexec.exe
Token: SeIncBasePriorityPrivilege	892	msiexec.exe
Token: SeCreatePagefilePrivilege	892	msiexec.exe
Token: SeCreatePermanentPrivilege	892	msiexec.exe
Token: SeBackupPrivilege	892	msiexec.exe
Token: SeRestorePrivilege	892	msiexec.exe
Token: SeShutdownPrivilege	892	msiexec.exe
Token: SeDebugPrivilege	892	msiexec.exe
Token: SeAuditPrivilege	892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	892	msiexec.exe
Token: SeChangeNotifyPrivilege	892	msiexec.exe
Token: SeRemoteShutdownPrivilege	892	msiexec.exe
Token: SeUndockPrivilege	892	msiexec.exe
Token: SeSyncAgentPrivilege	892	msiexec.exe
Token: SeEnableDelegationPrivilege	892	msiexec.exe
Token: SeManageVolumePrivilege	892	msiexec.exe
Token: SeImpersonatePrivilege	892	msiexec.exe
Token: SeCreateGlobalPrivilege	892	msiexec.exe
Token: SeBackupPrivilege	1708	vssvc.exe
Token: SeRestorePrivilege	1708	vssvc.exe
Token: SeAuditPrivilege	1708	vssvc.exe
Token: SeBackupPrivilege	876	msiexec.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe
Token: SeBackupPrivilege	3204	srtasks.exe
Token: SeRestorePrivilege	3204	srtasks.exe
Token: SeSecurityPrivilege	3204	srtasks.exe
Token: SeTakeOwnershipPrivilege	3204	srtasks.exe
Token: SeBackupPrivilege	3204	srtasks.exe
Token: SeRestorePrivilege	3204	srtasks.exe
Token: SeSecurityPrivilege	3204	srtasks.exe
Token: SeTakeOwnershipPrivilege	3204	srtasks.exe
Token: SeDebugPrivilege	1664	rundll32.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe
Token: SeDebugPrivilege	2036	rundll32.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe
Token: SeSecurityPrivilege	876	msiexec.exe
Token: SeRestorePrivilege	876	msiexec.exe
Token: SeTakeOwnershipPrivilege	876	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
892	msiexec.exe
892	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4236	Cloudflare WARP.exe
4236	Cloudflare WARP.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3204	876	msiexec.exe	96
PID 876 wrote to memory of 3880	876	msiexec.exe	98
PID 3880 wrote to memory of 1664	3880	MsiExec.exe	99
PID 876 wrote to memory of 4316	876	msiexec.exe	100
PID 4316 wrote to memory of 1948	4316	MsiExec.exe	101
PID 4316 wrote to memory of 4652	4316	MsiExec.exe	102
PID 4316 wrote to memory of 2036	4316	MsiExec.exe	103
PID 4316 wrote to memory of 4280	4316	MsiExec.exe	107
PID 4280 wrote to memory of 4656	4280	rundll32.exe	108
PID 4280 wrote to memory of 4956	4280	rundll32.exe	110
PID 4280 wrote to memory of 1852	4280	rundll32.exe	112
PID 4280 wrote to memory of 764	4280	rundll32.exe	114
PID 4236 wrote to memory of 4960	4236	Cloudflare WARP.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.4.1390.0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:892

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E5CD888209710F1C59EC3D0F98CC0ACF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBA52.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240696062 2 CustomInstallerActions!CustomInstallerActions.Processes.KillGUIProcess
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C299E7F9D3DCF2BF233593B6237A5BE E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC457.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698484 7 CustomInstallerActions!CustomInstallerActions.CustomActions.ReadCmdLineParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1948
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC552.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698703 18 CustomInstallerActions!CustomInstallerActions.FolderPermissions.SecureDataDirectory
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4652
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC93B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240699718 28 CustomInstallerActions!CustomInstallerActions.Processes.StopRunningProcesses
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID3EA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240702453 34 CustomInstallerActions!CustomInstallerActions.Service.ConfigureService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config CloudflareWARP depend= "wlansvc"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4956
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" failureflag CloudflareWARP 1
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1852
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config CloudflareWARP start=AUTO
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:4424

C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\System32\Wbem\wmic.exe
  wmic ComputerSystem get TotalPhysicalMemory /VALUE
  2⤵
  PID:4960

C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cloudflare WARP.exe

Path C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
Size 402KB
SHA256 0853ca6a5dd7e380e65afa160ad33747eb86af92694f3b2617c3851cb7adb5da
MD5 0eedb5d3e279d9a903885f70ffc5743b
SHA1 b452e41ba0212f2c7e14fc3fa32666c72539647d
SHA512 7c6d4501d4b209a2d68902e2753cff270aa24d3a30cdb09f2eaf89c91898506f1d1c48d8080282260a6fd50320313f8a95f21b394438a8f7de88f55891f35eb4
SSDEEP 6144:RnWzNxY+fSm6PiKXvsDGk5mbr3T9bK+xZRtiKzvzaODBlr:QxY+6m6qKXvoGk5mbbhbH5
TLSH
T15A94A1E666555C9DF2168C748D77B64087A1ACB10B6283CB134036BACEB36C5FE7B603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_links_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\app_links_plugin.dll
Size 147KB
SHA256 206b73fe73e9e2719e7f5794c6aaeaf8f9f3fe0f2dfbfe53f710ba2a0d5aeb2e
MD5 c67ba29f6e1805151909c07474674a0e
SHA1 9fe6f23537c8a5720fb3c6e971ac13659fb59b30
SHA512 634bdb98784c841ae8e08dfa73ea830c1c71d3b0c99c661a12ce1d3ca962535b26460c20bbbe734bd84f8508aa54a009b57c3c9cab91fb74fb61297742f72553
SSDEEP 3072:+GyhYxA365uvl1h/eDaZw8vTMpZdTdcCX9GTHATavBYcy:+GyhYO365uv4a9TMpZdTdcCQTHAkBTy
TLSH
T1DDE37E2BF71940A7D21AC17DCA934946EBB2B8960B9197CF17500B9B0F17BE81E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto_updater_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\auto_updater_windows_plugin.dll
Size 106KB
SHA256 b34a6dc4ecac40bf02a75e2847db35bfdd9b72214550a8b198686986fdec0252
MD5 3b3b3a7caacdf4e511c3b5f330667021
SHA1 e9fd1078beab1916c3dbbcbde0340390c23fcc7e
SHA512 bffa90b85772ee284096bf27f62a8ad364480ad677d702632674c38f137a8379bc66d9d06d635b270b7d296a9e81353bbba73d400da41273d947d752588ffced
SSDEEP 1536:NrH3NjUGY98Ev69NxozwmhPpxjHM87frP4H377awkmw9:Nrdo/98M6piBxjHM87frP4X7vBS
TLSH
T155B33C2BEA59509BD21AD87CCA978945DB71F8914BD1EBCF57504ACA0F13BE80F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_webview_window_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\desktop_webview_window_plugin.dll
Size 192KB
SHA256 9605a1f0d7012e3782e545dfe01c1ea5b6d47784deb5e1292f99ab860c71c8a1
MD5 630d42430730f69c235aef7624c66981
SHA1 e28e9b6330a929d9c32cda39576c89ff6087bd26
SHA512 c2f28d3bac26b2893416f8f6500d567f87abb4c3060f876e6cf948598369ed0218bcad1864d86120195bed9c2e4cb83329f08fd37358d6edd4c8af43ca68d0e2
SSDEEP 6144:b7l9tseTJepNq6PN8mVAv9OMvwLtqixqJbNbgHW3QYNb0xbDVbDbAbgbwmb4Qb0P:b7lLn6P+mVAv9OMvwNxqJbNbgHW3QYNB
TLSH
T12C142927B25910B6E16BD57CCE834A46F7B2B4825BA193CF175047BA0F57BE89E39300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_inappwebview_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_inappwebview_windows_plugin.dll
Size 957KB
SHA256 5c2d7f29463b21a87799c57bb3754146e89929b61cb7310b9218a61d7e6cec51
MD5 d5faf0f143403f868225bbbcace12156
SHA1 6752961a6ae287fc49a554d61ae073c0f0324521
SHA512 d6590737671d7c8ab92f345279709be1c89a9e077196eb55b8ab3b526ee52642731f04bff0b8b1dba25910f6dd5488982e639461fa1dc6d747f84308dfb88149
SSDEEP 24576:FQDXZQE1HedLRyl7GOhTX+rB3x6nTtOMf81HKE:FSZZedzmTX8B3ETMMfoH
TLSH
T1A5253A2F6B4C00BCE0B5C2BDCE578A51E773B48A07A1C7CB1690065A7E677E48E79712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\screen_retriever_windows_plugin.dll
Size 128KB
SHA256 9507319ab9f48620a798f630c46fb6897589c6afb116ee2bc85506e43b757052
MD5 1bda5cbdf46ba1896d7bd90aa30daef9
SHA1 d7d394eaa6a92f7831386a2458f4cc7736572516
SHA512 aca8a8d018a20ab24524be97ba4687193167d013b73262d7611d4b01956f865874bc0f1b2eb24069446bbc1d47db9100e9f18e01d94d51b9b0980e88a998f2e8
SSDEEP 1536:Eeep96cBfMbsl0QzwzJ6u+mxCb853hhrStBST1sp0+dTMp+eC+A7mju80F7awkmi:EFgNiuJ6MR9GtoTwTMp+eC+A7w2vBi
TLSH
T128D34C2BF719406BD22AC479CD838D56DB71B8914B91A7CF57904A9B0F27BE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\share_plus_plugin.dll
Size 143KB
SHA256 322003b7243fb51a6c65df6111093461099febdbef25ff11a3ab07ffb09322f9
MD5 ab6667dd032f71534fae4f4a9dc60f55
SHA1 e93c8362b7ab081db36d22f39d346e898c8d2ad8
SHA512 f082eb492b1380fb812789ef5334e2d68ad1dd0eacd529004342e7d3743baa86f5345ad8a5b649b7a824cc0779678a2a8cac600e3de700e557ba04f81ead9c02
SSDEEP 1536:XK3tgH/jIzIpis96dt6xM1AKPPv58Aj/1tMfT4yAxYMUvRn5k6f/U/0e/5Qe+WPl:Xctij6WoAKPPvjj/1tMfT4yAsE+vBi
TLSH
T177E34B27BA1C409BD12AA478D943CA55D772F8A64F9183CB37614B9F4F63BD80E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_recovery_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\system_recovery_plugin.dll
Size 121KB
SHA256 609a290aa20348b97d13255b0ddafd1471a610c5d157aa9093f2a54a0fca7c0d
MD5 46e02bc9a2189024f9342ee6270c4455
SHA1 abdaf57db5dbdd2c382a7a8ea6bce77d109f3aeb
SHA512 d51bbefeb3935b04e0dcd133b20d6a3a43c72ae08e4a040a2019d9dc241f0f9bd02cddf933062bc05c3fcdc8b6372ede731d7d57ea9adb3fec51cc5c53b7ba0c
SSDEEP 3072:gq0fX65/PWGH3V7OOvpZJcf1HYIzIvB6:gFX65/AOvpZJcf1HYIzyB
TLSH
T1B4C35C2BEB6950ABD21AC478C9478916DB71B8D547A0A7CF17800ADA0F17FE84F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\tray_manager_plugin.dll
Size 116KB
SHA256 225ad3132a0c010d30445c98acceea1ff2c35ac0bd07ee2f9ea0cc395a363c10
MD5 c4ee7f4b8db7b50e251dad4f113e3fbf
SHA1 e2e62b8dd12982ad82dae1e4e14a5ed5f9abfd4c
SHA512 ae55abfcd221b02ac8b9bdce072bd0dd1d32abbcd28975ac8c990e13f180f81690016bdc1e3a68867247974de58dee87664893d9f527db532837a43c6e9c8d6e
SSDEEP 1536:0cc07ngb+Ye0LQu6gYWxJuo/JdgCMTFTvpZJHCAPMN43QN7awkmP:e0b00u6+w+vgCWxvpZJHCAPMNwAvB
TLSH
T1E2C35B2BEA5D40ABD26AC47CCD538916DFB2B8854791A7CF57500ADB0F27BE40E3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\url_launcher_windows_plugin.dll
Size 107KB
SHA256 1e92431aea7452e24559c590182a3cbc0e05a4de521c1a33e6a194b9f149976c
MD5 8eb503862c1e1bce0f958c83193f492d
SHA1 58571c76d21e28e2cfbecdfcc3f341732b0bb645
SHA512 b1f2fd10962e044a348dd5e2932148355dfe0dff269741b0aac191d42080951cfb18c0b564f86e1e1a86e3d6fe291cd75bf8a2bc4a36ee0add81368f993d6952
SSDEEP 1536:XGpZRNr942MEIxKj2a66rzCiVB2MN9LBwdIBBaM8xV/i7jigbW7awkmiO9:Xkvr942MPa6n7+hBsM8xV/i7juvBt9
TLSH
T166B34B3BAB1910AAD259D4B8CA934941DB72BCC54BD1A7CF13A04ADB0F67BD41F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_manager_plugin.dll
Size 138KB
SHA256 f4effd6e13808d0215c11ebeae4b0a8ae0b569b889c9507bae829f552165550c
MD5 70abb21c28478bda9b5a326de7b5cbb0
SHA1 8becc2ff5714429388e37a8a64cda5bd33fe2e66
SHA512 e393a1cdf723feba7cc6e432d74547e234ca96bf834aca6f45245d9da0162c00e4f31c6ad1a529f9f841aa9c6464fc4c534d2297cd8f57157e9b33742ff4d86c
SSDEEP 3072:YCRvX+KIDvi36enH/yuxaqe6VvpZJHJT5K0JGvBt:YCJX+KIDs6en6ie6VvpZJHJT5K0J0Bt
TLSH
T11AD36E2BF75900ABD25AD478CD828942DF72B8854B91D7CF07954A9B1F23BE41F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 6fc3f4e71ca0c4f7b2a04a774877fa362ed407d28c6bf24c8631b8d272da694e
MD5 5fa4f332d6be683c7948df31ac41d71d
SHA1 8bc304069217bdd9a8f83f8670498477496dc9ef
SHA512 70561bcb9dfe9a8f6be9e0301afbe29b71713a42c453f1e86dd5bc5fdb4d872844defdc3226b4ecc7674e89ca7917c08d65996e58f487096b6d3ac0819abe9f4
TLSH
T1CAF0DC2E69FA64F37906606C16F58C5962E0E6DE5DD7C12F343084C0439D0E0BA0702A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 727B
SHA256 6db6468b1ee84f7d649ed7e94665de701895dd9e11fc553fb0fe4a7f8fd90668
MD5 87709c3a18ecda561f2a12a695f1f49f
SHA1 2ceb248a3c02a025ba8b2427d65f0655d9282aa5
SHA512 b8386e0be33a0972e775eca6e85d8c8359f36a42286e8c7220be1cbe869f6cbc91e6c0a737020682aeab0d206f462ca8ebb935240c5581330dbd25ab3bb320bd
TLSH
T1690194277DF81A189F574EF46EEE2AF135C702211C7202A4EA3D10D0C099B22DF4F6A6
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 928311856bef48fe7ddaa17e5849ef8d807353643aa61672241692a1c8585b63
MD5 a9102118f8c4be0ddc5f435fcb01a464
SHA1 c1bf278ce33d0969df62de9172e9c1086ea51621
SHA512 287cd25835e35b3ef22f132be2fee1606ddaf2019a7fccc57fbd91f987fdb554081a9b19f52aa226168eb711d0716b27d9cb5de4156671449bfd30b7e5a40742
TLSH
T17701202256A81E0139261C16CF7C88DAB89F42FD0883025F2B6604C861CA77A9F12120
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 623f539d74f1cbbcdcd943a7b806874cac4738790f21867a4a30e1f9358c8f2f
MD5 ecfc17c44cb61f1d8cb9f046e2a924c2
SHA1 9f4d870a8149070f416494baf77678c81335fb17
SHA512 608a7e4ffc91d62bab30030ab621635af098d630f3a3e252d20ed988f349187fb1ce059f5c52d1ef99b5fcb24a040ef3bda4a214cb30ea56ed42e1d477ad4676
TLSH
T185E0C02013FF511FF5A0977503D580A69F29F0032C0452BE0E81042C5C0AA044C62C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 404B
SHA256 c9195d02a6d39ad473a9e53df792ed1ebb710b79d3a79e642860bd6426b8a8b1
MD5 cbb4c07837bc78e44f0210b85d95aad1
SHA1 932a1d918e580ca1023e88b7e015ebef68b09b1f
SHA512 e1c528f948164e821d73f8c4b9dbfbca0d618729b89e8c26f9f0908524a22257ba1fb260f6116cba452d6c4b87429cfcb3dd8d466412dd93bb080e9da3d355e9
TLSH
T163E0203421F5C55DF0F4943456F65C135A5DF11F4C0697B916545305A794B804DF1670
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 667ebec59e552b97782863f3256a1488ab1c1e3bb69ea5cd6a257a7896af6565
MD5 19bba111c2bccbf0a7997f92b2dee046
SHA1 6260f26992b6b0af34b815baca87c64006c9c3b9
SHA512 4671cdfb6fe4e9e28b2e6d19219ec457d13ce64ab5ef7d77c44f7f8f7cf54422c97f6560b26678360fb4bb84fe2b314904a248e67f195636f139f5f2b5514c0f
TLSH
T143E06F2822EBB52EF090983046E9E0B60E48E3012808C7BB0A900308BB2BE005E10EB0
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 651B
SHA256 549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
MD5 9bbfe11735bac43a2ed1be18d0655fe2
SHA1 61141928bb248fd6e9cd5084a9db05a9b980fb3a
SHA512 a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483
TLSH
T1B8F078702322F5D589032F431C5C659507FF07A8A564FE2CB9AE225FD82A1276F362E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSIBA52.tmp

Path C:\Windows\Installer\MSIBA52.tmp
Size 345KB
SHA256 b16b7dcf05fca6466d6528dc3c89c45463e27bbb6c76b76f9db8afe90bc9f372
MD5 97eebbf5bcb049f09bcb13ad7a4bab56
SHA1 0c1340cab9174171e2d58e897585b64a586a1a49
SHA512 c16f3dc5bfe0da5d7d02d26a4a5399cc62746b15840866fcd6883edcd71880a3f77de4620fec04f8def125a86d206f282fa0ae90555f250cc26a619590062e72
SSDEEP 6144:O0J39rrXzgzQIphn+Zf7x2yS73GTHe6g/j/CGHVLyuiubSB0:1JJr8phoTxJS730+LxVLJit0
TLSH
T10E74C000BAD48931F9FF593916788AA15A7E7DA01F70C9CF6748496A8E303C19B34B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA842176889346394A0936287B574D0692\CustomAction.config
Size 942B
SHA256 8a0c15fd64db64866ec57cf6344dad0f40a558bedf38d9801d02f37548f30344
MD5 2c039f283cd4f6de13a3c8a975a0311d
SHA1 aa2364d8f8cfe81ef136b4233e170a2fc69df4fb
SHA512 89e2df87142299b7fec70408e9370d165aa6174abd30c17f9e613032dd1cbb8fd6e907f7eee3f7c62efe19b3ac576ef985335f9977d9eb0564c9738b3f05c92c
TLSH
T18311D04D8A5457B7242127937BAC51D487A1E4AA39A4911C749FA9101B2993913633CF
MD5 SHA1 SHA512 TLSH

Submit Download

CustomInstallerActions.dll

Path C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\CustomInstallerActions.dll
Size 34KB
SHA256 f00f17c9efecb3a3a1edb48c1476872de7d93b42384904995a3896ef86bb41cc
MD5 0303923d5bc7c9f556bc83295c1d5edf
SHA1 584999769b1a32059d5cafc51606774d60c95817
SHA512 09ec4caa8bcc30e5e2f04116ad911c3e95d6c9be80d1ec59f6918c0b55d2cb2225472440d9f855f90ac92fa6e2c7f9f9912faff3128200964a6a96a38af80853
SSDEEP 768:JyW2R8TymM2t4n7gb0bfNGXiJFsEBsCvOj:o7R8GmM2JbAfgyJF/BsOOj
TLSH
T138F2948177FC5614F6FF6FB26DB145110AB2BD5AAC32DB1D29C4404E1972B809960F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCAAA1971707D46F9FAA95A1758FD9C55CE\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 dd4120702e4cc794705c0ad23ce1eaa265310ab96064fd23947f6dff38e8e680
MD5 599912457191503b65184f0d35a9dbc9
SHA1 60790092e6249b194732a606ac9dd7ac291f66ce
SHA512 cc07ae732a4cd1ba296a0f388b924c0b0280f2fde201409719087cae0c25fdcaec2af771d1734c64daa80c394832d3261e1675001e90a2fc046fda801833d60f
SSDEEP 3072:UOf7tVL6+Yvj12FuDHYQj69UgoTqddHYCnfKlRUjW01Kyqx3GR8UQQ:UgTex224Qj6jomdT8x2R2Q
TLSH
T166149C2657F8473ECEFF8B78E2A14212C7B1F1E67203D71D5D8281A62163784B692397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\System.Diagnostics.EventLog.dll
Size 37KB
SHA256 7b1e002e8f3616bf4d42413b7e587e2597d4f6aac013922aa7df3039089e388e
MD5 1f2726d75788dc641eb9cd45bcbe932f
SHA1 63c064f145eafb5ad8e611ea2ed0f6b9bac3da6c
SHA512 d1cd0eb1e1576fa9c4a52d150852994e0b236fe0a610060435964369ac57e4dd4a96ea275ed45ea0a21c6aba98b1496507b4b926517f3683e2b8b58497b28223
SSDEEP 384:xt7fxeD85CypGlMBm2PBf0QhJZcVcA7GTmRmH3OaXIZWnuWEnvWcLPDHRN7/V/cB:7TgDJlM82m+JSGTmAXOaYZWkndm9zgG
TLSH
T1A0034B65D3FC436EEEF60F70AB72D0160E39B6C67812D52E5159A48D2E32B408631B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\System.Security.Principal.Windows.dll
Size 17KB
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ServiceProcess.ServiceController.dll

Path C:\Windows\Installer\SFXCAF67B7C468A46C7E9B4B35F83283E32FB\System.ServiceProcess.ServiceController.dll
Size 22KB
SHA256 264aba3ab46ede36a81014543096c339fd0f249297f3619074272a8d8b32c81a
MD5 3390e22e4758fc9ee1f1255eff93339e
SHA1 86583cf347412da7f726819c2687364ff6d335bb
SHA512 350b170c37e93029eb58c236e65c352abd57e4051afb2341b47d7d8924ddaf10bde0503e94a2dc37c65c826917a0766d40595c6d84df62b2c9ae0d9068f82c3c
SSDEEP 384:R/SU1Gtf2PlJgGdXEkvxKWiWVzDupaWJ/hljHRN7p3/o7R9zBfY+Tj:JSkW2bgKXEPPDjp3c9zW+f
TLSH
T19FA24B6157BC4377CDAA0EB1A9B5D5532E38A3C52912D73F06D4E4062DA7B8CEA30339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 90e3a31b916c569380afd6036de345e45d90cf53a8a7f724b0968041153ff2fe
MD5 33e8e5032291ca9afacc25f183e4b700
SHA1 85b3dd8d6ef4b45394eef8f5446df66cb164bb1f
SHA512 9f3f402e6dc98cb16e545cc3016960633bef8a1a09d8d4aad4bd68aa245e01a00f16adfde1d31e1575edd014775659d5c5ab6c2412a01606402b6a60f5585ebe
SSDEEP 24576:Nu8m+1zkdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:W
TLSH
T1F647C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{94dbdd74-6e77-40b1-8526-6e2908b8b760}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{94dbdd74-6e77-40b1-8526-6e2908b8b760}_OnDiskSnapshotProp
Size 6KB
SHA256 1f1b4e28353e2b1e465e225e557e031c8225b4069da06639a28a52b7ed3325a3
MD5 d8ad860b9b69eafbf89f6f0db27a86ee
SHA1 961049ec9e028c46aeda0740d49fb68bff4a7eb9
SHA512 deafa152afa98556239ce7023a3725c40c0a6b2c4db25f5f687c625988b77701c64efc4e2f1d269971ddea3ddc7ba880ac2eaef5600d1dbeb509f26ababdc6c6
SSDEEP 96:FxYePWBAsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:RPEb++ZVmN
TLSH
T13CD188085AF54311E2B3AB312CF14553A877B911EF33CB8E0298238E2670A10F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-44-0x0000000002CC0000-0x0000000002CCE000-memory.dmp

Download

memory/1664-40-0x0000000002C80000-0x0000000002CB4000-memory.dmp

Download

memory/2036-111-0x00000000055A0000-0x00000000055C2000-memory.dmp

Download

memory/4228-1052-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-1032-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-1012-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-992-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-829-0x00007FF92A930000-0x00007FF92AB5F000-memory.dmp

Download

memory/4228-972-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-952-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-932-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-912-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-892-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-893-0x00007FF92A930000-0x00007FF92AB5F000-memory.dmp

Download

memory/4228-868-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-848-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4228-828-0x00007FF739280000-0x00007FF73C722000-memory.dmp

Download

memory/4236-796-0x000002A57C8F0000-0x000002A57C8F1000-memory.dmp

Download

memory/4236-817-0x00007FF92D130000-0x00007FF92D150000-memory.dmp

Download

memory/4236-816-0x00007FF92D150000-0x00007FF92D175000-memory.dmp

Download

memory/4236-815-0x00007FF92D180000-0x00007FF92D1A2000-memory.dmp

Download

memory/4236-814-0x00007FF92D1B0000-0x00007FF92D2A5000-memory.dmp

Download

memory/4236-812-0x00007FF92DD90000-0x00007FF92DDAB000-memory.dmp

Download

memory/4236-811-0x00007FF92DB00000-0x00007FF92DB26000-memory.dmp

Download

memory/4236-823-0x00007FF92D010000-0x00007FF92D099000-memory.dmp

Download

memory/4236-818-0x00007FF92D110000-0x00007FF92D130000-memory.dmp

Download

memory/4236-819-0x00007FF92D0F0000-0x00007FF92D10D000-memory.dmp

Download

memory/4236-846-0x00007FF92AD30000-0x00007FF92AFFB000-memory.dmp

Download

memory/4236-842-0x00007FF92B000000-0x00007FF92C24D000-memory.dmp

Download

memory/4236-820-0x00007FF92D0C0000-0x00007FF92D0E5000-memory.dmp

Download

memory/4236-821-0x00007FF92D0A0000-0x00007FF92D0B8000-memory.dmp

Download

memory/4236-824-0x00007FF93B570000-0x00007FF93B57C000-memory.dmp

Download

memory/4236-886-0x00007FF92B000000-0x00007FF92C24D000-memory.dmp

Download

memory/4236-825-0x00007FF92CFF0000-0x00007FF92D00E000-memory.dmp

Download

memory/4236-822-0x00007FF92B000000-0x00007FF92C24D000-memory.dmp

Download

memory/4236-826-0x00007FF92AD30000-0x00007FF92AFFB000-memory.dmp

Download

memory/4236-813-0x00007FF92DAC0000-0x00007FF92DAF2000-memory.dmp

Download

memory/4236-810-0x00007FF7D4550000-0x00007FF7D45B6000-memory.dmp

Download

memory/4236-798-0x000002A57EA50000-0x000002A57F5E1000-memory.dmp

Download

memory/4236-799-0x000002A57EA50000-0x000002A57F5E1000-memory.dmp

Download

memory/4236-800-0x000002A57C900000-0x000002A57C901000-memory.dmp

Download

memory/4236-797-0x000002A57EA50000-0x000002A57F5E1000-memory.dmp

Download