1a987075524fc570ef53bf9cf5e868a9bc878f56376d86ce9f8c6d674fc76195

Analysis

user interaction
yes
max time kernel
225s
max time network
218s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cloudflare_WARP_2026.7.1376.0.msi
Size 56.7MB
Sample260916-2rnyjsgl7s
SHA256 1a987075524fc570ef53bf9cf5e868a9bc878f56376d86ce9f8c6d674fc76195
MD5 92475c156b6699ad10cb2eb56e9f2a06
SHA1 750f06f3248bdf76daaae05fcfb6ae41c392b220
SHA512 9075d3019eedb03e6ef908fbf04e2d46e8885c4dabbf456279d0871ce12def5fbe830ca9f62649402faae51582f1a4bd03294aecc336680737dd7b32a1945f5c
SSDEEP 1572864:sMBnqukwfpYXA8zkSH15qCe2fKVRviTaRnK0RSEY:sMOMYw8zZrrruuLD
TLSH
T151D73398F6B014ABD95E5275C8BAD7C0AA727D453B01C4E71A20B02E9D333E1E5BB317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2824	Cloudflare WARP.exe
2988	warp-updater.exe
1148	warp-svc.exe

Loads dropped DLL 44 IoCs

pid	Process
3000	MsiExec.exe
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe
2444	MsiExec.exe
2440	rundll32.exe
2440	rundll32.exe
2440	rundll32.exe
2444	MsiExec.exe
2824	rundll32.exe
2824	rundll32.exe
2824	rundll32.exe
2444	MsiExec.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2444	MsiExec.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
2444	MsiExec.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
2824	Cloudflare WARP.exe
1148	warp-svc.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CloudflareWARP = "C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe"	msiexec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2640	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1148	warp-svc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attention-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-instagram-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-pull-request-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\flutter_inappwebview_windows_plugin.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-pipeline-stream-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-security-unlock-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\msvcp140_2.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-open-sidepanel-right-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-optimization-gear-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\NOTICES.Z	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-instagram-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-optimization-scale-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-security-waf-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-network-scale-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-poison-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_ui\lib\fonts\Inter-SemiBold.otf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\tray_icons\pngs\attention_disconnected.png	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-case-study-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-trace-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-pin-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-code-api-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-edit-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-no-edit-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-pull-request-merged-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\wintun.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloud-multi-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-radar-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-code-js-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-industry-gaming-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-location-pin-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-numeric-3-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-benefits-healthcare-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-pages-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-email-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-performance-validator-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-analytics-bots-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-drag-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-media-play-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-media-stop-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\NativeAssetsManifest.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-network-scale-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\vcruntime140_threads.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-weibo-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-connect-1-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-health-check-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-home-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-inbox-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\assets\json\warp_animation_transition_paused_connecting.json	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloud-upload-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-internet-globe-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-logo-cloudflare-tv-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\vccorlib140.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-consolidation-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-dex-digital-experience-monitoring-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-radar-dish-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-trophy-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-x-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\flutter_inappwebview_web\assets\web\web_support.js	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-cloudflare-area1-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-connect-iot-solid.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-phishing-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-tag-outline.svg	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_ui\lib\fonts\Inter-Medium.otf	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\data\flutter_assets\packages\cf_icons\assets\icons\cf-attention-outline.svg	msiexec.exe

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{5F29C20F-A69A-45EB-9542-45054FE9D77F}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA91091D3B8D44A73A9054EA0883730261\System.Diagnostics.EventLog.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF5799D636FEEA444A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA457169D5D54714F9C334481BFCB2CAB0\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8A1F338698482D79E1EFC40522A82C0A\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8A1F338698482D79E1EFC40522A82C0A\System.Security.Principal.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{5F29C20F-A69A-45EB-9542-45054FE9D77F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA457169D5D54714F9C334481BFCB2CAB0\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAAE6BA27E14FF0193F09A4D24EEFA8E4\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAAE6BA27E14FF0193F09A4D24EEFA8E4\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8A1F338698482D79E1EFC40522A82C0A\System.ServiceProcess.ServiceController.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFEEE5F487848B4F31.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF93822AC3EE4A43CA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA399.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA91091D3B8D44A73A9054EA0883730261\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD41A692055D6ED20.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB5DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e599adf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA91091D3B8D44A73A9054EA0883730261\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAAE6BA27E14FF0193F09A4D24EEFA8E4\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC31D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA8A1F338698482D79E1EFC40522A82C0A\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8A1F338698482D79E1EFC40522A82C0A\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA457169D5D54714F9C334481BFCB2CAB0\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA457169D5D54714F9C334481BFCB2CAB0\System.Security.Principal.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\e599adf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA91091D3B8D44A73A9054EA0883730261\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF63.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA457169D5D54714F9C334481BFCB2CAB0\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA91091D3B8D44A73A9054EA0883730261\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB0CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAAAE6BA27E14FF0193F09A4D24EEFA8E4\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAAE6BA27E14FF0193F09A4D24EEFA8E4\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\{5F29C20F-A69A-45EB-9542-45054FE9D77F}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA8A1F338698482D79E1EFC40522A82C0A\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA91091D3B8D44A73A9054EA0883730261\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA457169D5D54714F9C334481BFCB2CAB0\CustomInstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAAAE6BA27E14FF0193F09A4D24EEFA8E4\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB6D8.tmp	msiexec.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4524	sc.exe
5968	sc.exe
4400	sc.exe
1044	sc.exe
5356	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2640	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\", 1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\" \"%1\""	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\ = "URL:com.cloudflare.warp Protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 6b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d70f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a6b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc652000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100006b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	warp-svc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1852	rundll32.exe
1852	rundll32.exe
5384	msiexec.exe
5384	msiexec.exe
5924	rundll32.exe
5924	rundll32.exe
1148	warp-svc.exe
1148	warp-svc.exe
1148	warp-svc.exe
1148	warp-svc.exe
1148	warp-svc.exe
1148	warp-svc.exe
1148	warp-svc.exe
1148	warp-svc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2640	msiexec.exe
Token: SeSecurityPrivilege	5384	msiexec.exe
Token: SeCreateTokenPrivilege	2640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2640	msiexec.exe
Token: SeLockMemoryPrivilege	2640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2640	msiexec.exe
Token: SeMachineAccountPrivilege	2640	msiexec.exe
Token: SeTcbPrivilege	2640	msiexec.exe
Token: SeSecurityPrivilege	2640	msiexec.exe
Token: SeTakeOwnershipPrivilege	2640	msiexec.exe
Token: SeLoadDriverPrivilege	2640	msiexec.exe
Token: SeSystemProfilePrivilege	2640	msiexec.exe
Token: SeSystemtimePrivilege	2640	msiexec.exe
Token: SeProfSingleProcessPrivilege	2640	msiexec.exe
Token: SeIncBasePriorityPrivilege	2640	msiexec.exe
Token: SeCreatePagefilePrivilege	2640	msiexec.exe
Token: SeCreatePermanentPrivilege	2640	msiexec.exe
Token: SeBackupPrivilege	2640	msiexec.exe
Token: SeRestorePrivilege	2640	msiexec.exe
Token: SeShutdownPrivilege	2640	msiexec.exe
Token: SeDebugPrivilege	2640	msiexec.exe
Token: SeAuditPrivilege	2640	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2640	msiexec.exe
Token: SeChangeNotifyPrivilege	2640	msiexec.exe
Token: SeRemoteShutdownPrivilege	2640	msiexec.exe
Token: SeUndockPrivilege	2640	msiexec.exe
Token: SeSyncAgentPrivilege	2640	msiexec.exe
Token: SeEnableDelegationPrivilege	2640	msiexec.exe
Token: SeManageVolumePrivilege	2640	msiexec.exe
Token: SeImpersonatePrivilege	2640	msiexec.exe
Token: SeCreateGlobalPrivilege	2640	msiexec.exe
Token: SeBackupPrivilege	4664	vssvc.exe
Token: SeRestorePrivilege	4664	vssvc.exe
Token: SeAuditPrivilege	4664	vssvc.exe
Token: SeBackupPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeDebugPrivilege	1852	rundll32.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeDebugPrivilege	5924	rundll32.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeSecurityPrivilege	5384	msiexec.exe
Token: SeSecurityPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeBackupPrivilege	5960	srtasks.exe
Token: SeRestorePrivilege	5960	srtasks.exe
Token: SeSecurityPrivilege	5960	srtasks.exe
Token: SeTakeOwnershipPrivilege	5960	srtasks.exe
Token: SeRestorePrivilege	5384	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2640	msiexec.exe
2640	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2640	msiexec.exe
5384	msiexec.exe
3000	MsiExec.exe
2444	MsiExec.exe
2824	Cloudflare WARP.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 5960	5384	msiexec.exe	93
PID 5384 wrote to memory of 3000	5384	msiexec.exe	95
PID 3000 wrote to memory of 1852	3000	MsiExec.exe	96
PID 5384 wrote to memory of 2444	5384	msiexec.exe	97
PID 2444 wrote to memory of 2440	2444	MsiExec.exe	98
PID 2444 wrote to memory of 2824	2444	MsiExec.exe	117
PID 2444 wrote to memory of 2376	2444	MsiExec.exe	100
PID 2376 wrote to memory of 1044	2376	rundll32.exe	101
PID 2444 wrote to memory of 5924	2444	MsiExec.exe	103
PID 2444 wrote to memory of 4100	2444	MsiExec.exe	104
PID 4100 wrote to memory of 5356	4100	rundll32.exe	105
PID 4100 wrote to memory of 4524	4100	rundll32.exe	107
PID 4100 wrote to memory of 5968	4100	rundll32.exe	109
PID 4100 wrote to memory of 4400	4100	rundll32.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.7.1376.0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5960
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F6AF999CF78BB6422A3DD71139104BE5
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA399.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756031 2 CustomInstallerActions!CustomInstallerActions.Processes.KillGUIProcess
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F04323EAC584D3CC8E804986E925D58F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIAF63.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240758734 7 CustomInstallerActions!CustomInstallerActions.CustomActions.ReadCmdLineParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2440
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB0CB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240759031 18 CustomInstallerActions!CustomInstallerActions.FolderPermissions.SecureDataDirectory
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2824
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB5DD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240760296 28 CustomInstallerActions!CustomInstallerActions.StopUpdater.StopUpdaterCA
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\system32\sc.exe
      "sc.exe" delete CloudflareWARPUpdater
      4⤵
      Launches sc.exe
      PID:1044
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB6D8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240760562 40 CustomInstallerActions!CustomInstallerActions.Processes.StopRunningProcesses
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC31D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240763687 46 CustomInstallerActions!CustomInstallerActions.Service.ConfigureService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP depend= "wlansvc"
      4⤵
      Launches sc.exe
      PID:5356
  - - C:\Windows\system32\sc.exe
      "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
      4⤵
      Launches sc.exe
      PID:4524
  - - C:\Windows\system32\sc.exe
      "sc.exe" failureflag CloudflareWARP 1
      4⤵
      Launches sc.exe
      PID:5968
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP start=AUTO
      4⤵
      Launches sc.exe
      PID:4400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Program Files\Cloudflare\Cloudflare WARP\warp-updater.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-updater.exe"
1⤵
- Executes dropped EXE
PID:2988

C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Cloudflare WARP.exe

Path C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
Size 402KB
SHA256 f53f952932478771fe89b4d8119a29635b27ad1dbe5757b28e329ec86d3bf5dd
MD5 57f49f55d6897176ff11403ff5a09559
SHA1 b20efa84e69c47bc693798310a88a3172af7e083
SHA512 880ff3c7d2853081d98e2a50b27c595502606e77e13acc667ad133d5aea8990b34738068b2d1c3fe689a2ab060a73f9ab0f7e58f82ee12cbe91216aaea5bf58b
SSDEEP 6144:fnWzNxY+fSm6ybm2uaarGk5mbrUqjz+xZRtiKzvzaOV8G:OxY+6m6b2uaarGk5mbYKM
TLSH
T18094B1E666554C9DF2168C748D77B64087A1ACB10B6297CB134036BACEB36C5FE3B603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSparkle.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\WinSparkle.dll
Size 2.7MB
SHA256 d2fe921a42ae10282e04ab90cd00dd2b68b65851799b403eaecffab0b77e09d0
MD5 64f38e6d71beb0d8ed76a832d6298b32
SHA1 7fca5d9a6624c9cc9737558897266035ff8c1fec
SHA512 4be1e21bc39a9a7b2fabcaf7f75f6b5ae3eb70513c7c3f76d5ba8673b76342c30ddc400d0df86c46e978e0467aef3c1fd205213c97a76c03c90880ff7dda21c9
SSDEEP 49152:XOTgqOYMVp7ycLXBDHGO2dvo+ijAfIveBa52fo2mVkK:VqCmOzWe
TLSH
T14AD58D1BAAB441FED4AAC278CE179A57F7F1F9560730A74F0291059E5FAB3210E2E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_links_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\app_links_plugin.dll
Size 147KB
SHA256 0434c0c8582050111ba60d4d2af1fb0ec37901db7cc421334843c56332d30a36
MD5 1a9029b1f529f5c9eb12ec418ab74e60
SHA1 9f6e2bf5a5c4c20ec7e3eaf10b6273d44f88d5a7
SHA512 83a0227fe93a4785c9f2404902227c3dffc915590e83898ad20df1b84bcb8d551462e7bfa6c37f0266c73b770d95621d94efb07895b1c49f567292d0bfd04ab3
SSDEEP 3072:pGyhYxA365JdElyh/5OHIO9y9MpZdTdcCM9GTOJA8tbjzA:pGyhYO365JdERHw9MpZdTdcCrTOJA8Rs
TLSH
T1D7E36D2BB7194067D21AC17DCA834946EBB2B8960B9197CF1750079B1F27BE81F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto_updater_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\auto_updater_windows_plugin.dll
Size 106KB
SHA256 ffc6053b61c1acd66ceb1e74a217344e6610d404dc5f8bd7dd1e567688df5d4f
MD5 045e1926c069aaa20582e64ef5b4b318
SHA1 468b4cefca163f47afa086ea614dcd8c97f6f262
SHA512 ccc8210ef7bd24c28778c37a85ead7af2db0911ecbaf29e319afb00fcbd277e09040c06c531393127abb3751cdb4ed161bc6f9f00b9c5ecb95a4959b1f5fd92d
SSDEEP 1536:EH3NjUnY98Ev69NxozHm1Pwk53nZM87f4PqQ6V27uwxe/l:EdoY98M6pdv53ZM87f4PqQO2jWl
TLSH
T1EEB34C2BEA5C506BD22AC478CE97C945DB71B8914BD1A7CF57540A8E0F23BE80F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_webview_window_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\desktop_webview_window_plugin.dll
Size 192KB
SHA256 af779866f425b1fbdbb56589d6bb8452f3c845f17c9d3890474cee5349c50e62
MD5 d0e0eb9ffd9e7bdd80596eb0188e9ea9
SHA1 28d1a223e392d10c6d976aa5c48ff288f58fd6cd
SHA512 c0e1b46232f894737196ba081ccfc6cd7335ed2e009308563dcf831a49c36b80cf9e4aeb03d251ae4c8381b3310de424b880868c9de310d3ad1c9130e3c75cf8
SSDEEP 6144:+7lotseTJepNq6PN8Bfb9OMvwLtslxqJbNbgHW3QYNb0xbDVbDbAbgbwmb4Qb0be:+7lSn6P+Bfb9OMvwQxqJbNbgHW3QYNbr
TLSH
T1F5142827B65910B6D16BD07CCE824A46F7B2B4825BA197CF175047BB0F67BE89E39300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_inappwebview_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_inappwebview_windows_plugin.dll
Size 958KB
SHA256 4635655ac3bc8e43982447a8789a6c905df6842b18ffd5127a611c59f6e5a829
MD5 5ce8cb6d4299c20b217d72570b255fb0
SHA1 d11797a8103d50d7d11ae777d2882d1c68f5b491
SHA512 37bb66507f6ddda892bb2a8a5836516e33138af16372bc6ef5779cee6cd76006f904413f83e6ffc813b45b97006010d38cc072d3bd24e598ac6bb3dbc3dd809b
SSDEEP 24576:2V6i+mrALokmBLFC8LsyGIM8EyD6EE/O11Mf2u69H:GF8LokYohIZEyC/O/Mfx69H
TLSH
T128254A2F6B4D007CE0F9C3BDCE97CA51E773B49907A187CB1690065A2E677E84E39612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\flutter_windows.dll
Size 18.2MB
SHA256 d1b3828a5e1c9338a3c499459fa5767aa149542cecfbde001c022191d9dac6b3
MD5 20ae91bde4bf28b7cbbe6dc2a29ad652
SHA1 f4d5d350d348b29a3294182b0becfdf8f494993f
SHA512 a62f5142542a7aaa3847691b10c40e19eec069e3d90aa43a026f79f91f8d3ca45480a1cc72a82207e3093a970ff041511541e6de57089c77b28d97da3064d9e6
SSDEEP 196608:DK/sS1sgz8vY/qhZUQ9UgFqUA0hfrZng2B:e/hihZ1Uyq6frZngO
TLSH
T1BD178D03F19640F9C48DE2788B5BA927E671B88E0621B5DF279847153FA7BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\screen_retriever_windows_plugin.dll
Size 128KB
SHA256 c3850c5e93f478b843c6f7dfc967c2500a311fc41a3d963303143685302740cb
MD5 5c2a773875f78a6faed292f011614ca2
SHA1 256116e30a5ef62290d91de3c8d435b45d4a0e16
SHA512 150be4a116724d8bf47c21c109c2f2f93bf23e8b4de3ed2f46968fb72f44d94e74ddbeefa0a5b592b399f4632c55c27d00948144145ecbe61d10a89062889bfa
SSDEEP 1536:veep96cBfMbsl0QzwzJ6u+mxCb+lO/3hhrS9fjPafl2lkMp+eCFAejMHbP7uwP2:vFgNiuJ6MZs3G9fhyMp+eCFAekPj
TLSH
T148D34D2BF759406BD26AD479CD838D56DB71B8914BA1A7CF57500A9A0F27BE80F3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\share_plus_plugin.dll
Size 143KB
SHA256 9e385d4fb771003ed1d9fbf16f0c80c2759d95059af4c9108ea81b6fdacb8ade
MD5 550ddc2a3cb9a0512e53da939d883306
SHA1 ecc98cb71d303090b10b94f68f2325dce18e36b9
SHA512 9ea8e345f6c888e603d163b1b298724cdab29a3c78a017cd806b2517cff8ed0b74af17b59ac6313a8d3c43dec8ddb14f63e9eafa549c2d8e54931276a03399c9
SSDEEP 1536:zK3tgH/jIzIpir96dt6xM1XYHPv504AcDgMfT4JAxYMUvRn5k6f/U/0e/5Qe+WPZ:zctiA6WoXYHPvXAcDgMfT4JAxP5j5
TLSH
T12BE33B27BA1C409BD12AA479D943CA55D772F8A64F9083CB37610B9F4F63BD84E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_recovery_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\system_recovery_plugin.dll
Size 121KB
SHA256 0fc630158b579b799b12dcad91a67c93b90b60aff02c001f7ed3ce57ddff4d43
MD5 fd13377cb27d405db48fc0d2bfef75cc
SHA1 9660bf23722f5bfe10ff3dad4bb5dd51aacaa616
SHA512 b476607185625308f53f5172f9ba83b0f92890f507005f3741167c2406908bdef522c1d059733366295b4bffae30f337ba76ac75e3244d2a8d5c2b267824364d
SSDEEP 1536:m+nqWZ5lUWX6eXQxDzPWnj9/5ZwjZeFIaga3aNEf5WP7HyauJMZCZDvpZJcf1lY9:Vq0FX65/Pl7Hy6ivpZJcf1lYuf/jj
TLSH
T1D1C34C2BFA6950ABD219C479CA578916DB71B8D547E0A7CF17840ADA0F13FE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\tray_manager_plugin.dll
Size 117KB
SHA256 3ca4496a6dfd4f3d9605025002d779461a76c51fb0970f1124b7773625df7a67
MD5 50e13ffe35bf8ba136aedfa50917285a
SHA1 19bb298170af83fb0b33e51ced5addb938d56a8c
SHA512 e4647ce7769dcd512825d7ee1ab28093331c3b8c8cce6301eaca2e4cfa04720c12cf680eb486bfedf24692148f61c87dabb5152b4a2a939daad5c7b925061868
SSDEEP 3072:y0200u6+won+FpvpZJHCyPKOk6h2jquEs:y021u6+QpvpZJHCyPKRquEs
TLSH
T1EBC35C2BEA5D40ABD269C47CCD534916DBB2B8854B91A7CF57800ADB0F67BE40F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\url_launcher_windows_plugin.dll
Size 107KB
SHA256 a23a648f5cc4f7ee9441103097ca590410ce39fccecd342b733ca761b03866cc
MD5 794dfb6acc258a2beb3d214c1c3eca66
SHA1 13ddf53d2744c34a14d4ae9b844d9677d681e3bf
SHA512 608657877a805188b0d054acf2d7586c1883b41e90299045aac0263a63f02c781cc89c3cf5423f75a33dd7ee67955f7c1b3822907663af3af1a316655206f88e
SSDEEP 1536:3GpZRNU942MEIxKj2a66rzCVzhSmLZJM8xVgiqOQ2RDh7uwWWGW:3kvU942MPa6nlomrM8xVgiqOpFhjUW
TLSH
T180B35A2BAB1D40ABD259D478CA934A41DB72BC854B91A7CF13A04ADB0F67BD41F3F211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warp-updater.exe

Path C:\Program Files\Cloudflare\Cloudflare WARP\warp-updater.exe
Size 8.8MB
SHA256 b221075696292ed2e1fafb0d4fbfa5b2be93702965c74b23e36795206b3ee50c
MD5 15f335808ea263d9e83dabde3ef313f9
SHA1 1aa17da35681c05ba68289781cd6ddcaa3f21a9c
SHA512 1636be6a2c00e211dc20fb76444dc6a02ed8fbb5803d986f9c40790d769d033497af5ddbb5ba48eebc0e962dd0110c81e7e5ad282adfb318f6d546080f47f5d3
SSDEEP 98304:O2zL81vhflTBcjh02Ry+qsOWKV/GphFFQx+RDDNr:0+htQxc
TLSH
T175965A22BB5A55EDC19AC07483464672AA3170CB0B35BAFF44D492393F6AAF15F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_manager_plugin.dll
Size 139KB
SHA256 4cae52248b89669ff9bdb5701657c8b256c8f629730d6049241b7a73928924c9
MD5 3a1145428ec388c28c7b52c5e104e465
SHA1 c7e9e7a34b6af9ac79d1a5a26653cd7b9d52f8cd
SHA512 5dba0fe7b013f7061c861a01e57035e235047254716ba0eca1d1a8c34762b9fc94c9485c356d6615b75f367b7b9e0feabca0d8237d4336e6eb54b89c1d4ec230
SSDEEP 3072:sCRvX+KGlvi36enQoWUVP04vpZJHJTgKr5jH:sCJX+KGls6enLP04vpZJHJTgKrdH
TLSH
T122D36D2BF65900A7D26AD4BCCD828946DF72B8C54B91D7CF07914A9B1F23BE41E3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_to_front_plugin.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\window_to_front_plugin.dll
Size 90KB
SHA256 8d8388231ab46ddce5cfa3a481f096b3c14480eea3af8ffa28a8463255c0663f
MD5 9bb2acea5659dc70165041d93d9ab449
SHA1 7d8ee1eba9a5464e7c2dcdf534328e608d014ede
SHA512 5b34bf022ad78e2ad29aba8800ee8f11aea60d2bf9d6432c06ff8f4fdcea323424c2912fc37cfb41976923becfe78b1638fd2479d6ffd13a69edc703d758eea0
SSDEEP 1536:eg6FFW63L7Dx7c08UzqpRkJgTZ8jIvAqWvM93eiiXRZ7uw6dRey:edS6lwfpaJguIvAqWvM93bEjq
TLSH
T1D6934C3BEA59506AD219C878CE438D15DB72B8C64B91A7CF57500ADB0F67BE40F3E212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA399.tmp

Path C:\Windows\Installer\MSIA399.tmp
Size 374KB
SHA256 e2cf06c3761a919daba235fe2212e826cb1e800667368bc1febc3ed2dee42c16
MD5 2cf12145c255dec72a56ca651a118a65
SHA1 245eea93ff617004e012cfc9dbb71bb3be302e0d
SHA512 df2508c31022cadbffac04ebd87218b9a2617e4e24181cfbc9ff82653e15a050c73e623a384a36a09ab2fc3d58ce937978518ab0b74ed5612280b9a22983d1a2
SSDEEP 6144:mCVaQ9abVQaWagrrBNzuqHpkyRn0fIUafFQQq7w9g9:zaSabyWaXNJNRn0LafZ39
TLSH
T19284CF4577E80DA9FC7B963989630946E2737C515B30CADF0360471A9F3B7D0A93AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomInstallerActions.dll

Path C:\Windows\Installer\SFXCA91091D3B8D44A73A9054EA0883730261\CustomInstallerActions.dll
Size 38KB
SHA256 060f66619ee5f58852a346fccb063afa4d75f735ce74aab931cccfe7cea04546
MD5 40496939da7938e937e2114815a662c0
SHA1 c2d94c90eda2c9c4504cbf8c25b2de063fc20f30
SHA512 e637f80462836fbee0c707b42e4d42e416831a1c7844d88da39d47d05029e7fec87567928c41e06f9dd29fb6ff4d669d6182a9d00222e72415a656ef69d17e92
SSDEEP 768:qW8RMK5wbPsIaGMMPbxtfoluiJFsEBsCkutS:qtRMK5wbDBbvfSjJF/BsFutS
TLSH
T18F03858177F84615F6FF6FB2AEB2050019B6BD96AC32CB1D29C4404E1972B849971F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\System.Diagnostics.EventLog.dll
Size 37KB
SHA256 7b1e002e8f3616bf4d42413b7e587e2597d4f6aac013922aa7df3039089e388e
MD5 1f2726d75788dc641eb9cd45bcbe932f
SHA1 63c064f145eafb5ad8e611ea2ed0f6b9bac3da6c
SHA512 d1cd0eb1e1576fa9c4a52d150852994e0b236fe0a610060435964369ac57e4dd4a96ea275ed45ea0a21c6aba98b1496507b4b926517f3683e2b8b58497b28223
SSDEEP 384:xt7fxeD85CypGlMBm2PBf0QhJZcVcA7GTmRmH3OaXIZWnuWEnvWcLPDHRN7/V/cB:7TgDJlM82m+JSGTmAXOaYZWkndm9zgG
TLSH
T1A0034B65D3FC436EEEF60F70AB72D0160E39B6C67812D52E5159A48D2E32B408631B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\System.Security.Principal.Windows.dll
Size 17KB
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ServiceProcess.ServiceController.dll

Path C:\Windows\Installer\SFXCA9F68321F4A41AB9921D404281AC6B230\System.ServiceProcess.ServiceController.dll
Size 22KB
SHA256 264aba3ab46ede36a81014543096c339fd0f249297f3619074272a8d8b32c81a
MD5 3390e22e4758fc9ee1f1255eff93339e
SHA1 86583cf347412da7f726819c2687364ff6d335bb
SHA512 350b170c37e93029eb58c236e65c352abd57e4051afb2341b47d7d8924ddaf10bde0503e94a2dc37c65c826917a0766d40595c6d84df62b2c9ae0d9068f82c3c
SSDEEP 384:R/SU1Gtf2PlJgGdXEkvxKWiWVzDupaWJ/hljHRN7p3/o7R9zBfY+Tj:JSkW2bgKXEPPDjp3c9zW+f
TLSH
T19FA24B6157BC4377CDAA0EB1A9B5D5532E38A3C52912D73F06D4E4062DA7B8CEA30339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\CustomAction.config
Size 942B
SHA256 8a0c15fd64db64866ec57cf6344dad0f40a558bedf38d9801d02f37548f30344
MD5 2c039f283cd4f6de13a3c8a975a0311d
SHA1 aa2364d8f8cfe81ef136b4233e170a2fc69df4fb
SHA512 89e2df87142299b7fec70408e9370d165aa6174abd30c17f9e613032dd1cbb8fd6e907f7eee3f7c62efe19b3ac576ef985335f9977d9eb0564c9738b3f05c92c
TLSH
T18311D04D8A5457B7242127937BAC51D487A1E4AA39A4911C749FA9101B2993913633CF
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCAA902F4F00B4F62288DA9D68D4470543B\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 dd4120702e4cc794705c0ad23ce1eaa265310ab96064fd23947f6dff38e8e680
MD5 599912457191503b65184f0d35a9dbc9
SHA1 60790092e6249b194732a606ac9dd7ac291f66ce
SHA512 cc07ae732a4cd1ba296a0f388b924c0b0280f2fde201409719087cae0c25fdcaec2af771d1734c64daa80c394832d3261e1675001e90a2fc046fda801833d60f
SSDEEP 3072:UOf7tVL6+Yvj12FuDHYQj69UgoTqddHYCnfKlRUjW01Kyqx3GR8UQQ:UgTex224Qj6jomdT8x2R2Q
TLSH
T166149C2657F8473ECEFF8B78E2A14212C7B1F1E67203D71D5D8281A62163784B692397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 db5a8ff19325475d3dd0308c8126e637c9823e45b6a0d04926a4bf934cc59831
MD5 bba05501230a931981580a4b0bf71dea
SHA1 f59d90ad2262a590b2b102319b7d92d4871f1b9c
SHA512 00007410401aa97e9e567e02e75d3d4ab22f6efe6a79cad0add4bdf75be75ed37ead2221462166eb0b12b9e610dca5ecab072288c44b1531834a33205c23b8c1
SSDEEP 24576:nFo3DMP1doO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+H:LHE
TLSH
T1CA57B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7c6ed3b5-d385-41d2-a8bd-150f32152377}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7c6ed3b5-d385-41d2-a8bd-150f32152377}_OnDiskSnapshotProp
Size 6KB
SHA256 1e6b1c29898be5ee16e8007c372e69f015fdc550c90626b0471d4070a708bf88
MD5 064f2e24aa3ad83053a62d66565cf348
SHA1 cee1009902f303784c41158228faf6004ac59c05
SHA512 d62b11acf99d861feacc10b9dd54d9b8b6b0cbec96e9ac088d5d821a47eaf7e64236d6c5f51b2371682fa0d038c016b194e2b32b6771e934d222ec712afc1e87
SSDEEP 96:FbPsWZ4vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:9Ps3b++uVmN
TLSH
T1D6D197085AF54711E2B3AB312CF18557A877B851EF33CB8E0198238E6630A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-813-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-829-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-845-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-843-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-841-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-839-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-806-0x00007FFD690B0000-0x00007FFD692E3000-memory.dmp

Download

memory/1148-837-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-838-0x00007FFD690B0000-0x00007FFD692E3000-memory.dmp

Download

memory/1148-835-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-836-0x00007FFD690B0000-0x00007FFD692E3000-memory.dmp

Download

memory/1148-833-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-831-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-805-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-827-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-825-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-823-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-821-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-819-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-817-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-815-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1148-816-0x00007FFD690B0000-0x00007FFD692E3000-memory.dmp

Download

memory/1148-807-0x00007FF722030000-0x00007FF725DEE000-memory.dmp

Download

memory/1852-21-0x000001A69FB20000-0x000001A69FB54000-memory.dmp

Download

memory/1852-25-0x000001A69F9C0000-0x000001A69F9CE000-memory.dmp

Download

memory/2824-800-0x00007FFD75DC0000-0x00007FFD75DD8000-memory.dmp

Download

memory/2824-798-0x00007FFD76400000-0x00007FFD76420000-memory.dmp

Download

memory/2824-787-0x00007FF7928A0000-0x00007FF792906000-memory.dmp

Download

memory/2824-788-0x00007FFD7DA90000-0x00007FFD7DAAB000-memory.dmp

Download

memory/2824-789-0x00007FFD764F0000-0x00007FFD76522000-memory.dmp

Download

memory/2824-790-0x00007FFD7DA60000-0x00007FFD7DA86000-memory.dmp

Download

memory/2824-791-0x00007FFD764C0000-0x00007FFD764E5000-memory.dmp

Download

memory/2824-793-0x00007FFD76490000-0x00007FFD764B2000-memory.dmp

Download

memory/2824-794-0x00007FFD76470000-0x00007FFD76490000-memory.dmp

Download

memory/2824-795-0x00007FFD76450000-0x00007FFD7646D000-memory.dmp

Download

memory/2824-796-0x00007FFD76420000-0x00007FFD76445000-memory.dmp

Download

memory/2824-797-0x00007FFD744E0000-0x00007FFD74569000-memory.dmp

Download

memory/2824-775-0x000002738BDC0000-0x000002738BDC1000-memory.dmp

Download

memory/2824-801-0x00007FFD7F4C0000-0x00007FFD7F4CC000-memory.dmp

Download

memory/2824-802-0x00007FFD69770000-0x00007FFD6A9BD000-memory.dmp

Download

memory/2824-792-0x00007FFD72660000-0x00007FFD72755000-memory.dmp

Download

memory/2824-804-0x00007FFD692F0000-0x00007FFD695BB000-memory.dmp

Download

memory/2824-799-0x00007FFD763E0000-0x00007FFD763FE000-memory.dmp

Download

memory/2824-774-0x000002738EBA0000-0x000002738F53D000-memory.dmp

Download

memory/2824-772-0x000002738EBA0000-0x000002738F53D000-memory.dmp

Download

memory/2824-773-0x000002738EBA0000-0x000002738F53D000-memory.dmp

Download

memory/2824-771-0x000002738BDB0000-0x000002738BDB1000-memory.dmp

Download