Overview

overview

8

Static

static

1

app.exe

windows10-2004-x64

6

app.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    129s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 08:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    app.exe
  • Size 6.0MB
  • Sample260720-kdaekad18y
  • SHA256 64d1b461eed7795e23a4c51ae525620ee43220e12f01e17e07d4198780a30423
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionransomwarespywaretrojan

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Badlisted process makes network request 7 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 35 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\app.exe
    "C:\Users\Admin\AppData\Local\Temp\app.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\app.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1784295388 "
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5864
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5588
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BFBFE49C5F764BEE2B63520C8E142EFA C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5072
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CDAAE1DB08BBE4049E6DAD2BB52762EA U
      2⤵
      • Badlisted process makes network request
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4168
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 20FC48178683F1467584C23B67226BC3 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1112
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4292
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding BA2751AA7B48D78837AFDB8E68753DDE
        2⤵
        • Badlisted process makes network request
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1564
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4556
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 96C0B457EF6C39DF673CB0F74E8FA642 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4108
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E2D3259D077D25864E490325036F3A92 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:6128
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6C9FF9C4477EE5D7088246A2EB490FF6 U
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2444
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 5510D5884F88EC7599FA0E3FA849110E C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4624
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9548C9B32909439ABAB26D26DBC4064F
        2⤵
          PID:5452
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
            3⤵
            • Kills process with taskkill
            PID:5672
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
            3⤵
            • Kills process with taskkill
            PID:476
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
            3⤵
            • Kills process with taskkill
            PID:3980
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 7D70D52A8342A12A6134CA5BEE520933 E Global\MSI0000
          2⤵
            PID:2080
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:4328
        • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
          "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:2884
        • C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
          "C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1540
          • C:\Users\Admin\AppData\Local\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe
            "C:\Users\Admin\AppData\Local\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Users\Admin\AppData\Local\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini"
            2⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5112
            • C:\ProgramData\AW Manager\Windows Manager\updates\v115\v115.exe
              "C:\ProgramData\AW Manager\Windows Manager\updates\v115\v115.exe"
              3⤵
              • Enumerates connected drives
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3188
              • C:\Windows\SysWOW64\msiexec.exe
                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.5\install\C44AF90\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v115\v115.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v115\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1784295388 "
                4⤵
                • Enumerates connected drives
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                PID:3404
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(1024,50);" "&""C:\Users\Admin\AppData\Local\Temp\ps157A2.ps1""" 2> "C:\Users\Admin\AppData\Local\Temp\ps157A3.txt"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5772
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..bat" "
              3⤵
              • Executes a command shell one-liner
              PID:4436
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..bat" "
                4⤵
                  PID:3920
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" cls"
                  4⤵
                    PID:4768
            • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
              "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
              1⤵
              • Executes dropped EXE
              • Checks processor information in registry
              PID:6076
            • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
              "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
              1⤵
              • Executes dropped EXE
              • Checks processor information in registry
              PID:1140
            • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
              "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
              1⤵
              • Executes dropped EXE
              • Checks processor information in registry
              PID:432
            • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
              "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
              1⤵
              • Executes dropped EXE
              • Checks processor information in registry
              PID:3344
            • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
              "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
              1⤵
              • Executes dropped EXE
              • Checks processor information in registry
              PID:1660
            • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
              "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
              1⤵
              • Executes dropped EXE
              • Checks processor information in registry
              PID:788
            • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
              "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 127
              1⤵
                PID:4348
              • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
                "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 125
                1⤵
                  PID:860
                • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
                  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 128
                  1⤵
                    PID:5756
                  • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
                    "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 126
                    1⤵
                      PID:1888
                    • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
                      "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 129
                      1⤵
                        PID:2788
                      • C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
                        "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 130
                        1⤵
                          PID:4612

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              e59f709.rbs
                              • Path C:\Config.Msi\e59f709.rbs
                              • Size 1.6MB
                              • SHA256 4c1703a009798e61e0038ab2253221b62ce414dfff44697af7829a3f06dc7004
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              e59f70e.rbs
                              • Path C:\Config.Msi\e59f70e.rbs
                              • Size 13KB
                              • SHA256 89b5860b381b4092e06de8027b9bdb33dbce10f50c857156e2f1d77c230c15be
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              e59f70f.rbf
                              • Path C:\Config.Msi\e59f70f.rbf
                              • Size 1KB
                              • SHA256 3de733940dddeb1918f390b55cca92f3a17d7aaa44127e406f4ad9913ad6abd6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              e59f712.rbs
                              • Path C:\Config.Msi\e59f712.rbs
                              • Size 1.6MB
                              • SHA256 b288352cb53d4168ea4fa1ca3e784af78f26980401ba9d30ec6a58b14733aeaa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Privacy.url
                              • Path C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url
                              • Size 108B
                              • SHA256 085c4cae3b71218418ab197bf0b52231e426988882c71a77a67919d52a8c982a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Updater.ini
                              • Path C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini
                              • Size 284B
                              • SHA256 b796ac54b9bf8af72f074bd9a5f9fff7bc5ff48af047d2a39c3f3c0d6f9746fa
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Updater.ini
                              • Path C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini
                              • Size 442B
                              • SHA256 34695e807efe90290177d78c6449728edaaabbe9bf78741b855e17607c9624f2
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Updater.ini
                              • Path C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini
                              • Size 241B
                              • SHA256 69634317050e9bd6cb0ff9c4a36059576b099de8e122bf3cb3c2d99811b27faa
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Windows Updater.ini
                              • Path C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini
                              • Size 380B
                              • SHA256 028c4f3cead1fa818479b7c9de4565149ba43e05f2c4b125430beafba9d41240
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              updates.aiu
                              • Path C:\ProgramData\AW Manager\Windows Manager\updates\updates.aiu
                              • Size 497B
                              • SHA256 0afa8ed803d12eaeababfb7e0968b3c08fa425dc983ed7795589fa674fb6e11d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              v115.exe
                              • Path C:\ProgramData\AW Manager\Windows Manager\updates\v115\v115.exe
                              • Size 6.0MB
                              • SHA256 0b1c412db3c8493bb4d0f2a016629b3b90ad96526a2aa22b0e95262906e17aab
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tracking.ini
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.5\tracking.ini
                              • Size 84B
                              • SHA256 2950abc61fc1423333bd97a6df131ad51fdd085f36640699fd5864f0520cef93
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              {664FA24B-EEF6-409C-9DB4-CE4E6A980DA3}.session
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.5\{664FA24B-EEF6-409C-9DB4-CE4E6A980DA3}.session
                              • Size 9KB
                              • SHA256 389b544ef6df21d3c8b0fdb99a4961b98f808ab1440db230a93258c2a051c6ab
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tracking.ini
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini
                              • Size 84B
                              • SHA256 628e66661c27907589b2ec201057755dcb303cf54956a1c6ea2fd9837a045015
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              tracking.ini
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini
                              • Size 84B
                              • SHA256 fcde8e0ec1286a53b80a6d7c611a1122638d9032cc82bceee8f47f81e992b364
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              tracking.ini
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini
                              • Size 84B
                              • SHA256 3a219a2dc525f2b103a55e16f34071f09ffdd35b1d8d549d7ffc57efc4bc054e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              {E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Size 34KB
                              • SHA256 9c091f0fbcba7d7d3360896303c15a5cf089a5ddf3f24f71138d72e7f2c88ba4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              {E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Size 38KB
                              • SHA256 51275e1c94a6663e892e6436588cd68a7508dbfbca3e539187a2e55e73b147b6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              {E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Size 2KB
                              • SHA256 d7c72a7462af8f17b09751df3ae49f39a5c6c8ee2e5fbcab78542de1c05ddff6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              {E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{E00FC1A1-5BD0-4977-B34B-73F0C8D9A905}.session
                              • Size 8KB
                              • SHA256 f96ef92f12c659cbcd0b80171d749792a3e7d90308fc3f7f45053edf0b7fcba2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              InstallerAnalytics.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\MSI17472\InstallerAnalytics.dll
                              • Size 1.1MB
                              • SHA256 b784371c1278e079ae201226079bece93456f9d38dd733fc29f51e79cf4ea705
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              embeddeduiproxy.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\MSI17472\embeddeduiproxy.dll
                              • Size 321KB
                              • SHA256 9838bd52aef9e602cec4b28a8381336743ebb61a01c1adf57800fb6af37aba8f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSI4E27.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\MSI4E27.tmp
                              • Size 1.0MB
                              • SHA256 c54f8a0cc280a9a0c934b8b23bbd530ba739e79ad686121cc8b659882ceb60fd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSI503D.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\MSI503D.tmp
                              • Size 1.2MB
                              • SHA256 174dec20b84508bd01ef17444471d6b7a12f0e6529eefb98ee232cacf7faa631
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AdvancedWindowsManager.exe
                              • Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\AdvancedWindowsManager.exe
                              • Size 706KB
                              • SHA256 d78329e970c8c83e185da422060a710c25529f05aa4d1e82fa4f4d37acdcd6ee
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Windows Manager - Postback Johan.msi
                              • Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
                              • Size 5.8MB
                              • SHA256 607ea6557422fc804301e57c9cdcaaca9fcc03755008c5475070fc93be88d589
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Windows Updater.exe
                              • Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe
                              • Size 1.7MB
                              • SHA256 b16c68ad7d119d1131a6fa76ef74dbd2ba7ba89a863dd556dc2c789c299c7146
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System Updater.msi
                              • Path C:\Users\Admin\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.5\install\C44AF90\System Updater.msi
                              • Size 5.8MB
                              • SHA256 907cdad1770a131210ad209d7493bd0f81b243412c23aec605705ac00c3058f2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSI12F.tmp
                              • Path C:\Windows\Installer\MSI12F.tmp
                              • Size 925KB
                              • SHA256 3990a2750338b1442cfe1d37498799196a69eca1d39d73ba6d195af6dc9934af
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSI509C.tmp
                              • Path C:\Windows\Installer\MSI509C.tmp
                              • Size 423KB
                              • SHA256 64a3d152e7ff42db8dfd6a83371c74869979e7c8d7b6f25ab848f881a0d9e747
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSI692.tmp
                              • Path C:\Windows\Installer\MSI692.tmp
                              • Size 231KB
                              • SHA256 f58864b4480e4290e26b59ac229c037447bf152c84b93e141ec73328d7985b42
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SystemFoldermsiexec.exe
                              • Path C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe
                              • Size 14KB
                              • SHA256 f0f4d5bf1de9d2463031520aff51feb1e7d432ecea447534a91cbbd79832ac89
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              logo.exe
                              • Path C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe
                              • Size 42KB
                              • SHA256 2bc3a9ce18a7fcb66bb6fab198cfaf68dd1a9321bde70010814073983ceb1fdc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              metadata-2
                              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                              • Size 26.1MB
                              • SHA256 2b81b778ee4f8706555b40ab434e5b9cc5a1184653961c2e87c4792a5c65757f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              {771a327a-f1f6-46fa-8b15-9e94389ba25b}_OnDiskSnapshotProp
                              • Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{771a327a-f1f6-46fa-8b15-9e94389ba25b}_OnDiskSnapshotProp
                              • Size 6KB
                              • SHA256 a86235472879ff52ed7b80228e233334acc95a3d51da247d2491ebc61f514571
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/432-430-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/432-630-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/432-603-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/432-420-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/432-613-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/788-616-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/788-433-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/788-633-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/788-606-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/788-423-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1140-602-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1140-429-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1140-612-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1140-419-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1140-626-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1660-605-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1660-632-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1660-432-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1660-615-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/1660-422-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/2884-324-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/2884-424-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/2884-406-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/2884-415-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/2884-592-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/2884-434-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/3344-631-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/3344-614-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/3344-604-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/3344-421-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/3344-431-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/5772-870-0x0000000005F80000-0x0000000005FE6000-memory.dmp
                              Download

                              memory/5772-869-0x0000000005F10000-0x0000000005F76000-memory.dmp
                              Download

                              memory/5772-878-0x00000000074F0000-0x00000000074FA000-memory.dmp
                              Download

                              memory/5772-879-0x0000000007500000-0x0000000007508000-memory.dmp
                              Download

                              memory/5772-876-0x0000000007E50000-0x00000000084CC000-memory.dmp
                              Download

                              memory/5772-866-0x0000000005040000-0x0000000005076000-memory.dmp
                              Download

                              memory/5772-867-0x0000000005810000-0x0000000005E5A000-memory.dmp
                              Download

                              memory/5772-868-0x0000000005720000-0x0000000005742000-memory.dmp
                              Download

                              memory/5772-877-0x0000000006A50000-0x0000000006A6A000-memory.dmp
                              Download

                              memory/5772-875-0x0000000006550000-0x000000000659C000-memory.dmp
                              Download

                              memory/5772-873-0x00000000061F0000-0x000000000654B000-memory.dmp
                              Download

                              memory/5772-874-0x0000000006180000-0x000000000619E000-memory.dmp
                              Download

                              memory/6076-428-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/6076-628-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/6076-611-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/6076-601-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download

                              memory/6076-418-0x00007FF650D30000-0x00007FF650E40000-memory.dmp
                              Download