40ee1df774131155ebec51544bb714442e52102b44c3009fe8f2198b82a86394

Analysis

max time kernel
46s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cloudflare_WARP_2026.4.1390.0.msi
Size 49.8MB
Sample260621-g1ee9acy21
SHA256 40ee1df774131155ebec51544bb714442e52102b44c3009fe8f2198b82a86394
MD5 8870ff1e8a17dc3bb2d6f26bf4bd3206
SHA1 3b40088617d6df0e74e5727e8711d2d06abe7d03
SHA512 816e6b6944c9ca126e7789e6ec870ae2ba589afcfeb37845d1e285c77c8c7070cbc1191b1b0b963d1b71c0919226093db99a2ab3be3fa380c2b0b4e74bd0f25f
SSDEEP 1572864:sg8oO/C18bfcStE7br/J0QvYbhykzoxf/lwOKKjy:sJEraQAVzoxf+OKr
TLSH
T1F6B733C5B1711C79E897443582B687709A7B3C68674294CB8624B45EBF336F0E2BE783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
5520	Cloudflare WARP.exe
1244	warp-svc.exe

Loads dropped DLL 52 IoCs

pid	Process
1500	MsiExec.exe
1440	rundll32.exe
1440	rundll32.exe
1440	rundll32.exe
1440	rundll32.exe
1440	rundll32.exe
5752	MsiExec.exe
2820	rundll32.exe
2820	rundll32.exe
2820	rundll32.exe
2820	rundll32.exe
2820	rundll32.exe
5752	MsiExec.exe
1520	rundll32.exe
1520	rundll32.exe
1520	rundll32.exe
1520	rundll32.exe
1520	rundll32.exe
5752	MsiExec.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
5752	MsiExec.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
1244	warp-svc.exe
5520	Cloudflare WARP.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CloudflareWARP = "C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe"	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1020	msiexec.exe
3	1020	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1244	warp-svc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-byoip-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-connect-1-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-notification-announcements-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-numeric-minus-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-open-door-exit-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-pin-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-ransomware-attack-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-airplane-paper-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-account-analytics-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\arrow-drop-down.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-benefits-parental-leave-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloud-multi-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-download-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-expand-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\aws_lc_fips_0_13_7_rust_wrapper.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-applications-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-device-desktop-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-learning-center-book-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attacker-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-orbit-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-industry-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-price-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\cloud-connected.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-calendar-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-device-mobile-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-dex-digital-experience-monitoring-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-documentation-logs-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-info-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-github-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-refactor-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-reliability-timer-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-security-unlock-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-spam-email-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-arrow-backward-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-ip-truncation-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-optimization-web-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-platform-apps-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-price-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-server-1-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-target-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-preemptive-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-user-add-member-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\tray_manager_plugin.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-device-mobile-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-pull-request-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\warp-dex.exe	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\tray_icons\icons\attention_disconnected_dark.ico	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-caret-up-2-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-media-play-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-caret-up-1-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-open-sidepanel-right-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-optimization-gear-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-platform-apps-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\msvcp140.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\yes-check-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\tray_icons\pdfs\attention_disconnected.pdf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attention-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-reliability-dns-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-radar-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-web3-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-icard-view-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-regional-services-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-satellite-solid.svg	msiexec.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCAF0016DA4914924F8526A83772E0DE609\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAB7B1339E524844AB4C875CCF7C4F8D86\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\{9E49837E-2971-413F-9587-119FA819E572}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF72A7CE882A5F229E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAD263FE0D4D42F00A219DE330B1800C19\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAD263FE0D4D42F00A219DE330B1800C19\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF0016DA4914924F8526A83772E0DE609\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI658A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAB7B1339E524844AB4C875CCF7C4F8D86\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e594b09.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAD263FE0D4D42F00A219DE330B1800C19\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF0016DA4914924F8526A83772E0DE609\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF0016DA4914924F8526A83772E0DE609\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAB7B1339E524844AB4C875CCF7C4F8D86\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\System.ServiceProcess.ServiceController.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{9E49837E-2971-413F-9587-119FA819E572}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FCC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAB7B1339E524844AB4C875CCF7C4F8D86\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{9E49837E-2971-413F-9587-119FA819E572}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\CustomInstallerActions.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFA20B1E1B9DDBEC6C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAF0016DA4914924F8526A83772E0DE609\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF0016DA4914924F8526A83772E0DE609\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAB7B1339E524844AB4C875CCF7C4F8D86\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAD263FE0D4D42F00A219DE330B1800C19\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI74BE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD474C355DF5E90D8.TMP	msiexec.exe
File created	C:\Windows\Installer\e594b09.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI553A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BF2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6144.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAB7B1339E524844AB4C875CCF7C4F8D86\CustomInstallerActions.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF449CA04BDB708831.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAD263FE0D4D42F00A219DE330B1800C19\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAD263FE0D4D42F00A219DE330B1800C19\System.Diagnostics.EventLog.dll	rundll32.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4708	sc.exe
5036	sc.exe
1404	sc.exe
3408	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1020	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000087e67ffcd5645fff0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380187e67ffc0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410187e67ffc000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e387e67ffc00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e687e67ffc00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\ = "URL:com.cloudflare.warp Protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{1EB7B330-A41B-4EA8-9640-AB2C6A39BBEE}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\", 1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\" \"%1\""	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{55A03ADC-FF0A-4A39-A034-7F7C04C522CE}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100006b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 6b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d70f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a6b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc652000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1440	rundll32.exe
1440	rundll32.exe
4640	msiexec.exe
4640	msiexec.exe
2104	rundll32.exe
2104	rundll32.exe
1244	warp-svc.exe
1244	warp-svc.exe
1244	warp-svc.exe
1244	warp-svc.exe
1244	warp-svc.exe
1244	warp-svc.exe
4748	explorer.exe
4748	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1020	msiexec.exe
Token: SeSecurityPrivilege	4640	msiexec.exe
Token: SeCreateTokenPrivilege	1020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1020	msiexec.exe
Token: SeLockMemoryPrivilege	1020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1020	msiexec.exe
Token: SeMachineAccountPrivilege	1020	msiexec.exe
Token: SeTcbPrivilege	1020	msiexec.exe
Token: SeSecurityPrivilege	1020	msiexec.exe
Token: SeTakeOwnershipPrivilege	1020	msiexec.exe
Token: SeLoadDriverPrivilege	1020	msiexec.exe
Token: SeSystemProfilePrivilege	1020	msiexec.exe
Token: SeSystemtimePrivilege	1020	msiexec.exe
Token: SeProfSingleProcessPrivilege	1020	msiexec.exe
Token: SeIncBasePriorityPrivilege	1020	msiexec.exe
Token: SeCreatePagefilePrivilege	1020	msiexec.exe
Token: SeCreatePermanentPrivilege	1020	msiexec.exe
Token: SeBackupPrivilege	1020	msiexec.exe
Token: SeRestorePrivilege	1020	msiexec.exe
Token: SeShutdownPrivilege	1020	msiexec.exe
Token: SeDebugPrivilege	1020	msiexec.exe
Token: SeAuditPrivilege	1020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1020	msiexec.exe
Token: SeChangeNotifyPrivilege	1020	msiexec.exe
Token: SeRemoteShutdownPrivilege	1020	msiexec.exe
Token: SeUndockPrivilege	1020	msiexec.exe
Token: SeSyncAgentPrivilege	1020	msiexec.exe
Token: SeEnableDelegationPrivilege	1020	msiexec.exe
Token: SeManageVolumePrivilege	1020	msiexec.exe
Token: SeImpersonatePrivilege	1020	msiexec.exe
Token: SeCreateGlobalPrivilege	1020	msiexec.exe
Token: SeBackupPrivilege	2728	vssvc.exe
Token: SeRestorePrivilege	2728	vssvc.exe
Token: SeAuditPrivilege	2728	vssvc.exe
Token: SeBackupPrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeBackupPrivilege	2888	srtasks.exe
Token: SeRestorePrivilege	2888	srtasks.exe
Token: SeSecurityPrivilege	2888	srtasks.exe
Token: SeTakeOwnershipPrivilege	2888	srtasks.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeBackupPrivilege	2888	srtasks.exe
Token: SeRestorePrivilege	2888	srtasks.exe
Token: SeSecurityPrivilege	2888	srtasks.exe
Token: SeTakeOwnershipPrivilege	2888	srtasks.exe
Token: SeDebugPrivilege	1440	rundll32.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeDebugPrivilege	2104	rundll32.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeSecurityPrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1020	msiexec.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
1020	msiexec.exe
2740	sihost.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
5520	Cloudflare WARP.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
5520	Cloudflare WARP.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1020	msiexec.exe
4640	msiexec.exe
1500	MsiExec.exe
5752	MsiExec.exe
5520	Cloudflare WARP.exe
5520	Cloudflare WARP.exe
252	StartMenuExperienceHost.exe
304	SearchHost.exe
4748	explorer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2888	4640	msiexec.exe	93
PID 4640 wrote to memory of 1500	4640	msiexec.exe	95
PID 1500 wrote to memory of 1440	1500	MsiExec.exe	96
PID 4640 wrote to memory of 5752	4640	msiexec.exe	97
PID 5752 wrote to memory of 2820	5752	MsiExec.exe	98
PID 5752 wrote to memory of 1520	5752	MsiExec.exe	99
PID 5752 wrote to memory of 2104	5752	MsiExec.exe	100
PID 5752 wrote to memory of 3532	5752	MsiExec.exe	102
PID 3532 wrote to memory of 3408	3532	rundll32.exe	103
PID 3532 wrote to memory of 4708	3532	rundll32.exe	105
PID 3532 wrote to memory of 5036	3532	rundll32.exe	107
PID 3532 wrote to memory of 1404	3532	rundll32.exe	109
PID 2740 wrote to memory of 4748	2740	sihost.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.4.1390.0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1708826DC48B402172901FC90DD8E54
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI553A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240735921 2 CustomInstallerActions!CustomInstallerActions.Processes.KillGUIProcess
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5EC74A667FA678FEDFF8DDA2073DBD83 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5FCC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240738359 7 CustomInstallerActions!CustomInstallerActions.CustomActions.ReadCmdLineParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2820
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6144.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240738656 18 CustomInstallerActions!CustomInstallerActions.FolderPermissions.SecureDataDirectory
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1520
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI658A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739765 28 CustomInstallerActions!CustomInstallerActions.Processes.StopRunningProcesses
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI74BE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240743656 34 CustomInstallerActions!CustomInstallerActions.Service.ConfigureService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config CloudflareWARP depend= "wlansvc"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3408
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4708
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" failureflag CloudflareWARP 1
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5036
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config CloudflareWARP start=AUTO
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5520
- C:\Windows\System32\Wbem\wmic.exe
  wmic ComputerSystem get TotalPhysicalMemory /VALUE
  2⤵
  PID:1036

C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:4212

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4748

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:304

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cloudflare WARP.exe

Path C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
Size 402KB
SHA256 0853ca6a5dd7e380e65afa160ad33747eb86af92694f3b2617c3851cb7adb5da
MD5 0eedb5d3e279d9a903885f70ffc5743b
SHA1 b452e41ba0212f2c7e14fc3fa32666c72539647d
SHA512 7c6d4501d4b209a2d68902e2753cff270aa24d3a30cdb09f2eaf89c91898506f1d1c48d8080282260a6fd50320313f8a95f21b394438a8f7de88f55891f35eb4
SSDEEP 6144:RnWzNxY+fSm6PiKXvsDGk5mbr3T9bK+xZRtiKzvzaODBlr:QxY+6m6qKXvoGk5mbbhbH5
TLSH
T15A94A1E666555C9DF2168C748D77B64087A1ACB10B6283CB134036BACEB36C5FE7B603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_links_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\app_links_plugin.dll
Size 147KB
SHA256 206b73fe73e9e2719e7f5794c6aaeaf8f9f3fe0f2dfbfe53f710ba2a0d5aeb2e
MD5 c67ba29f6e1805151909c07474674a0e
SHA1 9fe6f23537c8a5720fb3c6e971ac13659fb59b30
SHA512 634bdb98784c841ae8e08dfa73ea830c1c71d3b0c99c661a12ce1d3ca962535b26460c20bbbe734bd84f8508aa54a009b57c3c9cab91fb74fb61297742f72553
SSDEEP 3072:+GyhYxA365uvl1h/eDaZw8vTMpZdTdcCX9GTHATavBYcy:+GyhYO365uv4a9TMpZdTdcCQTHAkBTy
TLSH
T1DDE37E2BF71940A7D21AC17DCA934946EBB2B8960B9197CF17500B9B0F17BE81E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto_updater_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\auto_updater_windows_plugin.dll
Size 106KB
SHA256 b34a6dc4ecac40bf02a75e2847db35bfdd9b72214550a8b198686986fdec0252
MD5 3b3b3a7caacdf4e511c3b5f330667021
SHA1 e9fd1078beab1916c3dbbcbde0340390c23fcc7e
SHA512 bffa90b85772ee284096bf27f62a8ad364480ad677d702632674c38f137a8379bc66d9d06d635b270b7d296a9e81353bbba73d400da41273d947d752588ffced
SSDEEP 1536:NrH3NjUGY98Ev69NxozwmhPpxjHM87frP4H377awkmw9:Nrdo/98M6piBxjHM87frP4X7vBS
TLSH
T155B33C2BEA59509BD21AD87CCA978945DB71F8914BD1EBCF57504ACA0F13BE80F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_webview_window_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\desktop_webview_window_plugin.dll
Size 192KB
SHA256 9605a1f0d7012e3782e545dfe01c1ea5b6d47784deb5e1292f99ab860c71c8a1
MD5 630d42430730f69c235aef7624c66981
SHA1 e28e9b6330a929d9c32cda39576c89ff6087bd26
SHA512 c2f28d3bac26b2893416f8f6500d567f87abb4c3060f876e6cf948598369ed0218bcad1864d86120195bed9c2e4cb83329f08fd37358d6edd4c8af43ca68d0e2
SSDEEP 6144:b7l9tseTJepNq6PN8mVAv9OMvwLtqixqJbNbgHW3QYNb0xbDVbDbAbgbwmb4Qb0P:b7lLn6P+mVAv9OMvwNxqJbNbgHW3QYNB
TLSH
T12C142927B25910B6E16BD57CCE834A46F7B2B4825BA193CF175047BA0F57BE89E39300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_inappwebview_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_inappwebview_windows_plugin.dll
Size 957KB
SHA256 5c2d7f29463b21a87799c57bb3754146e89929b61cb7310b9218a61d7e6cec51
MD5 d5faf0f143403f868225bbbcace12156
SHA1 6752961a6ae287fc49a554d61ae073c0f0324521
SHA512 d6590737671d7c8ab92f345279709be1c89a9e077196eb55b8ab3b526ee52642731f04bff0b8b1dba25910f6dd5488982e639461fa1dc6d747f84308dfb88149
SSDEEP 24576:FQDXZQE1HedLRyl7GOhTX+rB3x6nTtOMf81HKE:FSZZedzmTX8B3ETMMfoH
TLSH
T1A5253A2F6B4C00BCE0B5C2BDCE578A51E773B48A07A1C7CB1690065A7E677E48E79712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_windows.dll
Size 18.2MB
SHA256 ef979ba1d8401aa7eef5d4cd2abc5fa1dbebf6ae83382938522bb121cdd54bb0
MD5 e9cec1382e911c6894f8e4a2e8fc1d7a
SHA1 ad590e3e2dc76b7098e6bbef1b622a78b534067b
SHA512 2fc211a4538b49ef5227ca7e583972ebeedaba1f773ce49ebed5a40444e9da13df2ec6892dabc3dd545696508056e82ed3e855924b7004722ae0ff80781169bf
SSDEEP 196608:FK/sS1sgz8vY/qhZUQ9UgFqUA0hfrZng2:Y/hihZ1Uyq6frZng
TLSH
T1E1178D03F19640F9C48DE2788B5BA927E671B88E0621B5DF279847153FA7BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\screen_retriever_windows_plugin.dll
Size 128KB
SHA256 9507319ab9f48620a798f630c46fb6897589c6afb116ee2bc85506e43b757052
MD5 1bda5cbdf46ba1896d7bd90aa30daef9
SHA1 d7d394eaa6a92f7831386a2458f4cc7736572516
SHA512 aca8a8d018a20ab24524be97ba4687193167d013b73262d7611d4b01956f865874bc0f1b2eb24069446bbc1d47db9100e9f18e01d94d51b9b0980e88a998f2e8
SSDEEP 1536:Eeep96cBfMbsl0QzwzJ6u+mxCb853hhrStBST1sp0+dTMp+eC+A7mju80F7awkmi:EFgNiuJ6MR9GtoTwTMp+eC+A7w2vBi
TLSH
T128D34C2BF719406BD22AC479CD838D56DB71B8914B91A7CF57904A9B0F27BE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\share_plus_plugin.dll
Size 143KB
SHA256 322003b7243fb51a6c65df6111093461099febdbef25ff11a3ab07ffb09322f9
MD5 ab6667dd032f71534fae4f4a9dc60f55
SHA1 e93c8362b7ab081db36d22f39d346e898c8d2ad8
SHA512 f082eb492b1380fb812789ef5334e2d68ad1dd0eacd529004342e7d3743baa86f5345ad8a5b649b7a824cc0779678a2a8cac600e3de700e557ba04f81ead9c02
SSDEEP 1536:XK3tgH/jIzIpis96dt6xM1AKPPv58Aj/1tMfT4yAxYMUvRn5k6f/U/0e/5Qe+WPl:Xctij6WoAKPPvjj/1tMfT4yAsE+vBi
TLSH
T177E34B27BA1C409BD12AA478D943CA55D772F8A64F9183CB37614B9F4F63BD80E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_recovery_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\system_recovery_plugin.dll
Size 121KB
SHA256 609a290aa20348b97d13255b0ddafd1471a610c5d157aa9093f2a54a0fca7c0d
MD5 46e02bc9a2189024f9342ee6270c4455
SHA1 abdaf57db5dbdd2c382a7a8ea6bce77d109f3aeb
SHA512 d51bbefeb3935b04e0dcd133b20d6a3a43c72ae08e4a040a2019d9dc241f0f9bd02cddf933062bc05c3fcdc8b6372ede731d7d57ea9adb3fec51cc5c53b7ba0c
SSDEEP 3072:gq0fX65/PWGH3V7OOvpZJcf1HYIzIvB6:gFX65/AOvpZJcf1HYIzyB
TLSH
T1B4C35C2BEB6950ABD21AC478C9478916DB71B8D547A0A7CF17800ADA0F17FE84F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\tray_manager_plugin.dll
Size 116KB
SHA256 225ad3132a0c010d30445c98acceea1ff2c35ac0bd07ee2f9ea0cc395a363c10
MD5 c4ee7f4b8db7b50e251dad4f113e3fbf
SHA1 e2e62b8dd12982ad82dae1e4e14a5ed5f9abfd4c
SHA512 ae55abfcd221b02ac8b9bdce072bd0dd1d32abbcd28975ac8c990e13f180f81690016bdc1e3a68867247974de58dee87664893d9f527db532837a43c6e9c8d6e
SSDEEP 1536:0cc07ngb+Ye0LQu6gYWxJuo/JdgCMTFTvpZJHCAPMN43QN7awkmP:e0b00u6+w+vgCWxvpZJHCAPMNwAvB
TLSH
T1E2C35B2BEA5D40ABD26AC47CCD538916DFB2B8854791A7CF57500ADB0F27BE40E3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\url_launcher_windows_plugin.dll
Size 107KB
SHA256 1e92431aea7452e24559c590182a3cbc0e05a4de521c1a33e6a194b9f149976c
MD5 8eb503862c1e1bce0f958c83193f492d
SHA1 58571c76d21e28e2cfbecdfcc3f341732b0bb645
SHA512 b1f2fd10962e044a348dd5e2932148355dfe0dff269741b0aac191d42080951cfb18c0b564f86e1e1a86e3d6fe291cd75bf8a2bc4a36ee0add81368f993d6952
SSDEEP 1536:XGpZRNr942MEIxKj2a66rzCiVB2MN9LBwdIBBaM8xV/i7jigbW7awkmiO9:Xkvr942MPa6n7+hBsM8xV/i7juvBt9
TLSH
T166B34B3BAB1910AAD259D4B8CA934941DB72BCC54BD1A7CF13A04ADB0F67BD41F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_manager_plugin.dll
Size 138KB
SHA256 f4effd6e13808d0215c11ebeae4b0a8ae0b569b889c9507bae829f552165550c
MD5 70abb21c28478bda9b5a326de7b5cbb0
SHA1 8becc2ff5714429388e37a8a64cda5bd33fe2e66
SHA512 e393a1cdf723feba7cc6e432d74547e234ca96bf834aca6f45245d9da0162c00e4f31c6ad1a529f9f841aa9c6464fc4c534d2297cd8f57157e9b33742ff4d86c
SSDEEP 3072:YCRvX+KIDvi36enH/yuxaqe6VvpZJHJT5K0JGvBt:YCJX+KIDs6en6ie6VvpZJHJT5K0J0Bt
TLSH
T11AD36E2BF75900ABD25AD478CD828942DF72B8854B91D7CF07954A9B1F23BE41F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_to_front_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_to_front_plugin.dll
Size 90KB
SHA256 6017c77cd99bc8a77646d08207f0f4123c7405c315b951a72e8c5d0746e7db01
MD5 6f8487b1584b9e4ede44e910f24d64d6
SHA1 771cbe9acc672549e1bb342627b967bf7b89b67f
SHA512 a927f6d1e524dfae9a0b6302ce97ad50fb1f75fc63ed75751430afd5008c870fb8b9477d470fc45af3bb05120d5ac6fd4579a325b8c334bbacd40c1d5dc3b3b8
SSDEEP 1536:Ug6FFF63L7Dx7c3wU5qp8e84l8tivAqWjMnmEBwz7awkm5v+:Udx6lwipL8PivAqWjMnsvB
TLSH
T170933C2BEA59506BD219D878C9838D15DB72B8824BD1A7CF57500EDB0F67BE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 727B
SHA256 6db6468b1ee84f7d649ed7e94665de701895dd9e11fc553fb0fe4a7f8fd90668
MD5 87709c3a18ecda561f2a12a695f1f49f
SHA1 2ceb248a3c02a025ba8b2427d65f0655d9282aa5
SHA512 b8386e0be33a0972e775eca6e85d8c8359f36a42286e8c7220be1cbe869f6cbc91e6c0a737020682aeab0d206f462ca8ebb935240c5581330dbd25ab3bb320bd
TLSH
T1690194277DF81A189F574EF46EEE2AF135C702211C7202A4EA3D10D0C099B22DF4F6A6
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 404B
SHA256 f8dfe2b8335763342b756c214290849e2d84db6fc18566646d8822677fee514f
MD5 a3041da391c96820c7aff70b243dffe3
SHA1 ab1fd2f3e92911612d8dda8fc562bb26928425e2
SHA512 fb5facb5c1d85f14ef315fa3ace9b4d0b483e19e9322d92f45768435648161ac4943e04bdd53f1c00114357dfef19f4ba88e4369dc2e0f76d739bdf032bbbe12
TLSH
T142E0263422FAC55EF0F5A4385AFA5C236A5DF20F1C0697B916445345AA95B804CF1B30
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

MSI553A.tmp

Path C:\Windows\Installer\MSI553A.tmp
Size 345KB
SHA256 b16b7dcf05fca6466d6528dc3c89c45463e27bbb6c76b76f9db8afe90bc9f372
MD5 97eebbf5bcb049f09bcb13ad7a4bab56
SHA1 0c1340cab9174171e2d58e897585b64a586a1a49
SHA512 c16f3dc5bfe0da5d7d02d26a4a5399cc62746b15840866fcd6883edcd71880a3f77de4620fec04f8def125a86d206f282fa0ae90555f250cc26a619590062e72
SSDEEP 6144:O0J39rrXzgzQIphn+Zf7x2yS73GTHe6g/j/CGHVLyuiubSB0:1JJr8phoTxJS730+LxVLJit0
TLSH
T10E74C000BAD48931F9FF593916788AA15A7E7DA01F70C9CF6748496A8E303C19B34B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomInstallerActions.dll

Path C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\CustomInstallerActions.dll
Size 34KB
SHA256 f00f17c9efecb3a3a1edb48c1476872de7d93b42384904995a3896ef86bb41cc
MD5 0303923d5bc7c9f556bc83295c1d5edf
SHA1 584999769b1a32059d5cafc51606774d60c95817
SHA512 09ec4caa8bcc30e5e2f04116ad911c3e95d6c9be80d1ec59f6918c0b55d2cb2225472440d9f855f90ac92fa6e2c7f9f9912faff3128200964a6a96a38af80853
SSDEEP 768:JyW2R8TymM2t4n7gb0bfNGXiJFsEBsCvOj:o7R8GmM2JbAfgyJF/BsOOj
TLSH
T138F2948177FC5614F6FF6FB26DB145110AB2BD5AAC32DB1D29C4404E1972B809960F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA3F17B7CAC94F08888CE9BF4ED731E169\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 dd4120702e4cc794705c0ad23ce1eaa265310ab96064fd23947f6dff38e8e680
MD5 599912457191503b65184f0d35a9dbc9
SHA1 60790092e6249b194732a606ac9dd7ac291f66ce
SHA512 cc07ae732a4cd1ba296a0f388b924c0b0280f2fde201409719087cae0c25fdcaec2af771d1734c64daa80c394832d3261e1675001e90a2fc046fda801833d60f
SSDEEP 3072:UOf7tVL6+Yvj12FuDHYQj69UgoTqddHYCnfKlRUjW01Kyqx3GR8UQQ:UgTex224Qj6jomdT8x2R2Q
TLSH
T166149C2657F8473ECEFF8B78E2A14212C7B1F1E67203D71D5D8281A62163784B692397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\System.Diagnostics.EventLog.dll
Size 37KB
SHA256 7b1e002e8f3616bf4d42413b7e587e2597d4f6aac013922aa7df3039089e388e
MD5 1f2726d75788dc641eb9cd45bcbe932f
SHA1 63c064f145eafb5ad8e611ea2ed0f6b9bac3da6c
SHA512 d1cd0eb1e1576fa9c4a52d150852994e0b236fe0a610060435964369ac57e4dd4a96ea275ed45ea0a21c6aba98b1496507b4b926517f3683e2b8b58497b28223
SSDEEP 384:xt7fxeD85CypGlMBm2PBf0QhJZcVcA7GTmRmH3OaXIZWnuWEnvWcLPDHRN7/V/cB:7TgDJlM82m+JSGTmAXOaYZWkndm9zgG
TLSH
T1A0034B65D3FC436EEEF60F70AB72D0160E39B6C67812D52E5159A48D2E32B408631B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\System.Security.Principal.Windows.dll
Size 17KB
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ServiceProcess.ServiceController.dll

Path C:\Windows\Installer\SFXCA6A9A85CC6244F9B8017B36819F6C10FE\System.ServiceProcess.ServiceController.dll
Size 22KB
SHA256 264aba3ab46ede36a81014543096c339fd0f249297f3619074272a8d8b32c81a
MD5 3390e22e4758fc9ee1f1255eff93339e
SHA1 86583cf347412da7f726819c2687364ff6d335bb
SHA512 350b170c37e93029eb58c236e65c352abd57e4051afb2341b47d7d8924ddaf10bde0503e94a2dc37c65c826917a0766d40595c6d84df62b2c9ae0d9068f82c3c
SSDEEP 384:R/SU1Gtf2PlJgGdXEkvxKWiWVzDupaWJ/hljHRN7p3/o7R9zBfY+Tj:JSkW2bgKXEPPDjp3c9zW+f
TLSH
T19FA24B6157BC4377CDAA0EB1A9B5D5532E38A3C52912D73F06D4E4062DA7B8CEA30339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCAD263FE0D4D42F00A219DE330B1800C19\CustomAction.config
Size 942B
SHA256 8a0c15fd64db64866ec57cf6344dad0f40a558bedf38d9801d02f37548f30344
MD5 2c039f283cd4f6de13a3c8a975a0311d
SHA1 aa2364d8f8cfe81ef136b4233e170a2fc69df4fb
SHA512 89e2df87142299b7fec70408e9370d165aa6174abd30c17f9e613032dd1cbb8fd6e907f7eee3f7c62efe19b3ac576ef985335f9977d9eb0564c9738b3f05c92c
TLSH
T18311D04D8A5457B7242127937BAC51D487A1E4AA39A4911C749FA9101B2993913633CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 126eed6d2161c6140e2ea011fe3705f031aecc642040ede7c6d6743af1387715
MD5 a4118184825b65f03c6ff8c004ab5dcc
SHA1 c84c0d4dd79bb072096f3d1b792181b34d011871
SHA512 af22f1bd203f9ef101bfa5c139b320e081d443c9778b55cebfa4f65b154dfbf73318fca284efd3a9b2ee80c56c0b0e1a1bde48a46638f42cc0ff96c091eedc69
SSDEEP 24576:LFo3DMP0doO/vvTL/ywCSClgvL+Ipr1RU/UgtPs6k3s65lTCcoh2Sroz2u4:yHE
TLSH
T14857C02436F92210E7B79E3CACF06A274D397D5B9C15DE8D05411B8E0862F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{453f6ef2-ee42-4f27-8736-504e8758a276}_OnDiskSnapshotProp

Path \??\Volume{fc7fe687-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{453f6ef2-ee42-4f27-8736-504e8758a276}_OnDiskSnapshotProp
Size 6KB
SHA256 bb3b4aa2fa5f1a31afca0c010846f7d1e3b08327ca34f2e5b4f4ba151c6994fd
MD5 224933ecd00d6bee64272ddc0f8cfaa7
SHA1 10040a08426a9b7c12ee01fcc00d54057fedb85f
SHA512 2bf8d140c1a72de8364589f9b8e3777192850acccf333d96ab324df5d953e46e56c01ecd3f0dd4281b4707b4741d796ee5422d4df190e0c73e079801e7c41eff
SSDEEP 96:F7lsWRNvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Nls+b++uVmN
TLSH
T16ED178185AE54711E2B3AB312CF18557A877B911EF33CB8E0198238E6671A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/304-869-0x000002BE57520000-0x000002BE57540000-memory.dmp

Download

memory/304-837-0x000002BE45CE0000-0x000002BE45D00000-memory.dmp

Download

memory/304-824-0x000002B642AC0000-0x000002B642BC0000-memory.dmp

Download

memory/304-855-0x000002BE45F80000-0x000002BE45FA0000-memory.dmp

Download

memory/304-839-0x000002BE57190000-0x000002BE57290000-memory.dmp

Download

memory/1244-1134-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1049-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1112-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1091-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1070-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1071-0x00007FFABF870000-0x00007FFABFA9F000-memory.dmp

Download

memory/1244-821-0x00007FFABF870000-0x00007FFABFA9F000-memory.dmp

Download

memory/1244-820-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1024-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1218-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1155-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1176-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1244-1197-0x00007FF7AE230000-0x00007FF7B16D2000-memory.dmp

Download

memory/1440-34-0x0000000003620000-0x000000000362E000-memory.dmp

Download

memory/1440-30-0x0000000003650000-0x0000000003684000-memory.dmp

Download

memory/2104-99-0x00000000054E0000-0x0000000005502000-memory.dmp

Download

memory/5520-801-0x00007FF611C30000-0x00007FF611C96000-memory.dmp

Download

memory/5520-1021-0x00007FFABD960000-0x00007FFABEBAD000-memory.dmp

Download

memory/5520-803-0x00007FFACBFE0000-0x00007FFACC012000-memory.dmp

Download

memory/5520-806-0x00007FFAC9360000-0x00007FFAC9385000-memory.dmp

Download

memory/5520-817-0x00007FFABD960000-0x00007FFABEBAD000-memory.dmp

Download

memory/5520-804-0x00007FFACB530000-0x00007FFACB556000-memory.dmp

Download

memory/5520-805-0x00007FFACB490000-0x00007FFACB4B2000-memory.dmp

Download

memory/5520-807-0x00007FFAD1A50000-0x00007FFAD1A70000-memory.dmp

Download

memory/5520-808-0x00007FFAC00F0000-0x00007FFAC01E5000-memory.dmp

Download

memory/5520-809-0x00007FFACD730000-0x00007FFACD74D000-memory.dmp

Download

memory/5520-810-0x00007FFAC9330000-0x00007FFAC9355000-memory.dmp

Download

memory/5520-811-0x00007FFAC8C60000-0x00007FFAC8CE9000-memory.dmp

Download

memory/5520-1020-0x00007FFABFE20000-0x00007FFAC00EB000-memory.dmp

Download

memory/5520-802-0x00007FFAD1EC0000-0x00007FFAD1EDB000-memory.dmp

Download

memory/5520-812-0x00007FFAD72F0000-0x00007FFAD72FC000-memory.dmp

Download

memory/5520-816-0x00007FFABFE20000-0x00007FFAC00EB000-memory.dmp

Download

memory/5520-1067-0x00007FFABD960000-0x00007FFABEBAD000-memory.dmp

Download

memory/5520-813-0x00007FFACB510000-0x00007FFACB52E000-memory.dmp

Download

memory/5520-814-0x00007FFACB470000-0x00007FFACB490000-memory.dmp

Download

memory/5520-815-0x00007FFAC9120000-0x00007FFAC9138000-memory.dmp

Download

memory/5520-819-0x00007FFABFCF0000-0x00007FFABFD0B000-memory.dmp

Download

memory/5520-792-0x00000298C5170000-0x00000298C5D01000-memory.dmp

Download

memory/5520-791-0x00000298C5170000-0x00000298C5D01000-memory.dmp

Download

memory/5520-790-0x00000298C5170000-0x00000298C5D01000-memory.dmp

Download

memory/5520-793-0x00000298C2580000-0x00000298C2581000-memory.dmp

Download

memory/5520-789-0x00000298C2570000-0x00000298C2571000-memory.dmp

Download