ffcd1d803d774409ae54e565e85b7e03cd96450fd1654eee44f8a9e463078030

Analysis

max time kernel
899s
max time network
873s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cloudflare_WARP_2026.6.880.0.msi
Size 56.3MB
Sample260721-xtd4xashnb
SHA256 ffcd1d803d774409ae54e565e85b7e03cd96450fd1654eee44f8a9e463078030
MD5 17b9574f044fde44ae0fa559984cd9e1
SHA1 69fc4a428ab3e52975955d4bf4230e157f08614e
SHA512 4599e2b31d6a5cd6d6efe3c941c0e47b29c06d2b62726aac24b8b0c39d9da8766b2b953ec2e7c3cf5827695811aa90b1e7700b0ad9c57daca6f9d09732a968d0
SSDEEP 1572864:alXcvMvcokHYgGeIPZHXLoHFU4GbjzCaxSMm6O/QlI2P:7kkH5G/96mbbjOaUz2P
TLSH
T108D733A5FAC009ADE59A867982672324E6303C59270195DB8379B03D3F736B4F0BF752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2196	Cloudflare WARP.exe
3748	warp-updater.exe
216	warp-svc.exe

Loads dropped DLL 45 IoCs

pid	Process
3928	MsiExec.exe
1388	rundll32.exe
1388	rundll32.exe
1388	rundll32.exe
2896	MsiExec.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2896	MsiExec.exe
3592	rundll32.exe
3592	rundll32.exe
3592	rundll32.exe
2896	MsiExec.exe
4404	rundll32.exe
4404	rundll32.exe
4404	rundll32.exe
2896	MsiExec.exe
3540	rundll32.exe
3540	rundll32.exe
3540	rundll32.exe
2896	MsiExec.exe
3332	rundll32.exe
3332	rundll32.exe
3332	rundll32.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
216	warp-svc.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CloudflareWARP = "C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe"	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3768	msiexec.exe
6	3768	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
216	warp-svc.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\.sentry-native\fd00af0b-380a-4227-f084-5e933508438e.run.lock	Cloudflare WARP.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5256	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-durable-objects-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-code-brackets-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-device-desktop-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-no-security-shield-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-performance-wrench-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\cloudflare-logo.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-server-1-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\tray_manager_plugin.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-analytics-data-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-edge-log-delivery-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\svgs\notification-request.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-collapse-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-expand-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-podcast-microphone-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-target-retarget-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\desktop_webview_window_plugin.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-gateway-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-target-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-time-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-time-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-numeric-3-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-optimization-web-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-organization-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-support-chat-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-registrar-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-documentation-logs-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-growth-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-machine-learning-contextual-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-no-security-shield-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-price-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-case-study-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-copy-duplicate-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-help-question-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-internet-browser-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-security-center-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-twitter-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-payments-credit-card-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-refactor-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attention-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-security-center-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-edge-log-delivery-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-office-branch-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-arrow-down-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-hide-eye-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-youtube-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-apple-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloud-security-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-numeric-subtract-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-server-2-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-shop-cart-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attacker-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-benefits-healthcare-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-media-stop-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-spam-email-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-user-multi-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-workers-for-platform-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\tray_icons\pngs\disconnected.png	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-analytics-network-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-argo-smart-routing-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-code-branch-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-edit-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-media-play-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-no-edit-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-wrangler-cli-outline.svg	msiexec.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCABEEA74B45146F20BDD0A7586C628EAED\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABEEA74B45146F20BDD0A7586C628EAED\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABEEA74B45146F20BDD0A7586C628EAED\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC4A4D25DF44177BAF90B4AAFA0A2AC87\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAF780174137461AB9A34359A5360E8D70\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC4A4D25DF44177BAF90B4AAFA0A2AC87\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC4A4D25DF44177BAF90B4AAFA0A2AC87\System.Security.Principal.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF780174137461AB9A34359A5360E8D70\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAA59DCA0104C8A186A77ECE1B7FF8F6D\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e582362.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\{79046BCA-7908-4E33-9788-FFD89183A7BE}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCABEEA74B45146F20BDD0A7586C628EAED\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF780174137461AB9A34359A5360E8D70\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4286.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAA59DCA0104C8A186A77ECE1B7FF8F6D\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAA59DCA0104C8A186A77ECE1B7FF8F6D\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAA59DCA0104C8A186A77ECE1B7FF8F6D\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI43CF.tmp	msiexec.exe
File created	C:\Windows\Installer\e582362.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAC4A4D25DF44177BAF90B4AAFA0A2AC87\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC4A4D25DF44177BAF90B4AAFA0A2AC87\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{79046BCA-7908-4E33-9788-FFD89183A7BE}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAA59DCA0104C8A186A77ECE1B7FF8F6D\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAA59DCA0104C8A186A77ECE1B7FF8F6D\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{79046BCA-7908-4E33-9788-FFD89183A7BE}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2536.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAC4A4D25DF44177BAF90B4AAFA0A2AC87\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI391E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3A77.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAF780174137461AB9A34359A5360E8D70\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABEEA74B45146F20BDD0A7586C628EAED\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABEEA74B45146F20BDD0A7586C628EAED\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF780174137461AB9A34359A5360E8D70\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF780174137461AB9A34359A5360E8D70\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI51EA.tmp	msiexec.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4376	sc.exe
4260	sc.exe
4436	sc.exe
2664	sc.exe
5052	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3768	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5204	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\ = "URL:com.cloudflare.warp Protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\AppUserModelId\Cloudflare.CloudflareOne.WARP\DisplayName = "Cloudflare One Client"	Cloudflare WARP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\AppUserModelId\Cloudflare.CloudflareOne.WARP\CustomActivator = "{687a0d32-3695-562d-8c57-8912121f0bfd}"	Cloudflare WARP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\", 1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\AppUserModelId\Cloudflare.CloudflareOne.WARP	Cloudflare WARP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\AppUserModelId\Cloudflare.CloudflareOne.WARP\IconUri	Cloudflare WARP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\" \"%1\""	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\AppUserModelId	Cloudflare WARP.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100000400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d70f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a0400000001000000100000002edae4397f9c8f37d1709f2617513a8e2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1388	rundll32.exe
1388	rundll32.exe
5048	msiexec.exe
5048	msiexec.exe
3540	rundll32.exe
3540	rundll32.exe
216	warp-svc.exe
216	warp-svc.exe
216	warp-svc.exe
216	warp-svc.exe
216	warp-svc.exe
216	warp-svc.exe
216	warp-svc.exe
216	warp-svc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3768	msiexec.exe
Token: SeSecurityPrivilege	5048	msiexec.exe
Token: SeCreateTokenPrivilege	3768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3768	msiexec.exe
Token: SeLockMemoryPrivilege	3768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3768	msiexec.exe
Token: SeMachineAccountPrivilege	3768	msiexec.exe
Token: SeTcbPrivilege	3768	msiexec.exe
Token: SeSecurityPrivilege	3768	msiexec.exe
Token: SeTakeOwnershipPrivilege	3768	msiexec.exe
Token: SeLoadDriverPrivilege	3768	msiexec.exe
Token: SeSystemProfilePrivilege	3768	msiexec.exe
Token: SeSystemtimePrivilege	3768	msiexec.exe
Token: SeProfSingleProcessPrivilege	3768	msiexec.exe
Token: SeIncBasePriorityPrivilege	3768	msiexec.exe
Token: SeCreatePagefilePrivilege	3768	msiexec.exe
Token: SeCreatePermanentPrivilege	3768	msiexec.exe
Token: SeBackupPrivilege	3768	msiexec.exe
Token: SeRestorePrivilege	3768	msiexec.exe
Token: SeShutdownPrivilege	3768	msiexec.exe
Token: SeDebugPrivilege	3768	msiexec.exe
Token: SeAuditPrivilege	3768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3768	msiexec.exe
Token: SeChangeNotifyPrivilege	3768	msiexec.exe
Token: SeRemoteShutdownPrivilege	3768	msiexec.exe
Token: SeUndockPrivilege	3768	msiexec.exe
Token: SeSyncAgentPrivilege	3768	msiexec.exe
Token: SeEnableDelegationPrivilege	3768	msiexec.exe
Token: SeManageVolumePrivilege	3768	msiexec.exe
Token: SeImpersonatePrivilege	3768	msiexec.exe
Token: SeCreateGlobalPrivilege	3768	msiexec.exe
Token: SeBackupPrivilege	4628	vssvc.exe
Token: SeRestorePrivilege	4628	vssvc.exe
Token: SeAuditPrivilege	4628	vssvc.exe
Token: SeBackupPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeBackupPrivilege	2340	srtasks.exe
Token: SeRestorePrivilege	2340	srtasks.exe
Token: SeSecurityPrivilege	2340	srtasks.exe
Token: SeTakeOwnershipPrivilege	2340	srtasks.exe
Token: SeBackupPrivilege	2340	srtasks.exe
Token: SeRestorePrivilege	2340	srtasks.exe
Token: SeSecurityPrivilege	2340	srtasks.exe
Token: SeTakeOwnershipPrivilege	2340	srtasks.exe
Token: SeDebugPrivilege	1388	rundll32.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeDebugPrivilege	3540	rundll32.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeSecurityPrivilege	5048	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3768	msiexec.exe
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe
3768	msiexec.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2196	Cloudflare WARP.exe
2196	Cloudflare WARP.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2340	5048	msiexec.exe	94
PID 5048 wrote to memory of 3928	5048	msiexec.exe	96
PID 3928 wrote to memory of 1388	3928	MsiExec.exe	97
PID 5048 wrote to memory of 2896	5048	msiexec.exe	99
PID 2896 wrote to memory of 2436	2896	MsiExec.exe	100
PID 2896 wrote to memory of 3592	2896	MsiExec.exe	101
PID 2896 wrote to memory of 4404	2896	MsiExec.exe	102
PID 4404 wrote to memory of 4436	4404	rundll32.exe	103
PID 2896 wrote to memory of 3540	2896	MsiExec.exe	105
PID 2896 wrote to memory of 3332	2896	MsiExec.exe	110
PID 3332 wrote to memory of 2664	3332	rundll32.exe	111
PID 3332 wrote to memory of 5052	3332	rundll32.exe	116
PID 3332 wrote to memory of 4376	3332	rundll32.exe	118
PID 3332 wrote to memory of 4260	3332	rundll32.exe	120
PID 2196 wrote to memory of 5204	2196	Cloudflare WARP.exe	129
PID 5204 wrote to memory of 5256	5204	cmd.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.6.880.0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 01FC1A60EB06DBEBA19C4FCDE9BD440F
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2536.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240657796 2 CustomInstallerActions!CustomInstallerActions.Processes.KillGUIProcess
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DCC9B180913E4F26618EB7EE1109C2F1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI391E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240662890 7 CustomInstallerActions!CustomInstallerActions.CustomActions.ReadCmdLineParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2436
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3A77.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240663187 18 CustomInstallerActions!CustomInstallerActions.FolderPermissions.SecureDataDirectory
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3592
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4286.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240665218 28 CustomInstallerActions!CustomInstallerActions.StopUpdater.StopUpdaterCA
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\system32\sc.exe
      "sc.exe" delete CloudflareWARPUpdater
      4⤵
      Launches sc.exe
      PID:4436
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI43CF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240665546 40 CustomInstallerActions!CustomInstallerActions.Processes.StopRunningProcesses
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI51EA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240669171 46 CustomInstallerActions!CustomInstallerActions.Service.ConfigureService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP depend= "wlansvc"
      4⤵
      Launches sc.exe
      PID:2664
  - - C:\Windows\system32\sc.exe
      "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
      4⤵
      Launches sc.exe
      PID:5052
  - - C:\Windows\system32\sc.exe
      "sc.exe" failureflag CloudflareWARP 1
      4⤵
      Launches sc.exe
      PID:4376
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP start=AUTO
      4⤵
      Launches sc.exe
      PID:4260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\cmd.exe
  cmd.exe /c "tasklist /FO CSV"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5256

C:\Program Files\Cloudflare\Cloudflare WARP\warp-updater.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-updater.exe"
1⤵
- Executes dropped EXE
PID:3748

C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Cloudflare WARP.exe

Path C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
Size 402KB
SHA256 e90c902f372efda06606f39773bc6fc28422b67e2d7a0ed4d297a624e3d04bbc
MD5 e3adec282b2c58f6d3b015b2de7b5c78
SHA1 6fe6bbe58ed0b63fcfbc64b85c0360289ce322c9
SHA512 33887ca9aa2fe4811039371234ab7be9f86f83aff6bed076fdfc2c6d5c3b5beca6aa47c74796e3c2b2e6ed66cc25f18be776b6fa23185175b0c7ac88bffa1697
SSDEEP 6144:inWzNxY+fSm65m2uaarGk5mbrvnjz+xZRtiKzvzaOH6:fxY+6m6Y2uaarGk5mbLj5
TLSH
T1BA94B1E666554C9DF2168C748D77B64087A1ACB10B6297CB134036BACEB36C5FE3B603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_links_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\app_links_plugin.dll
Size 147KB
SHA256 e95d9b3ed396a5cac1378437d815758e5caee8f9250016f60a2bfbdbb2d8e8a3
MD5 faf9f2513a7c0101b619ecfccb42898f
SHA1 cbe142d21b1d407c7792286c117a8160ee9874fa
SHA512 1aa063c2accadc2379281a0b5a9546781dbe769b475b6bb3614e62970b991ecaa51f4c1ec8444ff6ace04358c66e1abcea1f50d052991feae2d297c7a54057a4
SSDEEP 3072:ZGyhYxA365JdElRha5OHIO9y9MpZdTdcCr9GTLJA8tcj:ZGyhYO365JdE9Hw9MpZdTdcC8TLJA8s
TLSH
T102E36D2BB7194067D21AC17DCA934946EBB2B8960B9197CF17500B9B1F17BE81F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto_updater_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\auto_updater_windows_plugin.dll
Size 106KB
SHA256 00b31dde9cf7c442beb6a995103339fd90d9caba63cab5553b0e2fdd76cb6232
MD5 206289535eb43389a553f2606c989aaa
SHA1 2ef621d4e53709251df8ab74078c4a4b648ac1b5
SHA512 18d6ffd8f93bdebb52863b2334da6c9bee82df1ef597cb6fe3c4d7cfb4c74a2cfd2a1b84008bae252c3f04f67139ffd6cef26481ba12d4bc81d43c1c44d5849f
SSDEEP 1536:xH3NjUnY98Ev69NxozHm1PKk53nZM87fXPuQ6VG7uwFF:xdoY98M6pdR53ZM87fXPuQOGj
TLSH
T1EEB34C2BEA5D506BD22AC478CE87C945DB71B8914BD1A7CF57540A8E0F23BE80F3E611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_webview_window_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\desktop_webview_window_plugin.dll
Size 192KB
SHA256 0ddcb18152f9d45ea4720129947e1a04d3c85f20dec067b8b06feab565762d1e
MD5 14354b2e2edd0d5c949726d123bcd627
SHA1 e51ee18207fc221c18325004dad6e2faa00d354d
SHA512 34eb70613d9ae79e810e6ca49d7fbf72a8b1d93b36685fbec97e7212e0fd8a31aea11a297b2e229b7e82f5e17a8ac5a33da7f8049ef513652f6facbc51d2cf2e
SSDEEP 6144:I7lotseTJepNq6PN8jfb9OMvwLtuCxqJbNbgHW3QYNb0xbDVbDbAbgbwmb4Qb0b0:I7lSn6P+jfb9OMvw5xqJbNbgHW3QYNb6
TLSH
T10C142827B65910B6E16BD07CCE824A47F7B2B4825BA197CF175047BB0F67BE49E39200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_inappwebview_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_inappwebview_windows_plugin.dll
Size 958KB
SHA256 ebe24746a76bd82ff3455b80edeac15863b0f2ccc46f5f80993413113cefd26e
MD5 e6a88eaf64207cc75cc83c3b86f353ca
SHA1 9f378ff4c59df82e2410e1506c812ec97b95dab6
SHA512 338c79a75f2530d9864705c6d69f832b04ff105b8314d04beeb1a78efdf8b3d0058ca9011fc721c81566f2573380fbd64675ad54d6e1dab1f0d56f7190f3fb79
SSDEEP 24576:YZTV7m/e8OHMi+yl7UiGMB1cNQM63/bQMf8IH8Hd:8MnOHMXBMBSNQL/cMf9H8Hd
TLSH
T1E9254B2FAB4C00BCE0F5C2BDCE578A51E773B48907A1C7CB1690065A6E677E48E79712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_windows.dll
Size 18.2MB
SHA256 4a2fafbebffbb357f99231c1e449ce7b72ce207c382de7466f3172249f2341cc
MD5 10f0e23036daa0925ba5dcec9ad77929
SHA1 256bede86cd6ffe2116edc3f17751664eb480058
SHA512 c810efb738b09704acb771e69ea9a9a90b77d7757050757bf4d051b1431118241380f1d442c4c9f1086941f6c14faab3872cd129df882ac89efa2ec44829dbb1
SSDEEP 196608:bK/sS1sgz8vY/qhZUQ9UgFqUA0hfrZng2:G/hihZ1Uyq6frZng
TLSH
T1F9178D03F19640F9C48DE2788B5BA927E671B88E0621B5DF279847153FA7BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\screen_retriever_windows_plugin.dll
Size 128KB
SHA256 dab072db0b0ac56d37010093c1699ad8cd9440dce45e29fecadfefd19d818171
MD5 70985f981cc911033036278d41bf913c
SHA1 01119d5124ca407d8f20c27668854e3d5af6308f
SHA512 f5df28982cc727062913aeb932c3d78764bc092e0c388859ad6768a9b0746d9333b676d40c10ff86196101acffe2fad29fde63d79a64906d0e342da95581c84a
SSDEEP 1536:7eep96cBfMbsl0QzwzJ6u+mxCb+lO13hhrSCfjPafl2lkMp+eCyAHjMHba7uwW:7FgNiuJ6MZsZGCfhyMp+eCyAHkaj
TLSH
T171D34D2BF759406BD25AD4B9C9878D56DB71B8814BA1A7CF57500B9B0F27BE80F3E200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\share_plus_plugin.dll
Size 143KB
SHA256 d7ad15363b81d244b0fe7acf9a05dd9df58cd0a3b5bc444445d995e1e50f7689
MD5 277f317fbcbb3c7420ba730f4f39a4ea
SHA1 9fae4181b6a896aaafb6ba8ffb25fc1eba73a9a6
SHA512 a35717c8f3b728724f84f57ce09f245dc4658f7c415d018617aba7c0696ccbba8ff0c3af96fa957891a46040030750223b6f6a7acc413446ecee60e5af141d84
SSDEEP 1536:qK3tgH/jIzIpir96dt6xM1XYEPv5P4AcDgMfT4+AxYMUvRn5k6f/U/0e/5Qe+WPT:qctiA6WoXYEPvqAcDgMfT4+AcP+j/
TLSH
T1A3E33B27BA1C409BD12AA479C943CA55D772F8A64F9083CB37610B9F4F67BD84E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_recovery_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\system_recovery_plugin.dll
Size 121KB
SHA256 be7450085d1dd948f63ef4a22f9530b34e687cba5a2a1f05f92c32e216847677
MD5 dcc646376664e475c7b7ca97fdc1e086
SHA1 05684c20e571c62cea13b5acd650f9eead6dcd96
SHA512 c7f2558e87ae32177df1dab1e1090fc689b5aef5f6d0c86f26cf9eb1d12e58b63e7688e37b395bc7bb91cf0ac2afba5c16bfb6dac7f729daaa5b26f0e25fa328
SSDEEP 1536:k+nqWZ5lvWX6eXQxDzPWnj9/5ZwjZeFIaga3aNEf5W27HyauJMZCZDvpZJcf1RYU:zq0qX65/P47Hy6ivpZJcf1RYof/sje
TLSH
T141C34C3BEA6950ABD219C479CA578916DB71B8D547E1A7CF17800ADA0F13FE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\tray_manager_plugin.dll
Size 117KB
SHA256 fb081cd1890194adf59dc28f4eb9d60a1c4f42b3801467298f64a341adcb3a01
MD5 72b44ed84162bf370134d23052fc4829
SHA1 e4fbf502f979dd6d2bf6703c7d29dc62b646cb1a
SHA512 ea381ef6c35821596aea16841efca420a3e291ea3a4a17ecf5a0561950ef3a8b437ecc388430afe49bf29960df63121f72ab7245caaebff7c615718b4a39a99b
SSDEEP 1536:pcc07ngb+YR0LQu6gYWxJujvIw+SKpvpZJHCmPRfPk6h1O7uwe8:v0U00u6+wj5+FpvpZJHCmPRnk6hYj
TLSH
T1EAC35C2BEA5D40ABD269C47CCD534916DBB2B8854B91A7CF17800ADB0F67BE40F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\url_launcher_windows_plugin.dll
Size 107KB
SHA256 2df19967780486ac38d70c8e30d9e7236d3c496e58fe636c49725362558b6371
MD5 9cda1323f3b36a7e85c1d6f899847f19
SHA1 3e0946cab24d3fdb5a29ac6c8a55d7e0790422bb
SHA512 cce8e1fcbc119fe3b3d336aa512bce58439835d6c8684341351afe4f2c5f0d077d84c0b996f28f7246cb598ea45ac97d9bbe3be8dc2e57b985991930d4758369
SSDEEP 1536:ZGpZRNU942MEIxKj2a66rzCVzBSmLZJM8xVniDOQ2RDl7uwesdh:ZkvU942MPa6nlImrM8xVniDOpFljhh
TLSH
T124B35A3BAB1D40ABD259D478CA834A41DB72BC854B91A7CF17A04AD70F67BD41F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_manager_plugin.dll
Size 139KB
SHA256 d5fb0d8312bea2ce0faff00bcce1f6e337f6d4b670e79e1a17021d1b3f90c356
MD5 a6f325a54855e528bc00788a8d5a7fee
SHA1 1aa8535a69b67a68c549599c3fc2d3384e3ca5a1
SHA512 5bc676877e74f23ad02aaea7a6c2e73e73a9a90dba260f34ae778bfccaeacfc21b65e6b0b4ebddb9abfc0d6be8ed71a06eaafcd1a79718d8591d04299d207456
SSDEEP 3072:sCRvX+KIDvi36enQwWUV304vpZJHJTNKEsjn:sCJX+KIDs6enr304vpZJHJTNKE6n
TLSH
T1F1D36E2BF75900A7D26AD4BCCD828946DF72B8C54B9197CF07914A9B1F23BE41E3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_to_front_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_to_front_plugin.dll
Size 90KB
SHA256 2197d2aee4f008869667ac914ed76091a38de9bf58bc00e9e92f2bf1aade1fc1
MD5 feaafbabc19b49c5906af14ba647a88c
SHA1 52dcfc78b0806c2787d650a36360b10f1257ac4b
SHA512 b6acdb0b5d6f79011da63a1c90f474e8f075a726bf7c95d758ff144901bb3a7fb160d374cb353e003d87205147a6cff4989f30ea35fb4165f403d62381a450a6
SSDEEP 1536:7g6FFW63L7Dx7c08UzqpGAJgTZ8jIvAqWYMm3eiiXY7uwXF:7dS6lwfpDJguIvAqWYMm3bLj
TLSH
T17E934C3BEA59505AD219C878CE438915DB72BCC64B91A7CF57500ADB0F67BE80F3E212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 0090dd4c6bf51bda75fbfe3fd492bd4a13d30f6b4ab1d4fd7bba426926de6ba2
MD5 128920367b716f7530d135ada81a4139
SHA1 f1ce3b6b07437afa9fd4fe5aec00518e7c67f5c5
SHA512 2164d88b0f754a0a9883503490026b735534855ff3f9f6320c6b0e4a90dbfc2a6fc7e9daedd8ddd7a99c35bed8af29560367e42c83d62008cb7f7b2b79865bb6
TLSH
T1ABF0DC1638BB38F1104B0CAC67FC59AC34EFEACF05928522343820C24AABA9D220F051
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FE2AF28B33C6DE3F447F7F539AA6D00

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FE2AF28B33C6DE3F447F7F539AA6D00
Size 727B
SHA256 dcea0658bd5c54dab1949c418367320f1c12a79c7426f70ee3049ea15afc845d
MD5 c560e4fdbc3d9b5ecd55ee9d5fbce769
SHA1 ddda59eaa759ce35d43d06c76c30c57679340c89
SHA512 bf3f8eb7693b30db83bc49b211b86ff37603d7796a2087aadc1a5903f63cb3c8796696b8891182dc1bbca628cd497f16d36de730dc2fbbe0b4dd35430bce9c5e
TLSH
T1C5019429FA591EAC76008E6CBCC54BA6F82051766ADD389366BE0420D2453B83703F34
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 42c88d91147f3ac6cc927c89aecfdbac144457e65fcf5c18747f62d0f3f05d0d
MD5 97a909b4f39f4a422fd2e3c07d78362d
SHA1 49b7d6161a5508f8362f393d1b33452a261c5a2a
SHA512 611e26642598ec696721bedfa7586c0e0a5d544bafeac41cdfae4219d49f9958c2b2b5916a8434d5418820b87bf73510a508301592653e6d14a3ef7c6e301dbf
TLSH
T1E5019413506C38C13852C71987FC8BF8F87FC69F6AC182A73661090901B644A24464D2
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 9bfdadc6c3fd09c3ec3c87ccb53b2b8b9b2a3c7aacf3b289af32571a41c49257
MD5 4a26763808805dc32504cecbcc125812
SHA1 cafbca882b18c90f2fd47556bb495346cd7b6f10
SHA512 132a2e2b35009f2e3adf313c314082073373933c6ecf5e7151d25e191f96fed176a2f409fae9b044b2ef955c669732185690f32f508a4bbe872a8d4c40187c66
TLSH
T195E0202017FA513EF1B4977803D5D0E5AF75F1167C44B6BE1F85542D9909E405CA3C70
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FE2AF28B33C6DE3F447F7F539AA6D00

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FE2AF28B33C6DE3F447F7F539AA6D00
Size 404B
SHA256 625a74b00cd5aff5dd486b2ea12bc545877b06627102c3d5c4f23d210944a401
MD5 73ec8ad0045b58d7d2108230b2e48c88
SHA1 7879864d48dd6073b2d2b45c1fad9423cd615582
SHA512 527177a9a4395e1ebdd6234f91d7ee6c10ede594df4ae59517b63342d588e305c0fcbe6c9544d4ec81fa7a5b5434897f469fc4919e272436e3115b38a06232a9
TLSH
T1A1E0207832F6455DF1F1E43852F798152DD9F50B04429769068113559A556407CD2A74
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 8837e0b1f64d1c3ed7216d480717e4ad1d81f568aa55528d375e5b638aa3ce50
MD5 e1d75dfdac9ac662a999e0f83cbb6e8d
SHA1 862da54cdbe77cf1e41b606c283361f9d8ada252
SHA512 c317a22842c2547870de38faeecf99d94207fef789710801da34610e090b113b9694bf332d79c7ffb51f446347d62c4a13e417b9d56cb37a94785281a5c84b45
TLSH
T1CCE0682C12EBA91EF0909C3042F9A5761D48F3091404E37A07D04309AB0AE009C109F4
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 651B
SHA256 d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580
MD5 00bfeb783aeff425ce898d55718d506d
SHA1 aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f
SHA512 2209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff
TLSH
T116F07DB02361F2D549133F46185C26440BBF4725AE54EE0C75A9625ED8250231F222E7
MD5 SHA1 SHA512 TLSH

Submit Download

MSI2536.tmp

Path C:\Windows\Installer\MSI2536.tmp
Size 375KB
SHA256 bb39ec595e19f3c9491147bf1093615222736baeb9d613bb4d3b5b814e38c47c
MD5 0da7e015efd69e2171f9f464c5de4e8a
SHA1 2ca3a0db1376e698fb0b3ee50f1f9dabb85d2402
SHA512 5b38ec67c892fa8b3e765a4f8d10e9b5f03003686d00efd455c16d9b554a90284cc7846930e67b64f672b2efc08eb130129307733d6052eaa31ea244212851d0
SSDEEP 6144:JCVaQ9abVQaWaHrg+NzZSyTJf8IiALkx4leY6QhZ:8aSabyWLJ9BWA4SXh
TLSH
T13084BF4677F80DA9FC7B8639C9630A16E6727C114770CBEF0390425A9F2B7D09939B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\CustomAction.config
Size 942B
SHA256 8a0c15fd64db64866ec57cf6344dad0f40a558bedf38d9801d02f37548f30344
MD5 2c039f283cd4f6de13a3c8a975a0311d
SHA1 aa2364d8f8cfe81ef136b4233e170a2fc69df4fb
SHA512 89e2df87142299b7fec70408e9370d165aa6174abd30c17f9e613032dd1cbb8fd6e907f7eee3f7c62efe19b3ac576ef985335f9977d9eb0564c9738b3f05c92c
TLSH
T18311D04D8A5457B7242127937BAC51D487A1E4AA39A4911C749FA9101B2993913633CF
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA53AF83CFD44BAF9B222BD91AB267ED29\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 dd4120702e4cc794705c0ad23ce1eaa265310ab96064fd23947f6dff38e8e680
MD5 599912457191503b65184f0d35a9dbc9
SHA1 60790092e6249b194732a606ac9dd7ac291f66ce
SHA512 cc07ae732a4cd1ba296a0f388b924c0b0280f2fde201409719087cae0c25fdcaec2af771d1734c64daa80c394832d3261e1675001e90a2fc046fda801833d60f
SSDEEP 3072:UOf7tVL6+Yvj12FuDHYQj69UgoTqddHYCnfKlRUjW01Kyqx3GR8UQQ:UgTex224Qj6jomdT8x2R2Q
TLSH
T166149C2657F8473ECEFF8B78E2A14212C7B1F1E67203D71D5D8281A62163784B692397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomInstallerActions.dll

Path C:\Windows\Installer\SFXCAC4A4D25DF44177BAF90B4AAFA0A2AC87\CustomInstallerActions.dll
Size 39KB
SHA256 e66ca6af8326742a4c6f08b2233b24ace7e84853a74c6d351ff9494b02ff0845
MD5 c7f4446d93154a6bf0d2d2f4ae34dca6
SHA1 3c15b25ac4019558ac88e6a8a859d3890e31eeee
SHA512 e45fd7992d4e8eb32d2432c13219d04abf8cb9112c29cc208b0da8bf5c7573dc6da1852cb8a63af8435f1f10ae9c1aea681cca29e81b9b290ad84527fd46682a
SSDEEP 768:pWLp7fJuP9f2uVy1eByvXw0IPkzPbxtfulFiJFsEBPnw8uw:pmp7fJuP9f2uVy1eByfwz8bvfEcJF/BZ
TLSH
T11803848277FC0A25F6FB6FB26DB1510119B6BDA66832DB1D2A80504E1972B80D970F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\System.Diagnostics.EventLog.dll
Size 37KB
SHA256 7b1e002e8f3616bf4d42413b7e587e2597d4f6aac013922aa7df3039089e388e
MD5 1f2726d75788dc641eb9cd45bcbe932f
SHA1 63c064f145eafb5ad8e611ea2ed0f6b9bac3da6c
SHA512 d1cd0eb1e1576fa9c4a52d150852994e0b236fe0a610060435964369ac57e4dd4a96ea275ed45ea0a21c6aba98b1496507b4b926517f3683e2b8b58497b28223
SSDEEP 384:xt7fxeD85CypGlMBm2PBf0QhJZcVcA7GTmRmH3OaXIZWnuWEnvWcLPDHRN7/V/cB:7TgDJlM82m+JSGTmAXOaYZWkndm9zgG
TLSH
T1A0034B65D3FC436EEEF60F70AB72D0160E39B6C67812D52E5159A48D2E32B408631B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\System.Security.Principal.Windows.dll
Size 17KB
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ServiceProcess.ServiceController.dll

Path C:\Windows\Installer\SFXCAC7EF4B809745F3C980DE50BDCC53B06F\System.ServiceProcess.ServiceController.dll
Size 22KB
SHA256 264aba3ab46ede36a81014543096c339fd0f249297f3619074272a8d8b32c81a
MD5 3390e22e4758fc9ee1f1255eff93339e
SHA1 86583cf347412da7f726819c2687364ff6d335bb
SHA512 350b170c37e93029eb58c236e65c352abd57e4051afb2341b47d7d8924ddaf10bde0503e94a2dc37c65c826917a0766d40595c6d84df62b2c9ae0d9068f82c3c
SSDEEP 384:R/SU1Gtf2PlJgGdXEkvxKWiWVzDupaWJ/hljHRN7p3/o7R9zBfY+Tj:JSkW2bgKXEPPDjp3c9zW+f
TLSH
T19FA24B6157BC4377CDAA0EB1A9B5D5532E38A3C52912D73F06D4E4062DA7B8CEA30339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 9e33bc93a41f0c8a914042ebb179571a4004ca666bdb1dffee327dd3e192a870
MD5 c12327940995c720faa3f46abbb093e9
SHA1 f7f5dcafeeb0c41f8c4df19a669af82c953eb1bb
SHA512 55a2fed0606f36e5ba0e59ed1d754164daf96326997d73066fa6fa8b4ccd18f7e0d2e8bd2264f76b83d51a1753e5dc1ac1a38137a5b07deb81703b19b9211808
SSDEEP 24576:Ku8m+1zNdoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:c
TLSH
T11347C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b8994370-af88-4a82-b0f4-ad2f40a0a37c}_OnDiskSnapshotProp

Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b8994370-af88-4a82-b0f4-ad2f40a0a37c}_OnDiskSnapshotProp
Size 6KB
SHA256 e35192027715d9cc3981ce4e86afd4033b1bcedbc785929655bbbd0953aa4881
MD5 167ab82705f284ea6975ffbfc9e7fc65
SHA1 891a5e7bcef9770d3ef714edd1aeeeb10dbdfc77
SHA512 0d2050933350db66e1e72bf767f9dc04295cb04a74a75accd583db45c7f39936dac4b32ded5e9fc9e7069e498beb24fa47941da9c918d18e0d4b37217e472154
SSDEEP 96:FeDPWcQsnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:IDPhb++ZVmN
TLSH
T1CED199084AF54311E2B3AB7128F14557A877B911EF33CB8E0298238E2670A10F835F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-822-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-848-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-908-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-906-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-904-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-902-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-900-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-806-0x00007FF90F4E0000-0x00007FF90F713000-memory.dmp

Download

memory/216-805-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-807-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-809-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-813-0x00007FF90F4E0000-0x00007FF90F713000-memory.dmp

Download

memory/216-812-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-814-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-816-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-818-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-820-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-898-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-824-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-826-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-828-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-830-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-833-0x00007FF90F4E0000-0x00007FF90F713000-memory.dmp

Download

memory/216-832-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-835-0x00007FF90F4E0000-0x00007FF90F713000-memory.dmp

Download

memory/216-834-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-836-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-838-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-840-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-842-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-844-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-847-0x00007FF90F4E0000-0x00007FF90F713000-memory.dmp

Download

memory/216-846-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-896-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-850-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-852-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-854-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-856-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-859-0x00007FF90F4E0000-0x00007FF90F713000-memory.dmp

Download

memory/216-858-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-860-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-862-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-864-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-866-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-868-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-870-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-872-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-874-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-876-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-878-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-880-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-882-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-884-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-887-0x00007FF90F4E0000-0x00007FF90F713000-memory.dmp

Download

memory/216-886-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-888-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-890-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-892-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/216-894-0x00007FF7AE680000-0x00007FF7B242C000-memory.dmp

Download

memory/1388-38-0x0000018F60C10000-0x0000018F60C44000-memory.dmp

Download

memory/1388-42-0x0000018F60BA0000-0x0000018F60BAE000-memory.dmp

Download

memory/2196-778-0x0000023093540000-0x0000023093541000-memory.dmp

Download

memory/2196-774-0x0000023093530000-0x0000023093531000-memory.dmp

Download

memory/2196-775-0x00000230935F0000-0x0000023093FA5000-memory.dmp

Download

memory/2196-776-0x00000230935F0000-0x0000023093FA5000-memory.dmp

Download

memory/2196-777-0x00000230935F0000-0x0000023093FA5000-memory.dmp

Download