98fa33f272f6e602546dd973c91f87a6ac09dc3cde2a9f0e6a8d94fe96a16fbe

Analysis

user interaction
yes
max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LTK.Manager_1.13.2_x64_en-US.msi
Size 13.7MB
Sample260804-e96jzsfq6w
SHA256 98fa33f272f6e602546dd973c91f87a6ac09dc3cde2a9f0e6a8d94fe96a16fbe
MD5 b1491323b139bf72ef286047f94fac2d
SHA1 68a2a52d129926330628f03a7c8c23fc951e74d9
SHA512 f112d41c3218f8d2dbe5dbfdee51c0682391d35b07721464d93bc0c0da4e70fa1245cc250c8c20d620040580b66cb2598d87a17965fe06fc63f5075af77ec288
SSDEEP 393216:wHYBjbUxDJhMzIJtxNgsR6UrGFHDmz30qPujACDsSL:wHYBjKJhMz+np6UrG4z30B8CDF
TLSH
T182E63347FC159633E94E3E368136DB4466783C64AAA6B81B022C736AD8F33D087376D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1964	ltk-manager.exe

Loads dropped DLL 1 IoCs

pid	Process
1772	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ltk-manager.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\LTK Manager\ltk-manager.exe	msiexec.exe
File created	C:\Program Files\LTK Manager\ltk_patcher_dll.dll	msiexec.exe
File created	C:\Program Files\LTK Manager\ltk_patcher_host.exe	msiexec.exe
File created	C:\Program Files\LTK Manager\Uninstall LTK Manager.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A61B114D-8613-4FBF-B394-5A96F994ADA1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DB6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A61B114D-8613-4FBF-B394-5A96F994ADA1}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e592bb9.msi	msiexec.exe
File created	C:\Windows\Installer\{A61B114D-8613-4FBF-B394-5A96F994ADA1}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e592bbb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592bb9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3920	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302920682146802"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ltk\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D411B16A3168FBF43B49A5699F49DA1A\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\ProductIcon = "C:\\Windows\\Installer\\{A61B114D-8613-4FBF-B394-5A96F994ADA1}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk\DefaultIcon\ = "\"C:\\PROGRA~1\\LTKMAN~1\\LTK-MA~1.EXE\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ltk\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D411B16A3168FBF43B49A5699F49DA1A\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\ProductName = "LTK Manager"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\PackageCode = "A9887CC39A1D57A48A9B091210ADF494"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk\ = "URL: protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D411B16A3168FBF43B49A5699F49DA1A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AB9D0C88F614DFE5089161F2B9C2B0E6\D411B16A3168FBF43B49A5699F49DA1A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk\shell\open\command\ = "\"C:\\PROGRA~1\\LTKMAN~1\\LTK-MA~1.EXE\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AB9D0C88F614DFE5089161F2B9C2B0E6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ltk\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D411B16A3168FBF43B49A5699F49DA1A\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\Version = "17629186"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\SourceList\PackageName = "LTK.Manager_1.13.2_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ltk	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D411B16A3168FBF43B49A5699F49DA1A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D411B16A3168FBF43B49A5699F49DA1A\External	msiexec.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5024	msiexec.exe
5024	msiexec.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe
1964	ltk-manager.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4256	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3920	msiexec.exe
Token: SeSecurityPrivilege	5024	msiexec.exe
Token: SeCreateTokenPrivilege	3920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3920	msiexec.exe
Token: SeLockMemoryPrivilege	3920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3920	msiexec.exe
Token: SeMachineAccountPrivilege	3920	msiexec.exe
Token: SeTcbPrivilege	3920	msiexec.exe
Token: SeSecurityPrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeLoadDriverPrivilege	3920	msiexec.exe
Token: SeSystemProfilePrivilege	3920	msiexec.exe
Token: SeSystemtimePrivilege	3920	msiexec.exe
Token: SeProfSingleProcessPrivilege	3920	msiexec.exe
Token: SeIncBasePriorityPrivilege	3920	msiexec.exe
Token: SeCreatePagefilePrivilege	3920	msiexec.exe
Token: SeCreatePermanentPrivilege	3920	msiexec.exe
Token: SeBackupPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeShutdownPrivilege	3920	msiexec.exe
Token: SeDebugPrivilege	3920	msiexec.exe
Token: SeAuditPrivilege	3920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3920	msiexec.exe
Token: SeChangeNotifyPrivilege	3920	msiexec.exe
Token: SeRemoteShutdownPrivilege	3920	msiexec.exe
Token: SeUndockPrivilege	3920	msiexec.exe
Token: SeSyncAgentPrivilege	3920	msiexec.exe
Token: SeEnableDelegationPrivilege	3920	msiexec.exe
Token: SeManageVolumePrivilege	3920	msiexec.exe
Token: SeImpersonatePrivilege	3920	msiexec.exe
Token: SeCreateGlobalPrivilege	3920	msiexec.exe
Token: SeCreateTokenPrivilege	3920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3920	msiexec.exe
Token: SeLockMemoryPrivilege	3920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3920	msiexec.exe
Token: SeMachineAccountPrivilege	3920	msiexec.exe
Token: SeTcbPrivilege	3920	msiexec.exe
Token: SeSecurityPrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeLoadDriverPrivilege	3920	msiexec.exe
Token: SeSystemProfilePrivilege	3920	msiexec.exe
Token: SeSystemtimePrivilege	3920	msiexec.exe
Token: SeProfSingleProcessPrivilege	3920	msiexec.exe
Token: SeIncBasePriorityPrivilege	3920	msiexec.exe
Token: SeCreatePagefilePrivilege	3920	msiexec.exe
Token: SeCreatePermanentPrivilege	3920	msiexec.exe
Token: SeBackupPrivilege	3920	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeShutdownPrivilege	3920	msiexec.exe
Token: SeDebugPrivilege	3920	msiexec.exe
Token: SeAuditPrivilege	3920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3920	msiexec.exe
Token: SeChangeNotifyPrivilege	3920	msiexec.exe
Token: SeRemoteShutdownPrivilege	3920	msiexec.exe
Token: SeUndockPrivilege	3920	msiexec.exe
Token: SeSyncAgentPrivilege	3920	msiexec.exe
Token: SeEnableDelegationPrivilege	3920	msiexec.exe
Token: SeManageVolumePrivilege	3920	msiexec.exe
Token: SeImpersonatePrivilege	3920	msiexec.exe
Token: SeCreateGlobalPrivilege	3920	msiexec.exe
Token: SeCreateTokenPrivilege	3920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3920	msiexec.exe
Token: SeLockMemoryPrivilege	3920	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3920	msiexec.exe
1964	ltk-manager.exe
3920	msiexec.exe
1964	ltk-manager.exe
1964	ltk-manager.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1964	ltk-manager.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1772	5024	msiexec.exe	97
PID 5024 wrote to memory of 3716	5024	msiexec.exe	101
PID 3920 wrote to memory of 1964	3920	msiexec.exe	105
PID 1964 wrote to memory of 4256	1964	ltk-manager.exe	106
PID 4256 wrote to memory of 4716	4256	msedgewebview2.exe	107
PID 4256 wrote to memory of 1696	4256	msedgewebview2.exe	108
PID 4256 wrote to memory of 1696	4256	msedgewebview2.exe	108
PID 4256 wrote to memory of 1696	4256	msedgewebview2.exe	108
PID 4256 wrote to memory of 4836	4256	msedgewebview2.exe	109
PID 4256 wrote to memory of 2524	4256	msedgewebview2.exe	110
PID 4256 wrote to memory of 2524	4256	msedgewebview2.exe	110
PID 4256 wrote to memory of 4660	4256	msedgewebview2.exe	112
PID 4256 wrote to memory of 4660	4256	msedgewebview2.exe	112
PID 4256 wrote to memory of 4660	4256	msedgewebview2.exe	112
PID 1964 wrote to memory of 1920	1964	ltk-manager.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LTK.Manager_1.13.2_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files\LTK Manager\ltk-manager.exe
  "C:\Program Files\LTK Manager\ltk-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ltk-manager.exe --webview-exe-version=1.13.2 --user-data-dir="C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1964.1232.1231710912995432720
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb7fedb078,0x7ffb7fedb084,0x7ffb7fedb090
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView" --webview-exe-name=ltk-manager.exe --webview-exe-version=1.13.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,10774272024877585732,13198930303486433013,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView" --webview-exe-name=ltk-manager.exe --webview-exe-version=1.13.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,10774272024877585732,13198930303486433013,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView" --webview-exe-name=ltk-manager.exe --webview-exe-version=1.13.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2324,i,10774272024877585732,13198930303486433013,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView" --webview-exe-name=ltk-manager.exe --webview-exe-version=1.13.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,10774272024877585732,13198930303486433013,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4660
- - C:\Windows\system32\reg.exe
    "reg" query "HKLM\SOFTWARE\WOW6432Node\Riot Games, Inc\League of Legends" /v Location
    3⤵
    PID:1920

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C6CF680C0097F349422D86E239F4C25D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1772
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592bba.rbs

Path C:\Config.Msi\e592bba.rbs
Size 11KB
SHA256 9b766bf8051a43c0ba3da843a91834af8557f70ec649bf2b67112b8b073e5f58
MD5 030622b192810560b91625863c6adff6
SHA1 61daa0bc64bcaad88c168a97b9ffa5ab27a6e6a3
SHA512 d39c74afaf889797584556a0c6c60f0540ed9622b682c2ad6efb0951efdfc2dcbb340ab4553782694a96b943150a7eb8ec6313a9a982c9a4a346510aabf62da0
SSDEEP 192:cNN5fhM81zbgtfTzFezZGfGXGfTvEr+WOiWl2pI:cNDfhM81z0tfUGUGkWx
TLSH
T1AA324147B71092C3E9960776EB57231637A7C3DAE309A25B05CC52340F43F85AFA868E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ltk-manager.exe

Path C:\Program Files\LTK Manager\ltk-manager.exe
Size 34.7MB
SHA256 b9bb735ce1fc5e404fcaf31d2afed78cfab434622d3363f8e65d9ad0405b15a6
MD5 e744a5cb8355d0aab631dda512d77e6d
SHA1 e6d7c220b4b1301a6776a9ccff16cfd6c0885f43
SHA512 c92da056b55648ad56f8ff51232261254411b9eba794e788e75fb1ea2ff1d8564075a8a97f684c3cf05808df70b9bacc109239723d22c998bdd269c48545cb2a
SSDEEP 786432:/P8V8tWEjdsYbmeZImM6FhIO4eXKQcgQJZESID:/XtWEjdsYbmeZImM6FhIOhKQcgQJZAD
TLSH
T15D870715BA5A996CD05AC4B483468A725A313CDB0B35B9FF44C4B2382F7DBF46B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LTK Manager.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LTK Manager\LTK Manager.lnk
Size 2KB
SHA256 fe9ae26e590e342eae2389475d9626fd6617243f9b1fd427e09a806b4ecfcbcf
MD5 3406fbaf7accdfbb58bbb68899eab7e1
SHA1 0bfc4b1532ffe8a8a093d0ec283104ee9410eb9e
SHA512 c500d374225e1ff014913c19b973d16cc2f2d792aa36d899d37f083ea777d991434af481d287bd5f821c0b25411fb7f9c48fcc73cf88a6a88be9b84d06b32bdc
TLSH
T17541CE404BE42B6BF337973A2A312211A772FC02F769CF3E118800C40927980869DF6F
MD5 SHA1 SHA512 TLSH

Submit Download

LTK Manager.lnk~RFe596085.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LTK Manager\LTK Manager.lnk~RFe596085.TMP
Size 1KB
SHA256 96f2aa7cb56290d9c956f42f58f6a94aeea19c978c342570838a92d83f4e6130
MD5 a35f64b04f81d73029a2377a05f9abe7
SHA1 c242fa7565e8485451b6534a2ecc6f360b55b8a8
SHA512 73f7ed35414530f47bd644f2994a671a9d43010c7aa9cc65c5c952ac85962cf05103ab2a72a62198f6886eaead2be3c5d70a5606423664e97ef3c876ecf997c7
TLSH
T17941AD404BE56B6BF737933A2A352221A772FC01F7658F3E118801C505679409699F6F
MD5 SHA1 SHA512 TLSH

Submit Download

MSID9D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID9D1.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1fa82767dd8dbdcc98412e329b28844fa077b27d54fab304221ea7f00fc34dcf
MD5 e17d2211535bae8f918d0b8cfd08659b
SHA1 e76cdc454d3a52ac9b1268faca4462ad553c022a
SHA512 7534955cc069fd8ff81afe906aa6c93ccee8ae9f704ec124071c7709fb2b90bf03dae70140f5d8ea19be044206b57159b413443fc0ab1261bbff60f249be9984
TLSH
T145D0121633410234C05030B30107A1091841C92F85454021642CD55D7F048500E17441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0be023a271f1114c3c7f7c9bc505e04133128d3a739e2d80a21cdff811fa7e8c
MD5 0901a73340d9525204d2a7a36f3061da
SHA1 bec742c8dd79b691f518920ab0669811b8b78b74
SHA512 aa70b534ab7f4947d35c8b0268396f2a8a6fe8095895f7c31bf184f6938553f5f41de16cb3014b5a25cd0bf2d7ea170b552e15456d2b9a83a049cd28d9153e21
TLSH
T191D0041453401110C0C070F1411DC10155454C7C4D510131115450447D40D014517100
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 2279da4f19d6b70bd8da2c20da91f69f5299edfdcabe991599722850fbbbae76
MD5 b34dcb0f43b36687828cea7a08b36361
SHA1 f23d380c81966812a968f198a7ea16508439d772
SHA512 3128f3e2d32210a840847c75cdeaacf0c0af29dd50aa861181852b2106726273f77b1acda43020a369e66bac99505355ef282b133bda77105a24226eede6df8d
TLSH
T18DC012A9E500B072C3044F7070C5C550713048D203032FE780AB03F0E1707CC8701041
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a02ef.TMP

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a02ef.TMP
Size 48B
SHA256 b126532a6dec0810c73cfdce9aafc88f15b5a015b783beee4d31f2fe29787037
MD5 ca0c0791117b54e27f1c31333997fe6a
SHA1 281677cba20da5b58653c03a3d8db985a2722978
SHA512 4557c6bebe108a230d3a8f2b0637d9b6b95476082b3fe82090bcbbbba28ea76cdea12a26fb3243b89ede0c4a3da6579ac967c62792464d53cec20d0f996455a3
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9a5da968dec74eb3fd4480b71103569882fa7b76dcb667fc065a84480368a855
MD5 4f2e9cf1ec50b1f84c6ffab22eb44d1e
SHA1 5d5ac99992cbd6b6a969680580e244aa77fb9fb7
SHA512 0cb32369a67a703f57c731fc5c4213550aa0cbd75a5352a7a7930e04201fa38bb6b1a6ab8fda309d118e6e95ad34237a276e3302b5cea7da012b804529698d47
SSDEEP 3:LstlNllkll/l/uiG:LsX3lEtm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Local State
Size 4KB
SHA256 ba7edabffd11baa3ed55734902358162d38c3ff425708b48c55fd36375cc72b5
MD5 6414b5614b9da0fe0ba45975ccc0e20c
SHA1 49732e70e0403ae8e461b329af72213e5c3d58c0
SHA512 f383c88efa8eba87a1e54b53ad409a2d6a2aa37c81ffba2d775035f62eee8eb67e5d145551fd22ca057a8dc5d18072e7f638ebb6a637061ea57388da24cbd4de
SSDEEP 96:zuDTiNkCufl0WA8Frh/cInURoDoto+5E+YDmBjx466dZFwaZgTAlFa:zWTiNbKbooDUhA2jxy4F
TLSH
T13691B83299A4BA3B8DF2D90579863B07A7A44173D5912FB5D6EC0F0C01DF3881352E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Local State
Size 1KB
SHA256 17b7844f7a7be8076c87e8a609b424760d7daddeb98bccc16e274572a40a3469
MD5 8ec33fc6adf9fcd79f19a0add4ebaa00
SHA1 5d53c43bfbfae66e9fd71b538f5633fe5b12f592
SHA512 4ecbed4e66c6df07ec4dd7ed7475ec65ed6af223139346601e69a01c5b90278ddb8d4f8719b38a28d44e01edcd5a337ee7d6d19f230c134de9ed4fcd5da08474
TLSH
T120318573D9D03B32A895A6467186778B1F601166C2604E6452ED4B1C12DB24CE272E32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Local State
Size 3KB
SHA256 561f80015e534bf458847f88e7b95b1e355cdab7bba508b8aed2bbd96381f2cf
MD5 0a60ba413318ce8bc596f54ed2109dab
SHA1 98be27027a5ebab3a14fd397ab9091776301b44a
SHA512 9d3fc62ce61600bfb89f5e918c2a180a3c1b1168d433d926267a7287dc0176061f0e9d6c5b2bbf11ea582147c3e0ec5bd9f417b2e856455eb508434ea39e1250
TLSH
T14271A636A9A4BA3B8DF29A05B8C63B07B7A54233D5912FB4C6ED0F0C01DB3881352D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Local State
Size 4KB
SHA256 3e4351093755039f049fc8fa50cfc2af907760442dbd73375d931ce949025b09
MD5 2f4e782981c8269b301072c67afbbb45
SHA1 d78f0c405b0ac188bdf23f63184b1cda3bfa4e52
SHA512 1f0820ec6fc061569d09e16152e554fa9f344d02b1ea1fa2e08b5140e77f8b0d7ece8503400169a6125fda360b736aa0272f3f223b84309f164a3fbe914bf4f6
SSDEEP 96:zuDTiNkCufl0WA8Frh/cInURoDoto+5E+YDmBjx466dZFwaZgTA6Fa:zWTiNbKbooDUhA2jxy4c
TLSH
T18E91B83299A4BA3B8DF2D90579863B07A7A44173D5912FB5D6EC0F0C01DF3881352E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Local State
Size 2KB
SHA256 75c1ea537e80fa2aa8919818a193ec2ca4224bdd1fd687f49c21057224266afd
MD5 4484cc4f4420a82e51bc739a9925b8e5
SHA1 284b9d7ac817956e93bc4d439c82e695cb602535
SHA512 dcd76a36b26b4d99cfb51b2a0db51d8aef48e7fea4c871dca542eeda84b52f1a1f516240545ce9c38a377e14c21d364b6c024ca232646aabd59d4168d2a2a4b4
TLSH
T12851B573AC54BB37C9E29A04798A3B079B75526286A21F7096ED1F0C01DF25C6352E37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59a946.TMP

Path C:\Users\Admin\AppData\Local\dev.leaguetoolkit.manager\EBWebView\Local State~RFe59a946.TMP
Size 1KB
SHA256 d9c2385379f535489bbfb0c4ad8a26c27f58c5417ca1e6476ea8d752480bea14
MD5 3eb4ca21e150d342764c8a51e294e337
SHA1 ad5e799f36a15e4fc9c3218597ad259f7f9ce5b0
SHA512 475a1b042fc2d6d11bdb1f08c488d152b4a996d8edaac693511cbc209819625dc7a6a875e4d9e743a1dcd7489522321176c3d59934bb752b4ee0cdd38001607f
TLSH
T151216273C9D07B72E995A6467242B78F2F60527682604A2892DE571C22DF68CD373D33
MD5 SHA1 SHA512 TLSH

Submit Download

e592bb9.msi

Path C:\Windows\Installer\e592bb9.msi
Size 13.7MB
SHA256 98fa33f272f6e602546dd973c91f87a6ac09dc3cde2a9f0e6a8d94fe96a16fbe
MD5 b1491323b139bf72ef286047f94fac2d
SHA1 68a2a52d129926330628f03a7c8c23fc951e74d9
SHA512 f112d41c3218f8d2dbe5dbfdee51c0682391d35b07721464d93bc0c0da4e70fa1245cc250c8c20d620040580b66cb2598d87a17965fe06fc63f5075af77ec288
SSDEEP 393216:wHYBjbUxDJhMzIJtxNgsR6UrGFHDmz30qPujACDsSL:wHYBjKJhMz+np6UrG4z30B8CDF
TLSH
T182E63347FC159633E94E3E368136DB4466783C64AAA6B81B022C736AD8F33D087376D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 2630c6a890baccbd993b2535d4de85b18975c3a73df69d2f44e2c93454b741b3
MD5 4af053a5ec88556764383e984a2ffa0e
SHA1 ea304ad733115568de7cf3b8e8c5eb94ae1c7525
SHA512 04dd3dee8e39e4ab1d1e5390f9dd2ab26dbe8bfdf2b88e27fbfaa18877d90c7b90225ab5bcfec9a912650dad80898c3246e7059e6803b33e85ecb95023a64176
SSDEEP 24576:gu8m+1zpdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:+
TLSH
T1AB47C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a9d7308d-ff0f-42b7-9f2f-00a572d7a585}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a9d7308d-ff0f-42b7-9f2f-00a572d7a585}_OnDiskSnapshotProp
Size 6KB
SHA256 c2413e054396d7ba93e71dae9c8b340cc2821054b9f35a61b564c65d27b58a7a
MD5 d2ae39e3e854b2f75e562414f02d882a
SHA1 e65165197f650b6228241f2098dd768adac56b8c
SHA512 34a0f0fbac4d32e37f051f215f4008e6b99ad25d98e161c1c2a20dfd2caad3dcb26a2f072b8042a7d9852c15019c689c97600df454fd26b86b702a80c971c544
SSDEEP 96:FFC7BAZvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:LBb++ZVm
TLSH
T110D1A9085AF54311E2B3AB3229F18543A837B911EF33CB8E0198238E2670A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-75-0x00007FFB9E150000-0x00007FFB9E151000-memory.dmp

Download

memory/1696-259-0x00000264AB8B0000-0x00000264ABD68000-memory.dmp

Download

memory/1696-294-0x00000264AB8B0000-0x00000264ABD68000-memory.dmp

Download

memory/2524-108-0x00007FFB9EC10000-0x00007FFB9EC11000-memory.dmp

Download

memory/2524-109-0x00007FFB9F4B0000-0x00007FFB9F4B1000-memory.dmp

Download

memory/4660-177-0x00007FFB9E150000-0x00007FFB9E151000-memory.dmp

Download