64d1b461eed7795e23a4c51ae525620ee43220e12f01e17e07d4198780a30423

Analysis

max time kernel
165s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.exe
Size 6.0MB
Sample260817-pm9cgabd64
SHA256 64d1b461eed7795e23a4c51ae525620ee43220e12f01e17e07d4198780a30423
MD5 82432dc312865e37de46645a4f1a8fc8
SHA1 0e15cbfa44e1b888427e80631b7d4b8ea087bb8d
SHA512 909fe63b7755bd432dfd8b88b1ccde2a96535b17b9e35cfd097e461982c59fc6736e4d9e4103418b65097af73cc9421a6825ba0865881dcc77b4f7755ba72a77
SSDEEP 98304:tESlP7ZdJuHDfd6MhRXzA8lg/+/npxWhHRZcXIRDLzIQauSpDVs+wRjUzrX29iJj:tESlP7ZdJuHDogRDA8lg/4TYwsBZUHXB
TLSH
T150569D21368AC46BD5A205F01B2CDAAB912CAE350B6188D7B3DC7D6F17785C31633E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery ransomware spyware trojan

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	988	MsiExec.exe
17	4612	MsiExec.exe
18	4612	MsiExec.exe
21	4612	MsiExec.exe
26	4612	MsiExec.exe
27	4612	MsiExec.exe
29	4612	MsiExec.exe
35	4612	MsiExec.exe
36	4612	MsiExec.exe
37	4612	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	app.exe
File opened (read-only)	\??\H:	app.exe
File opened (read-only)	\??\Z:	app.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	app.exe
File opened (read-only)	\??\S:	app.exe
File opened (read-only)	\??\T:	app.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	app.exe
File opened (read-only)	\??\R:	app.exe
File opened (read-only)	\??\V:	app.exe
File opened (read-only)	\??\X:	app.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	app.exe
File opened (read-only)	\??\O:	app.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	app.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	app.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	app.exe
File opened (read-only)	\??\I:	app.exe
File opened (read-only)	\??\Y:	app.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	app.exe
File opened (read-only)	\??\K:	app.exe
File opened (read-only)	\??\U:	app.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	app.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	app.exe
File opened (read-only)	\??\P:	app.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB8FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF999351967143F306.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9ced.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB79.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB62.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD86.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF045115407008ABB7.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a9ced.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA906.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB020.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB831.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB97B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA47.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF481AD4DDD86A7FC4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD01.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF738BEC077FCDCE30.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEA8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a9cef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA625.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACB2.tmp	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
6056	Windows Updater.exe
1164	AdvancedWindowsManager.exe
4168	AdvancedWindowsManager.exe
200	AdvancedWindowsManager.exe
1544	AdvancedWindowsManager.exe
3692	AdvancedWindowsManager.exe
2072	AdvancedWindowsManager.exe
3008	AdvancedWindowsManager.exe

Loads dropped DLL 32 IoCs

pid	Process
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
4620	MsiExec.exe
4620	MsiExec.exe
4620	MsiExec.exe
4620	MsiExec.exe
4620	MsiExec.exe
4620	MsiExec.exe
4620	MsiExec.exe
988	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Updater.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	AdvancedWindowsManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	AdvancedWindowsManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	AdvancedWindowsManager.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2944	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9\C414548CC3098124D97E31A29BF7FD26	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductName = "Windows Manager"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "F4A25F3ED3407BD4AA3CCC93AD26DB63"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\PackageName = "Windows Manager - Postback Johan.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductIcon = "C:\\Windows\\Installer\\{C845414C-903C-4218-9DE7-132AB97FDF62}\\logo.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	app.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5900000001000000120000005200530041002f00530048004100310000006b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25c000000010000000400000000080000200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	app.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3884	MsiExec.exe
3884	MsiExec.exe
2852	MsiExec.exe
2852	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
4644	msiexec.exe
4644	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4644	msiexec.exe
Token: SeCreateTokenPrivilege	2400	app.exe
Token: SeAssignPrimaryTokenPrivilege	2400	app.exe
Token: SeLockMemoryPrivilege	2400	app.exe
Token: SeIncreaseQuotaPrivilege	2400	app.exe
Token: SeMachineAccountPrivilege	2400	app.exe
Token: SeTcbPrivilege	2400	app.exe
Token: SeSecurityPrivilege	2400	app.exe
Token: SeTakeOwnershipPrivilege	2400	app.exe
Token: SeLoadDriverPrivilege	2400	app.exe
Token: SeSystemProfilePrivilege	2400	app.exe
Token: SeSystemtimePrivilege	2400	app.exe
Token: SeProfSingleProcessPrivilege	2400	app.exe
Token: SeIncBasePriorityPrivilege	2400	app.exe
Token: SeCreatePagefilePrivilege	2400	app.exe
Token: SeCreatePermanentPrivilege	2400	app.exe
Token: SeBackupPrivilege	2400	app.exe
Token: SeRestorePrivilege	2400	app.exe
Token: SeShutdownPrivilege	2400	app.exe
Token: SeDebugPrivilege	2400	app.exe
Token: SeAuditPrivilege	2400	app.exe
Token: SeSystemEnvironmentPrivilege	2400	app.exe
Token: SeChangeNotifyPrivilege	2400	app.exe
Token: SeRemoteShutdownPrivilege	2400	app.exe
Token: SeUndockPrivilege	2400	app.exe
Token: SeSyncAgentPrivilege	2400	app.exe
Token: SeEnableDelegationPrivilege	2400	app.exe
Token: SeManageVolumePrivilege	2400	app.exe
Token: SeImpersonatePrivilege	2400	app.exe
Token: SeCreateGlobalPrivilege	2400	app.exe
Token: SeCreateTokenPrivilege	2400	app.exe
Token: SeAssignPrimaryTokenPrivilege	2400	app.exe
Token: SeLockMemoryPrivilege	2400	app.exe
Token: SeIncreaseQuotaPrivilege	2400	app.exe
Token: SeMachineAccountPrivilege	2400	app.exe
Token: SeTcbPrivilege	2400	app.exe
Token: SeSecurityPrivilege	2400	app.exe
Token: SeTakeOwnershipPrivilege	2400	app.exe
Token: SeLoadDriverPrivilege	2400	app.exe
Token: SeSystemProfilePrivilege	2400	app.exe
Token: SeSystemtimePrivilege	2400	app.exe
Token: SeProfSingleProcessPrivilege	2400	app.exe
Token: SeIncBasePriorityPrivilege	2400	app.exe
Token: SeCreatePagefilePrivilege	2400	app.exe
Token: SeCreatePermanentPrivilege	2400	app.exe
Token: SeBackupPrivilege	2400	app.exe
Token: SeRestorePrivilege	2400	app.exe
Token: SeShutdownPrivilege	2400	app.exe
Token: SeDebugPrivilege	2400	app.exe
Token: SeAuditPrivilege	2400	app.exe
Token: SeSystemEnvironmentPrivilege	2400	app.exe
Token: SeChangeNotifyPrivilege	2400	app.exe
Token: SeRemoteShutdownPrivilege	2400	app.exe
Token: SeUndockPrivilege	2400	app.exe
Token: SeSyncAgentPrivilege	2400	app.exe
Token: SeEnableDelegationPrivilege	2400	app.exe
Token: SeManageVolumePrivilege	2400	app.exe
Token: SeImpersonatePrivilege	2400	app.exe
Token: SeCreateGlobalPrivilege	2400	app.exe
Token: SeCreateTokenPrivilege	2400	app.exe
Token: SeAssignPrimaryTokenPrivilege	2400	app.exe
Token: SeLockMemoryPrivilege	2400	app.exe
Token: SeIncreaseQuotaPrivilege	2400	app.exe
Token: SeMachineAccountPrivilege	2400	app.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2400	app.exe
5588	msiexec.exe
5588	msiexec.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4644	msiexec.exe
3884	MsiExec.exe
5588	msiexec.exe
4612	MsiExec.exe
2852	MsiExec.exe
988	MsiExec.exe
4620	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3884	4644	msiexec.exe	89
PID 2400 wrote to memory of 5588	2400	app.exe	91
PID 4644 wrote to memory of 4612	4644	msiexec.exe	92
PID 4644 wrote to memory of 2852	4644	msiexec.exe	93
PID 4644 wrote to memory of 1856	4644	msiexec.exe	99
PID 4644 wrote to memory of 988	4644	msiexec.exe	101
PID 988 wrote to memory of 2944	988	MsiExec.exe	102
PID 4644 wrote to memory of 4620	4644	msiexec.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\app.exe
"C:\Users\Admin\AppData\Local\Temp\app.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\app.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1786728970 "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5588

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CFEB7033313725452A7ED75B6262B173 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5749DFB1BB23DBF83C4355AB3E5F023B U
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EB3CEB6E3E6F4F45B31DFA97F1E36B03 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2852
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 698C731DC498D2E3DF7EB65E54A8D0BD
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8DA04D7FEB65B40DD3B846F7BC7E3F5E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4116

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1164

C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2072

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3692

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1544

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:200

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4168

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a9cee.rbs

Path C:\Config.Msi\e5a9cee.rbs
Size 1.6MB
SHA256 1d68e0996671c4f14d87d17821ea274272c4a57e2d0f72181f6b2f1885b90a66
MD5 ec341b3899a4cac5588750c060a11c57
SHA1 b066d8d8cbe11d7f6de30d1269f32590fd73d320
SHA512 786ff44701053ee11804011eaded6e89e983f56fcab71282cd521fd9c3a98581b4d785d63d13936701e65a30351734b788f6ddb9bbced82f4b8560953e8b31bf
SSDEEP 24576:t7PXGnr7PXGnt7PXGnV7PXGnT7PXGn27PXGnJ7PXGn9:tzGnrzGntzGnVzGnTzGn2zGnJzGn9
TLSH
T189756C217549C433D6AE09706A2ECFA79B6C79724FA294CBB3C05E7A4C701C19739E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updater.ini

Path C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini
Size 203B
SHA256 01307173015fbbfe4e7dc0c45bbe59e96bb1bf72893c78b32506fc4fd7f42844
MD5 1b50a1313a2c222c7620168265b19967
SHA1 b87b81b9d493d695fb9f98345f6219f45dbcfeca
SHA512 8d9905e110b12efd794bbee8940485926b86f51180b6363a92bd9a71a24a0ec34089d244492a1fab2fa8fdf19ef8927a2b38711fe92b115700d8c823bdfe307f
TLSH
T1B2D02387FF1551A5D11B25D331254DD312418406DFD5006092C2193EF7C1D02030743C
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Updater.ini

Path C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini
Size 284B
SHA256 b796ac54b9bf8af72f074bd9a5f9fff7bc5ff48af047d2a39c3f3c0d6f9746fa
MD5 064f9a5abec87750eefd0b16f53cfa6f
SHA1 5ab69b97fc77bbfa06ed94dc895643730f5b56df
SHA512 03c9ed48a5686ba1aa6f6c566807ddf04ee010ff907700a2acb9b9bb424eb5fa3f4df0edb48a9f34fb1257b879722ff43b8d9c4bd6f37a5595903e859be56a02
TLSH
T138D02B87BF6C52EAD25B66D3322989D212D1990EDFD4006491813D3EB7C3E06031752C
MD5 SHA1 SHA512 TLSH

Submit Download

tracking.ini

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini
Size 84B
SHA256 19703b3afe644a34bbda67ab778f6746af2a717501ccd2b00c4b8ceef81519d9
MD5 24bbbde8fedf6721ba961d6d0bdef64f
SHA1 8d08551b60d128f3910a3c5661751dc185778153
SHA512 eef9e6b35b9e6a18bc76e2442696f24e400438d112f59d82384fb994a940a699b95b085a5ec3d6e807fc6e468567e1253f7f1dbfbce2060fd6ae25b4f5a9aa96
TLSH
T1ECA012162A8031358C209102208700400474218476392070114D01877206E048B81908
MD5 SHA1 SHA512 TLSH

Submit Download

{CB4A9448-5A31-437E-AF63-1B60ABBEAD31}.session

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{CB4A9448-5A31-437E-AF63-1B60ABBEAD31}.session
Size 38KB
SHA256 475754ae8c2874b8c6a4174a93bd37db265d1723825ad7a2521044f7f943fc50
MD5 d8df53ce82b1491dc673b1c9d26e6807
SHA1 826b97d58633449f52698f815bbf2b26c23563cb
SHA512 81cacfc1050eaa0ffb237c6c1a4d6c5710d46a3425de443a106657d8c7d616070437f3c261ef4ac31f199aedc8d14fc75871add1184527c22af18262abf72e44
SSDEEP 768:qDZtYZtsXmZteZtCZtbZt9ZtDZtoZtuZtzZt4ZtGZtPHhZtnbZt10ZttZtKZtwMe:qDZtYZtsXmZteZtCZtbZt9ZtDZtoZtuq
TLSH
T1BB03A91A25FC5152E1F2F684DFF55477A727B8AA68394EAD11C2020D63D2C422893BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CB4A9448-5A31-437E-AF63-1B60ABBEAD31}.session

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{CB4A9448-5A31-437E-AF63-1B60ABBEAD31}.session
Size 33KB
SHA256 f2d787c364a17d2f7fbe93f0e92b734cf6cf5e7856ea355895147ad8ee6de949
MD5 38d916eb78ab2eea0e33e5fe4a959fd3
SHA1 73105d3f6d779e6cace9ca0e3a6407590cf16fb8
SHA512 c77cf84c1faf9e326aa7c5e98a4bbcbc21662bd81a24a25b04a8be44e7c05d29f29f33d4b193f38e2eeba97674bbbaa0ffa2e6c14e9eff574c874748cc165a34
SSDEEP 768:qDZtYZtsXmZteZtCZtbZt9ZtDZtoZtuZtzZt4ZtGZtPHhZtnbZt10ZttZtKZtwMN:qDZtYZtsXmZteZtCZtbZt9ZtDZtoZtuB
TLSH
T15EE2A81625FC5152E1F2F684DFF59477A727B8AA68394EAD11C2020D63D1C422893BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerAnalytics.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI2027\InstallerAnalytics.dll
Size 1.1MB
SHA256 b784371c1278e079ae201226079bece93456f9d38dd733fc29f51e79cf4ea705
MD5 5293d61ddb99767cad4bc4e952517163
SHA1 72ce6155ecd62e2d669af05ba3b9b2da17083cf2
SHA512 7fbc13bdbd6f232bbf870ea3612e957ed072d0cf44dc03511859165a7c47114dedb8d714b1146d92caf58523776929a402da5ae4e6ed045666d11b2c634459ab
SSDEEP 24576:8Nybtg94ZRnEvbyIqxJCrh0lhSMXlSeRGIGVbVXIhx8rsuEZc4:9btgKrCGpjCaCeRGIGVbVXIhx8rsuEZh
TLSH
T12C45F860EC6C8576FE5F117296167A6BE06C1DD01FB078DF82A0C8D61E712CBA139F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

embeddeduiproxy.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI2027\embeddeduiproxy.dll
Size 321KB
SHA256 9838bd52aef9e602cec4b28a8381336743ebb61a01c1adf57800fb6af37aba8f
MD5 9dc11997374ca79880f5694e8f459efc
SHA1 9cbabe25990c59437927005d57be34a620e2552b
SHA512 b58e2fcb4fb2334589e41c7ce4b0b0ef11a9f617cc97f9c2b674abd560327310165e3c6085f9f3d0bdbe625e7b50023b79c1909dc4850640b87c46d03d987d7f
SSDEEP 6144:BcbH5TU4svOhqgDWzuBBIpjHnph0lhSMXlBXBW/PG2RPN:Bx4sDIIFnph0lhSMXl2PDl
TLSH
T12864B010B991D173D75E0A7078BA9F995F3EBD404FA066CB638418A64F713C09B39B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDF1C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDF1C.tmp
Size 1.0MB
SHA256 c54f8a0cc280a9a0c934b8b23bbd530ba739e79ad686121cc8b659882ceb60fd
MD5 379f76e2fa6eef4c2116c2a3ae6896be
SHA1 1752ce4a944162f989505a3a826315ac7614d25f
SHA512 0b4f2fe85c76255db4b853f852b3e9d0f20736a2090d4c40b8ee332a9f0dfdd27bbb3944ccc61200d759f064d0f5f7431fa257c9f2298e1f80f7e74c466a6fee
SSDEEP 24576:ksHYYj0abjxKYLFfR4QOh0lhSMXlmGG3moCZwPKJF:kwYYIabTFZ4QbWGG3moCZwPKJF
TLSH
T154356B212E46C432EA6E01B1693DAA6B917D7D760F7184C763D4FE6B29704C2633AF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE23C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE23C.tmp
Size 1.2MB
SHA256 174dec20b84508bd01ef17444471d6b7a12f0e6529eefb98ee232cacf7faa631
MD5 e38f19ff35bb7a02c959489e0074b8ad
SHA1 d7b191b70d6fa74ef6b5b464cabdf96bdeba0074
SHA512 483e319755ce212fff7ad9edaf43c2fc6b96662a73e487e6dac06688011f3ab999b881b73ebe115aaaa5a09900d2cdac4784014adefd98a924005033d243d981
SSDEEP 24576:qZzGr9yxyUBh4rlZZijyQOziw3fMUwtNIvqf+Wc8MvQLN57tGyKOzBld9Ach5A0B:qZIUivMUwtNIvqfnc8MQLNxtGyKOzBlB
TLSH
T17B450825A87C4573FF2F0D709716572AEA1D65E2ABA008DB82E9D4C929313C353B1F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdvancedWindowsManager.exe

Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\AdvancedWindowsManager.exe
Size 706KB
SHA256 d78329e970c8c83e185da422060a710c25529f05aa4d1e82fa4f4d37acdcd6ee
MD5 5c8f464e96716c6ae2c1fe113e499b10
SHA1 e780aad628a610ba6e83639824f69b86596cc1eb
SHA512 c264ebc69ad4c578f4e071c8f0f209b03c202d9dafe1dbfd2a8085b40b1db0625dc58ab5b81d6b78ff21613efaed95a2f7f18a1da6569a8886425130cb094da4
SSDEEP 12288:ANA8JMdgXRZW/9YsDRUROFpEWnkNWHjLVUQVI:AN8gXRZW/93DReepT0WHjqQVI
TLSH
T1A9F4E547916E105BCD96AB3AD142DFE1B5227C3C15E07BEFD040FA203A3AD9B161B9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Manager - Postback Johan.msi

Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
Size 5.8MB
SHA256 607ea6557422fc804301e57c9cdcaaca9fcc03755008c5475070fc93be88d589
MD5 0b6d5cf00de8a9dec93d547f6808878f
SHA1 3b322f73d2d96e90141cf7f30b652eae49290805
SHA512 3aaa0a2c756c569ba76b2d8cd734b56833bd2f36aa2dbfdb18bcd5c2bebe7fc1f3d99575e216b611fef2a4c1589f046874d90c9445e192123221b41207dfdcac
SSDEEP 49152:PvbwYYIabTFZ4QbWGG3moCZwPKJ6ZIUivMUwtNIvqfnc8MQLNxtGyKOzBld9AchC:rwmabRofqY8lDYc6iWKrFpjCr/3y
TLSH
T13C567C21A96DC433FA2E05719629AB2BE53C6DE20FB058DB93E4F99A1D701C25335F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Updater.exe

Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe
Size 1.7MB
SHA256 b16c68ad7d119d1131a6fa76ef74dbd2ba7ba89a863dd556dc2c789c299c7146
MD5 80265b7adaf80f48c8068228961905d4
SHA1 0ed09b57e9962e4277c2f99a60fd2351736a38b3
SHA512 73f4bc7925fc8c83d35a822494e00d24b58597cbda2619855f283a09af7d82ec6f58c09e5090ece1fca7a3318e2ae0715d27c5cde83bc2c93c4d402fa44c953e
SSDEEP 49152:qDXiBRgnSFoIIrr2tiIjR6bqWNmUHn//fGU7WTPMPmWQ1TQxcjER+TK7R:qGUSFoII1VHHV7t
TLSH
T1AB856C30368F806AC97600F1562DEAAB952E6D350FA054E7F3DC7D2E1B749C21A31F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAB79.tmp

Path C:\Windows\Installer\MSIAB79.tmp
Size 925KB
SHA256 3990a2750338b1442cfe1d37498799196a69eca1d39d73ba6d195af6dc9934af
MD5 031b33b9aff4e6e80c6fa0fdb6df98bc
SHA1 2da63e129739fc15823c6247b912bec58eaf771d
SHA512 e3800c5cecbaa3cc40da79b6a9beacc27a6fbb385e939b5a92a9b0b3e744a18da0fd42b3755b7a7aadb8645d4fe49e688a9bc59bfe4365a5d951e1195e8f8653
SSDEEP 24576:1Xhoi3CDmoN8S8Nh7CMFfwcIh0lhSMXlAGcchaEHTSPyieFX9:9h/lTXfwcdwGPaEHTSPyieFN
TLSH
T15F156C20259FC036F26E01B02E3D8FBBD11D6D750BB164D7A3E4AE6A59B44C2173AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB020.tmp

Path C:\Windows\Installer\MSIB020.tmp
Size 231KB
SHA256 f58864b4480e4290e26b59ac229c037447bf152c84b93e141ec73328d7985b42
MD5 77a32ea6abee734ff0211ae372a0d87f
SHA1 6e96c36071613640f604916e88170cc9be744efa
SHA512 96b5328af36cf79eb09a35028c28854d8e62c0558b9d046e74b6114daa8eeb5f1f248914fb55deaabbf143f48f8bb3cdf64d2e2773a9010dd6e43193da299238
SSDEEP 3072:cQgELLvXdGONzxbhevln0T5F7GaWWxR0X9qMWbL7aJ8jYVGTWRGxWguQFbf:BgEvPnNFYtkPSxWx3MWSXGTptuQhf
TLSH
T191346C217549C433D6AE09706A2ECFA69B6C79724FA294CBF3C05E7A4C701C19739E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-358-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/200-334-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/200-372-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/200-365-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/200-341-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/200-351-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1164-368-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1164-361-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1164-337-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1164-330-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1164-354-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1164-344-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1544-357-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1544-374-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1544-333-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1544-364-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1544-340-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/1544-350-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/2072-331-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/2072-338-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/2072-348-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/2072-362-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/2072-355-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/2072-373-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3008-370-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3008-360-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3008-353-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3008-343-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3008-367-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3008-336-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3692-369-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3692-339-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3692-356-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3692-349-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3692-363-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/3692-332-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/4168-335-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/4168-366-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/4168-371-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/4168-342-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/4168-359-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download

memory/4168-352-0x00007FF765040000-0x00007FF765150000-memory.dmp

Download