78c3890e9f4efcf3f181c0d96ba05ce5d3a7f48e7bed0faa69888fb73c13ab1d

Analysis

max time kernel
600s
max time network
579s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cloudflare_WARP_2026.5.1155.1.msi
Size 53.4MB
Sample260708-hrpejact4w
SHA256 78c3890e9f4efcf3f181c0d96ba05ce5d3a7f48e7bed0faa69888fb73c13ab1d
MD5 5511cd4b9a3dd7e2d778618ca7d53074
SHA1 a338690567ff6f607c3aa971ffac9022cd775fff
SHA512 7c80b5c456a0df3addf423128338f63f60bc3a24bd2233d2a5225997245ee1ab141ff458c00885996291e39bb43dcdbf0e058609f7273c4150962e4eb6b6e67c
SSDEEP 1572864:uHr1Why/AawFELvk6dlZBOykkuS9/1KOTNVCv0gqN3Pj:aYkAawFWBOY99FZVZB7
TLSH
T1D6C733907A610CAAE6E60574C4A5D260DFB33C452B6280FF47B0B15E9E3B16437BFB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
4340	Cloudflare WARP.exe
1756	warp-svc.exe

Loads dropped DLL 42 IoCs

pid	Process
3068	MsiExec.exe
984	rundll32.exe
984	rundll32.exe
984	rundll32.exe
868	MsiExec.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
868	MsiExec.exe
3032	rundll32.exe
3032	rundll32.exe
3032	rundll32.exe
868	MsiExec.exe
5820	rundll32.exe
5820	rundll32.exe
5820	rundll32.exe
868	MsiExec.exe
1532	rundll32.exe
1532	rundll32.exe
1532	rundll32.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
1756	warp-svc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CloudflareWARP = "C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe"	msiexec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2480	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1756	warp-svc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-auto-rag-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-satellite-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-arrow-twoway-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attacker-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-case-study-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-feedback-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-image-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-server-origin-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-zero-trust-risk-scoring-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-drive-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-benefits-parental-leave-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloud-upload-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-magic-transit-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-radar-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-edit-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-learning-center-book-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-regional-services-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\icudtl.dat	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\install-vpn.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\tray_icons\pdfs\attention.pdf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-durable-objects-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-security-network-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-location-pin-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-network-scale-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\json\warp_animation_connecting_loop.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\json\warp_animation_disconnected.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\json\warp_animation_transition_connected_disconnected.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-drag-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-time-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\json\warp_animation_transition_paused_connecting.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\tray_icons\icons\connected.ico	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-youtube-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-optimization-gear-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-optimization-web-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-sidebar-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-government-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-user-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\WinSparkle.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-complexity-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-filtering-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-refresh-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-email-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-numeric-1-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-caret-reorder-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-open-door-exit-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cell-tower-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-wechat-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-satellite-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-security-unlock-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-analytics-data-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-arrow-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-casb-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-more-1-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-reusable-components-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-time-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\button_icon\svgs\spinner.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-bundled-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-email-security-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\msvcp140_1.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\yes-check-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-arrow-external-link-1-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-bug-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-magic-firewall-outline.svg	msiexec.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCA4FEC67851A467F78B2152D20743F4535\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8DEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA4FEC67851A467F78B2152D20743F4535\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA13C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA9912C27819492D0B69CC3A67505674BA\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9912C27819492D0B69CC3A67505674BA\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e598505.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA4FEC67851A467F78B2152D20743F4535\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\System.Diagnostics.EventLog.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF33257E7E58EBE89B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAF18F243F04EFBDB4090CEC6F40A8702\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAF18F243F04EFBDB4090CEC6F40A8702\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAF18F243F04EFBDB4090CEC6F40A8702\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAF18F243F04EFBDB4090CEC6F40A8702\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\{306498F7-C0BD-4037-BBF5-70B1401676BF}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{306498F7-C0BD-4037-BBF5-70B1401676BF}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e598505.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAF18F243F04EFBDB4090CEC6F40A8702\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA4FEC67851A467F78B2152D20743F4535\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\System.Security.Principal.Windows.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFCD7738A6752818C6.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAF18F243F04EFBDB4090CEC6F40A8702\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI963C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA4FEC67851A467F78B2152D20743F4535\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9912C27819492D0B69CC3A67505674BA\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9912C27819492D0B69CC3A67505674BA\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9912C27819492D0B69CC3A67505674BA\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{306498F7-C0BD-4037-BBF5-70B1401676BF}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF199413DCFAA29A12.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9912C27819492D0B69CC3A67505674BA\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA4FEC67851A467F78B2152D20743F4535\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DF850E08EF2C67C819.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD72.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\CustomAction.config	rundll32.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4440	sc.exe
4156	sc.exe
5648	sc.exe
3792	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2480	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b21809b5aa32d6460000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b21809b50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b21809b5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b21809b500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b21809b500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 54 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{5B0B3D20-EF53-49DC-AFA4-89FEFFA184DA}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\ = "URL:com.cloudflare.warp Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\" \"%1\""	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\", 1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{63B05031-52A3-48CA-BE8E-8D80718139AD}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d70f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a6b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc652000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100006b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 6b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
984	rundll32.exe
984	rundll32.exe
1564	msiexec.exe
1564	msiexec.exe
5820	rundll32.exe
5820	rundll32.exe
1756	warp-svc.exe
1756	warp-svc.exe
1756	warp-svc.exe
1756	warp-svc.exe
1756	warp-svc.exe
1756	warp-svc.exe
1756	warp-svc.exe
1756	warp-svc.exe
5444	explorer.exe
5444	explorer.exe
2928	wmic.exe
2928	wmic.exe
2928	wmic.exe
2928	wmic.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2480	msiexec.exe
Token: SeSecurityPrivilege	1564	msiexec.exe
Token: SeCreateTokenPrivilege	2480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2480	msiexec.exe
Token: SeLockMemoryPrivilege	2480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2480	msiexec.exe
Token: SeMachineAccountPrivilege	2480	msiexec.exe
Token: SeTcbPrivilege	2480	msiexec.exe
Token: SeSecurityPrivilege	2480	msiexec.exe
Token: SeTakeOwnershipPrivilege	2480	msiexec.exe
Token: SeLoadDriverPrivilege	2480	msiexec.exe
Token: SeSystemProfilePrivilege	2480	msiexec.exe
Token: SeSystemtimePrivilege	2480	msiexec.exe
Token: SeProfSingleProcessPrivilege	2480	msiexec.exe
Token: SeIncBasePriorityPrivilege	2480	msiexec.exe
Token: SeCreatePagefilePrivilege	2480	msiexec.exe
Token: SeCreatePermanentPrivilege	2480	msiexec.exe
Token: SeBackupPrivilege	2480	msiexec.exe
Token: SeRestorePrivilege	2480	msiexec.exe
Token: SeShutdownPrivilege	2480	msiexec.exe
Token: SeDebugPrivilege	2480	msiexec.exe
Token: SeAuditPrivilege	2480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2480	msiexec.exe
Token: SeChangeNotifyPrivilege	2480	msiexec.exe
Token: SeRemoteShutdownPrivilege	2480	msiexec.exe
Token: SeUndockPrivilege	2480	msiexec.exe
Token: SeSyncAgentPrivilege	2480	msiexec.exe
Token: SeEnableDelegationPrivilege	2480	msiexec.exe
Token: SeManageVolumePrivilege	2480	msiexec.exe
Token: SeImpersonatePrivilege	2480	msiexec.exe
Token: SeCreateGlobalPrivilege	2480	msiexec.exe
Token: SeBackupPrivilege	5684	vssvc.exe
Token: SeRestorePrivilege	5684	vssvc.exe
Token: SeAuditPrivilege	5684	vssvc.exe
Token: SeBackupPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeBackupPrivilege	4700	srtasks.exe
Token: SeRestorePrivilege	4700	srtasks.exe
Token: SeSecurityPrivilege	4700	srtasks.exe
Token: SeTakeOwnershipPrivilege	4700	srtasks.exe
Token: SeDebugPrivilege	984	rundll32.exe
Token: SeBackupPrivilege	4700	srtasks.exe
Token: SeRestorePrivilege	4700	srtasks.exe
Token: SeSecurityPrivilege	4700	srtasks.exe
Token: SeTakeOwnershipPrivilege	4700	srtasks.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeDebugPrivilege	5820	rundll32.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeSecurityPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2480	msiexec.exe
1976	sihost.exe
2480	msiexec.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe
5444	explorer.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2480	msiexec.exe
1564	msiexec.exe
3068	MsiExec.exe
868	MsiExec.exe
4340	Cloudflare WARP.exe
4340	Cloudflare WARP.exe
4196	StartMenuExperienceHost.exe
5760	SearchHost.exe
5444	explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4700	1564	msiexec.exe	93
PID 1564 wrote to memory of 3068	1564	msiexec.exe	95
PID 3068 wrote to memory of 984	3068	MsiExec.exe	96
PID 1564 wrote to memory of 868	1564	msiexec.exe	97
PID 868 wrote to memory of 1628	868	MsiExec.exe	98
PID 868 wrote to memory of 3032	868	MsiExec.exe	99
PID 868 wrote to memory of 5820	868	MsiExec.exe	100
PID 868 wrote to memory of 1532	868	MsiExec.exe	104
PID 1532 wrote to memory of 4440	1532	rundll32.exe	106
PID 1532 wrote to memory of 4156	1532	rundll32.exe	108
PID 1532 wrote to memory of 5648	1532	rundll32.exe	112
PID 1532 wrote to memory of 3792	1532	rundll32.exe	114
PID 1976 wrote to memory of 5444	1976	sihost.exe	120
PID 4340 wrote to memory of 2928	4340	Cloudflare WARP.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.5.1155.1.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 189065432E413BD5DC2E5A22169D3238
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8DEE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750375 2 CustomInstallerActions!CustomInstallerActions.Processes.KillGUIProcess
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D5DFB9143A560F9F239457732C559443 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9AE1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753453 7 CustomInstallerActions!CustomInstallerActions.CustomActions.ReadCmdLineParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1628
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9C39.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753812 18 CustomInstallerActions!CustomInstallerActions.FolderPermissions.SecureDataDirectory
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3032
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA13C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755015 28 CustomInstallerActions!CustomInstallerActions.Processes.StopRunningProcesses
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIAD72.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240758187 34 CustomInstallerActions!CustomInstallerActions.Service.ConfigureService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP depend= "wlansvc"
      4⤵
      Launches sc.exe
      PID:4440
  - - C:\Windows\system32\sc.exe
      "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
      4⤵
      Launches sc.exe
      PID:4156
  - - C:\Windows\system32\sc.exe
      "sc.exe" failureflag CloudflareWARP 1
      4⤵
      Launches sc.exe
      PID:5648
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP start=AUTO
      4⤵
      Launches sc.exe
      PID:3792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5444

C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\System32\Wbem\wmic.exe
  wmic ComputerSystem get TotalPhysicalMemory /VALUE
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:3024

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4196

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cloudflare WARP.exe

Path C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
Size 402KB
SHA256 2e5e73f5f4c44821aad73eed5521f9b449049e35df9ceee480a2032f3d5b09b2
MD5 95b297d0350ac0efd380df3f23047fc2
SHA1 534531e31f284c9b07dd855f7d645c39969bdfcb
SHA512 bf4abaf27cdaca215234e6e742951779742f0d78d130948d6f106ba45759c6f8209410cb3cb4e240cc20d688484c27a4c980cbfb59fef23544026916585eaddf
SSDEEP 6144:QnWzNxY+fSm6PeKXvsDGk5mbrJJ9bK+xZRtiKzvzaOkBa:FxY+6m62KXvoGk5mbdXbma
TLSH
T11794A1E666555C9DF2168C748D77B64087A1ACB10B6283CB174036BACE736C5FE3B603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Webview2Loader.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\Webview2Loader.dll
Size 137KB
SHA256 f51b2d4239adaf40c33f9290d0d318d431e2932421b3bf8d39eba466853bc75d
MD5 02360e248215b8fdeec7af63b78df8d8
SHA1 aad528032fc3443a3e4025a63f63045c0351117d
SHA512 293e64f562e05c833c66d92335f9f5ffff576434abb1b22358a7bd46705f905e5cf6e5fabbe402e0f12c7a01a21bb8615a95f82d870e849e6ca147acba25dc39
SSDEEP 3072:g1Ua32yCHjjTrxvJ7KP+6hJug3esZTbEtnDzUwsramuLcRvB:4myCDj31JGW6fhEt0TiIB
TLSH
T142D36C5773E5007FE1668274C8A30A19E772B8511BA1DBDF03A842691F237D1AE3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSparkle.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\WinSparkle.dll
Size 2.7MB
SHA256 365939ade9d199bdc976953155419e48c730915dc9ba2f751ae7b5fac543c91b
MD5 3687fec083827f2328587df4a0b67380
SHA1 7fa2fb71c4cd799d8fc619c1e8dc05010d1b1128
SHA512 8e3b8de988f0d12a7711d22a20e74a0cce310875890606aaf9084f48db8329cf4d6ad66b9b721cb901a4cce4acc2467c4952b92fc3eea2fa1ea20f5cbb52163b
SSDEEP 49152:9OTgqOYMVp7ycLXBDHGO2dvo+ijAfIveBa52fo2mVkX:jqCmOzWz
TLSH
T1CCD58D1BAAB441FED4AAC278CE179A57F7F1F9560730A74F0291059E5FAB3210E2E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_links_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\app_links_plugin.dll
Size 147KB
SHA256 7296b9b16fb3ff47d147404152f0da4d596ef0666778d34dfccd1d3094001b6d
MD5 f664d410365931e10e48520aa53321e7
SHA1 8c1c89fa50afe1017bf38bbaad3423ebdb995bec
SHA512 b1a0f262e0feb8d2fcdafac00e042967b8c97ffe6e81ce3c36b81789f9279a737ca2d1f746f34c13972d7146a02177ba866838c2234c3b2f1aad9a1aa8b7e5b6
SSDEEP 3072:PGyhYxA365uvlBh/eDaZw8vTMpZdTdcCZ9GTpATevBz:PGyhYO365uv8a9TMpZdTdcCOTpAwBz
TLSH
T191E37E2BF71940A7D21AC17DCA934946DBB2B8920B9197CF17500B9B0F17BE81E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto_updater_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\auto_updater_windows_plugin.dll
Size 106KB
SHA256 f4a3fa3ff53b82388a81c1bcddcb2ffb05919ab634fbfc78da754d3e7e27b6cc
MD5 c8b70d4da1b998855ba5b0395d354203
SHA1 a87ae4ecd2659e801be6cde5f5a7c93dd885f13b
SHA512 28ede018d9ad7b654f4b2c25c92ae872c7bb370abdd44f608be72f12ceeba7c19532a3d93df94b3648c6ad0ab32bb137c8d65906213d20c9ce6c088bb9923aa6
SSDEEP 1536:NxH3NjUGY98Ev69NxozwmhPpxjHM87ftPGH3C7awkmGNlM:Nxdo/98M6piRxjHM87ftPGXCvBF
TLSH
T145B34C2BEA595097D22AD87CCA978945DB71F8814BD1EBCF57504ACA0F13BE80F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_webview_window_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\desktop_webview_window_plugin.dll
Size 192KB
SHA256 8a013e30fa54676a939de77f380b84d48a8a0277c331466fa099d15f953fb9f4
MD5 bb370a1e814d4df5eabda88fd5bd68cf
SHA1 bd46e92a4032692b178ffe48f66ca95ab69ab68f
SHA512 c88894619bcd22c8db83524cd8585f661c770ebf2762c5dc658a46e874754bad625bb6e947f20ce5f75645ec5c5fc797f82e44e3a64f7cf0b4c698a2ec3725f6
SSDEEP 6144:U7l9tseTJepNq6PN8LVAv9OMvwLtpUxqJbNbgHW3QYNb0xbDVbDbAbgbwmb4Qb04:U7lLn6P+LVAv9OMvwUxqJbNbgHW3QYNW
TLSH
T186142827B25910B6E16BD57CCE834A46F7B2B4825BA193CF175047BB0F57BE89E39200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_inappwebview_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_inappwebview_windows_plugin.dll
Size 958KB
SHA256 cbd1a6bacf11b91f1825285916e7aab403ebd13c91740c679dc5cfddcb40277d
MD5 9094269bcd655ecd5dc5f84604f7be94
SHA1 67dddbf82aa846f83148c08f7e68b9800f5863fa
SHA512 71be4d59b6d3d7105be07fe9fd7514e5cc054f7bdc4c998a3119f887241f751608c88bab4be5d5c3763454e52e58118077bc42c060b2f24ed53a714626f8e708
SSDEEP 24576:NZVV7m/e8ONMwpyl7iiGMBecNQM63LNzMf8eH/D:LqnONMwBMBfNQLLtMfvH
TLSH
T1FD254B2F6B4C00BCE0B5C2BDCE578A51E773B48A07A1C7CB1690065A7EA77E44E79712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_windows.dll
Size 18.2MB
SHA256 9b425cf9d9eaf418437055a26c18f7ae0e7b5ad9af1c8192c52ea34ad88aac80
MD5 c383ec7f9e90746f11f0fabb2d406f16
SHA1 aacd7cd11df7641589bfeda763760686d61f923c
SHA512 a2cc1bd25c845f727ce8196665f54fe6bafe605e9923a3c8c7a57c4267532b306eb4081c070ec4c672e87252483973cad148c5d547570c295204ce28bc1f7219
SSDEEP 196608:AK/sS1sgz8vY/qhZUQ9UgFqUA0hfrZng2:r/hihZ1Uyq6frZng
TLSH
T138178D03F19640F9C48DE2788B5BA927E671B88E0621B5DF279847153FA7BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\screen_retriever_windows_plugin.dll
Size 128KB
SHA256 8f03be74605661256cff2adff65b1817b4d12edad4940774c4f9caad72f433a1
MD5 76a2083d320bcc22d9c18c78d6d6dde4
SHA1 8d2caade69b01f2436c0cdd2923fb1660355a991
SHA512 9774ffbe928007bc1efe6694de2f4f8ca98558ac7c30822c0314d5aacfe1e217a07f406d3705021e658b608002f1f1d842bb38ab30bb8f7baff81ddd61b8e389
SSDEEP 1536:Deep96cBfMbsl0QzwzJ6u+mxCb8m3hhrStBST1sp0+dTMp+eCcARmju80g7awkmj:DFgNiuJ6MRUGtoTwTMp+eCcARwbvB
TLSH
T1CED34C2BFB59406BD21AC479CD838D46DB71B8914B91A7CF57904A9B0F27BE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\share_plus_plugin.dll
Size 143KB
SHA256 8efbcbc64f89fbfa501cd303f0d3919ffb1574bd57d3a9c73b430f7aa02f1599
MD5 819cad2c957eebf27ff81bc4f6c1443f
SHA1 0a4887b12aedffea4019d3104c7cb07b8de1cc64
SHA512 a2e3af3aaaba47b61bba1ebdf9c3131518c548d91a5b2515077317661d53678805c464fa73606aa21bd66f1430f3bc5a60d5f274b447521c2b3b28c767be40a1
SSDEEP 1536:kK3tgH/jIzIpis96dt6xM1AKCPv58Aj/1tMfT4AAxYMUvRn5k6f/U/0e/5Qe+WPS:kctij6WoAKCPvjj/1tMfT4AAKEgvBd
TLSH
T107E34B27BA1C409BD12AA478D943CA55D772F8A64F9183CB37614B9F4F63BD80E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_recovery_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\system_recovery_plugin.dll
Size 121KB
SHA256 9ae9c5386c53dbb81bafd57b8b2f8b3a5e2782047c6f3e6e2e077f0e4cc4d13f
MD5 478094392d8c38cb718c8b2fe071ce0b
SHA1 45dc0523b2e3560f467082e6312b1f89e188bcc9
SHA512 40603208bb9c7293337a6153d445a56f0b18458a6a7bfc34fd070020a26ef645fbbd390c2385dbbaac7ac6b650e152197f26a1ec257774a80a55c7421a89ffc1
SSDEEP 3072:fq0HX65/PzGH3V7OOvpZJcf12YxjsvB1h:ftX65/HOvpZJcf12YxjOBv
TLSH
T16CC35C2BEB6940ABD21AC478C9478916DB71B8D547A0A7CF17904ADA0F17FE84F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\tray_manager_plugin.dll
Size 116KB
SHA256 438a606e2d25345f5450daa413c7d681a708f7c11bc0e236ccf3c8888bb6967b
MD5 8f2a09d2647cf363bdffab9d119bdf04
SHA1 054d5e529654988975f4100567ecafc155d0d39c
SHA512 1d8a8a2efd8d628981cc0d40336fbd303dc85561d66a986c5accdb37d76ce5dac1f773311087d8a3942ae7fac9283cffcf4c0597aa765898510de11e7b287da0
SSDEEP 1536:Fcc07ngb+YI0LQu6gYWxJuohJdgCMTFTvpZJHCqPhN4CQS7awkmu:L0h00u6+wIvgCWxvpZJHCqPhNlDvB
TLSH
T1B3C34B2BEA5D406BD26AC4BCCD538916DFB2B8854791A7CF57500ADB0F27BE40E3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\url_launcher_windows_plugin.dll
Size 107KB
SHA256 6ac85b7f31782dafaa2c76909d609a882d5013ca6e4bd4e9d0c8f4ab122653bd
MD5 e693426f4a6ae154f321173e403a1a46
SHA1 94cf78f314ad16e260a00dd34c68c94559f41d65
SHA512 75cb0cbbfbf5ae6e3aaf5a4011ba74941c9c17fff7904f90024ab0e0e93bd3a5c7198d4908cce90f5dc12b02a960552ce6c25f01ce49772e6c3fd01245401078
SSDEEP 1536:PGpZRNr942MEIxKj2a66rzCiVB2BN9LBwdIBBaM8xVZiZjigbL7awkmb:Pkvr942MPa6n7fhBsM8xVZiZjTvB
TLSH
T145B34A3BAB1910AAD259D4B8CA934941DB72BCC54BD1A7CF13904ADB0F67BD41F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_manager_plugin.dll
Size 138KB
SHA256 962b99de6733169f01fdec7f0c380ca24db3f06d9e7daa7c3452b3eecf5c4dfd
MD5 bf28e93ce0c279410061aaebeb7055fb
SHA1 9bd5a6719b130273f8ba9381bd6df21782944e2c
SHA512 31dd1c786aa8777d19e1d25041187b3e7474dc90fb6fb5e2ba5fbe266f9d32195c00a65880a3ac21f08267934987b38070817651127d275a0b4f3234242f4778
SSDEEP 3072:dCRvX+Kgjvi36enHryuxaqe6VvpZJHJT+KlQ8vB:dCJX+Kgjs6enmie6VvpZJHJT+KlQeB
TLSH
T10AD35E2BF75900ABD26AD478CD828946DF72B8854B91D7CF07914A9B1F23BE41F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_to_front_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_to_front_plugin.dll
Size 90KB
SHA256 2e2ebc75fd5bc1165b8b7c0c4560fe34e8b1315c778d7edaee3f17cc65c39fde
MD5 467cd15ff5b725cd29cdd437fd62ac0a
SHA1 63bd0585205e32e39fb28f942d616fe4ba9a6836
SHA512 91b83de0ec9741df329684e01882aeb0d2f7b7e5b64492101f7dd61cac0ae33c21af127b324980d13f840ef08f537c6c802d432cd7a11295e4b6bdb2081be759
SSDEEP 1536:qg6FFF63L7Dx7c3wU5qp4e84l8tivAqWSMYmEBw/7awkmY1:qdx6lwipH8PivAqWSMYUvBe
TLSH
T1DE933C2BEA1950A6D259D878C9838D15DB72BC824BD1A7CF57500EDB0F67BE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8DEE.tmp

Path C:\Windows\Installer\MSI8DEE.tmp
Size 373KB
SHA256 13dd147c384d0ec0cfe905a23a6a1809cf289353ce06f85d4ae387797ff4f906
MD5 6e124361f3fe10fe4d843282d2b44880
SHA1 231ba5b1f7d83a1ab378cb0059ab4127b4be9562
SHA512 a6c6b0f0028174eb6563606157695058cc89fbc858771e92eb97143b27938769a8e7b3688676d23ae52834ee15b2ff7440cef857eaf10d95d207bee41f93b35b
SSDEEP 6144:HCVaQ9abVQaWanro5NzlrZAYpJndT4ZuGmRjVP7pgeaK+Br:iaSabyWrOJlAUndME3j1KVKGr
TLSH
T17E84CF4577E80969FCBB823989634A46E7737C115770DADF03A0424E9F2B7D0993AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\CustomAction.config
Size 942B
SHA256 8a0c15fd64db64866ec57cf6344dad0f40a558bedf38d9801d02f37548f30344
MD5 2c039f283cd4f6de13a3c8a975a0311d
SHA1 aa2364d8f8cfe81ef136b4233e170a2fc69df4fb
SHA512 89e2df87142299b7fec70408e9370d165aa6174abd30c17f9e613032dd1cbb8fd6e907f7eee3f7c62efe19b3ac576ef985335f9977d9eb0564c9738b3f05c92c
TLSH
T18311D04D8A5457B7242127937BAC51D487A1E4AA39A4911C749FA9101B2993913633CF
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA181FF7CFA948941A1EFDFD06E3EC5C7A\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 dd4120702e4cc794705c0ad23ce1eaa265310ab96064fd23947f6dff38e8e680
MD5 599912457191503b65184f0d35a9dbc9
SHA1 60790092e6249b194732a606ac9dd7ac291f66ce
SHA512 cc07ae732a4cd1ba296a0f388b924c0b0280f2fde201409719087cae0c25fdcaec2af771d1734c64daa80c394832d3261e1675001e90a2fc046fda801833d60f
SSDEEP 3072:UOf7tVL6+Yvj12FuDHYQj69UgoTqddHYCnfKlRUjW01Kyqx3GR8UQQ:UgTex224Qj6jomdT8x2R2Q
TLSH
T166149C2657F8473ECEFF8B78E2A14212C7B1F1E67203D71D5D8281A62163784B692397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\System.Diagnostics.EventLog.dll
Size 37KB
SHA256 7b1e002e8f3616bf4d42413b7e587e2597d4f6aac013922aa7df3039089e388e
MD5 1f2726d75788dc641eb9cd45bcbe932f
SHA1 63c064f145eafb5ad8e611ea2ed0f6b9bac3da6c
SHA512 d1cd0eb1e1576fa9c4a52d150852994e0b236fe0a610060435964369ac57e4dd4a96ea275ed45ea0a21c6aba98b1496507b4b926517f3683e2b8b58497b28223
SSDEEP 384:xt7fxeD85CypGlMBm2PBf0QhJZcVcA7GTmRmH3OaXIZWnuWEnvWcLPDHRN7/V/cB:7TgDJlM82m+JSGTmAXOaYZWkndm9zgG
TLSH
T1A0034B65D3FC436EEEF60F70AB72D0160E39B6C67812D52E5159A48D2E32B408631B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\System.Security.Principal.Windows.dll
Size 17KB
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ServiceProcess.ServiceController.dll

Path C:\Windows\Installer\SFXCA6001AAEDE7449678B165EFDFA402E2FD\System.ServiceProcess.ServiceController.dll
Size 22KB
SHA256 264aba3ab46ede36a81014543096c339fd0f249297f3619074272a8d8b32c81a
MD5 3390e22e4758fc9ee1f1255eff93339e
SHA1 86583cf347412da7f726819c2687364ff6d335bb
SHA512 350b170c37e93029eb58c236e65c352abd57e4051afb2341b47d7d8924ddaf10bde0503e94a2dc37c65c826917a0766d40595c6d84df62b2c9ae0d9068f82c3c
SSDEEP 384:R/SU1Gtf2PlJgGdXEkvxKWiWVzDupaWJ/hljHRN7p3/o7R9zBfY+Tj:JSkW2bgKXEPPDjp3c9zW+f
TLSH
T19FA24B6157BC4377CDAA0EB1A9B5D5532E38A3C52912D73F06D4E4062DA7B8CEA30339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomInstallerActions.dll

Path C:\Windows\Installer\SFXCAAF18F243F04EFBDB4090CEC6F40A8702\CustomInstallerActions.dll
Size 33KB
SHA256 3719b71dc2c48b9d46d855412fd452dea237fe073fa7d9b60b6f8b8a5e61f4b0
MD5 f5022671399ad7f7258eee32e6ff7905
SHA1 31dc218437623020840eb735b971a1374fce8803
SHA512 d9df8af568f171198bc2b89eb17f13eff3addaa949a4ab55232836362ac3032b0ea453f3d92a10197e1622f288ab15951134de5691f126704cda603f76b8d9f7
SSDEEP 768:N3W2R8TymM2tlvk7gb0bfNGXiJFsEBsC9OE7:x7R8GmM2TFbAfgyJF/BswOE7
TLSH
T111F2948277FC1615F6FF6FB26DB145100AB2BD9AAC32DB5D29C4408E1972B809960F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ac3adc5d5158b31341a59c9069ec8fa71b08e5d5f180188c6081e0ccaf966b6c
MD5 4457763ad5c5b49071ef866468fa8ff1
SHA1 de2094c99a9edaa4674033947f9c8fa2b4045fe2
SHA512 9772f2d71129de601f2fefa8552c46131f73fc2412dce70a6ae54cfc7d7343a00547e5dc2effc2a904dd46115110885ea0c20d295b598c791c7b4ec10a3ac9a7
SSDEEP 24576:PFo3DMPfdoO/vvTL/SgF1ClQ/rO/OLSmEIDn9oLdDgL6pSUVM4x2VsPExe9:NHg
TLSH
T1B457E41436F92110F7F39E3CA8F46A63493A7D5BAC15DE8D45411B4E0822FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8c1f5081-1e70-495c-b9a8-d8075cca18dd}_OnDiskSnapshotProp

Path \??\Volume{b50918b2-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8c1f5081-1e70-495c-b9a8-d8075cca18dd}_OnDiskSnapshotProp
Size 6KB
SHA256 b82245e190bcbc0d4fa33987a4336cebd9ecf9c37ed0839605dd660c46f13078
MD5 1dd5394d671048d8df089335f4fc9d16
SHA1 b462fa7280ad569b06847ddf27d8d70f754b28eb
SHA512 7966898abadf63732fc0f5875a4a02a079608507b244000b869927e398e81747edc43bfc6ebfd77ce23a665f6f731edeee68af59e4832ef97fb866644a4507f1
SSDEEP 96:FGsWsjvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:4sHb++uVmN
TLSH
T10DD178085AE54711E2B3AB7128F18557A877B911FF33CB8E0198638E2661A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-23-0x00000268D0A70000-0x00000268D0AA4000-memory.dmp

Download

memory/984-27-0x00000268CF0B0000-0x00000268CF0BC000-memory.dmp

Download

memory/1756-1164-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1264-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1564-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1544-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1524-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1504-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1484-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1464-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1444-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1424-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1404-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1384-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1364-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1344-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1324-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1304-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1305-0x00007FFC61ED0000-0x00007FFC62102000-memory.dmp

Download

memory/1756-1284-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1265-0x00007FFC61ED0000-0x00007FFC62102000-memory.dmp

Download

memory/1756-1244-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1224-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1204-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1184-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1144-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1124-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1103-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1083-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-998-0x00007FFC61ED0000-0x00007FFC62102000-memory.dmp

Download

memory/1756-997-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1063-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1064-0x00007FFC61ED0000-0x00007FFC62102000-memory.dmp

Download

memory/1756-1019-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/1756-1039-0x00007FF74F3F0000-0x00007FF752FCB000-memory.dmp

Download

memory/4340-786-0x0000029C04940000-0x0000029C054F1000-memory.dmp

Download

memory/4340-968-0x00007FFC74250000-0x00007FFC742D9000-memory.dmp

Download

memory/4340-962-0x00007FFC74C80000-0x00007FFC74CA2000-memory.dmp

Download

memory/4340-958-0x00007FF7B2410000-0x00007FF7B2476000-memory.dmp

Download

memory/4340-959-0x00007FFC7CEE0000-0x00007FFC7CF06000-memory.dmp

Download

memory/4340-960-0x00007FFC7E540000-0x00007FFC7E55B000-memory.dmp

Download

memory/4340-784-0x0000029C01D10000-0x0000029C01D11000-memory.dmp

Download

memory/4340-961-0x00007FFC74CB0000-0x00007FFC74CE2000-memory.dmp

Download

memory/4340-964-0x00007FFC76380000-0x00007FFC763A0000-memory.dmp

Download

memory/4340-965-0x00007FFC74480000-0x00007FFC744A0000-memory.dmp

Download

memory/4340-972-0x00007FFC623E0000-0x00007FFC6362D000-memory.dmp

Download

memory/4340-1263-0x00007FFC62110000-0x00007FFC623DB000-memory.dmp

Download

memory/4340-1260-0x00007FFC623E0000-0x00007FFC6362D000-memory.dmp

Download

memory/4340-966-0x00007FFC74420000-0x00007FFC74445000-memory.dmp

Download

memory/4340-1018-0x00007FFC62110000-0x00007FFC623DB000-memory.dmp

Download

memory/4340-1015-0x00007FFC623E0000-0x00007FFC6362D000-memory.dmp

Download

memory/4340-971-0x00007FFC743B0000-0x00007FFC743CE000-memory.dmp

Download

memory/4340-970-0x00007FFC743D0000-0x00007FFC743ED000-memory.dmp

Download

memory/4340-967-0x00007FFC74460000-0x00007FFC74478000-memory.dmp

Download

memory/4340-975-0x00007FFC62110000-0x00007FFC623DB000-memory.dmp

Download

memory/4340-963-0x00007FFC73CA0000-0x00007FFC73D95000-memory.dmp

Download

memory/4340-973-0x00007FFC7CB70000-0x00007FFC7CB7C000-memory.dmp

Download

memory/4340-969-0x00007FFC743F0000-0x00007FFC74415000-memory.dmp

Download

memory/4340-785-0x0000029C04940000-0x0000029C054F1000-memory.dmp

Download

memory/4340-787-0x0000029C04940000-0x0000029C054F1000-memory.dmp

Download

memory/4340-788-0x0000029C01E30000-0x0000029C01E31000-memory.dmp

Download

memory/5760-868-0x0000018F94250000-0x0000018F94270000-memory.dmp

Download

memory/5760-822-0x0000018F801E0000-0x0000018F802E0000-memory.dmp

Download

memory/5760-835-0x0000018F82E50000-0x0000018F82F50000-memory.dmp

Download

memory/5760-854-0x0000018F82E10000-0x0000018F82E30000-memory.dmp

Download

memory/5760-834-0x0000018F82A30000-0x0000018F82A50000-memory.dmp

Download