» protectwindowsmanager.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (3)

protectwindowsmanager.exe

Windows SysTool Service

Cherished Technology Limited

The application protectwindowsmanager.exe by Cherished Technology Limited has been detected as adware by 21 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “WindowsMangerProtect Service”. This file is typically installed with the program WindowsMangerProtect20.0.0.502 by Fuyu LIMITED which is a potentially unwanted software program. While running, it connects to the Internet address server-54-230-216-15.mrs50.r.cloudfront.net on port 80 using the HTTP protocol.

File name:

Publisher:

SysTool PasSame LIMITED (signed by Cherished Technology Limited)

Product:

Windows SysTool Service

Version:

20.0.0.1953

MD5:

f94557f8fd41731a3d180383a516fbe3

SHA-1:

e527bbcafeddc287a621a2db49a1f10502c1e3d0

SHA-256:

23d49bf3f6383736399c964ada0045e61941c557d58160635abf46ac3ee36d1f

Scanner detections:

21 / 68

Status:

Adware

Analysis date:

2/25/2025 12:09:51 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.Graftor.172099

705

AhnLab V3 Security

Win32/Kashu.B

2015.03.19

Avira AntiVirus

ADWARE/Adware.Gen

7.11.213.30

avast!

Win32:Kukacka

2014.9-150319

AVG

Win32/Tanatos.M

2016.0.3166

Baidu Antivirus

Adware.Win32.Elex

4.0.3.1532

Bitdefender

Gen:Variant.Adware.Graftor.172099

1.0.20.305

Dr.Web

Trojan.Click3.11058

9.0.1.078

Emsisoft Anti-Malware

Gen:Variant.Adware.Graftor.172099

8.15.03.02.06

ESET NOD32

Win32/ELEX.BH potentially unwanted (variant)

9.11253

F-Secure

Gen:Variant.Adware.Graftor.172099

11.2015-02-03_2

G Data

Gen:Variant.Adware.Graftor.172099

15.3.25

K7 AntiVirus

Virus

13.201.15304

Kaspersky

not-a-virus:AdWare.Win32.WProtManager

14.0.0.2323

Microsoft Security Essentials

Threat.Undefined

1.193.3002.0

MicroWorld eScan

Gen:Variant.Adware.Graftor.172099

16.0.0.183

Reason Heuristics

PUP.Service.CherishedTechnology

15.3.2.6

Rising Antivirus

PE:Win32.KUKU.GEN!1463551

23.00.65.15317

Trend Micro House Call

PE_SALITY.JER

7.2.78

Trend Micro

PE_SALITY.JER

10.465.19

VIPRE Antivirus

Threat.416209

38050

File size:

482.1 KB (493,712 bytes)

Product version:

20.0.0.1953

Original file name:

Windows SysTool.exe

File type:

Executable application (Win32 EXE)

Language:

English

Common path:

C:\ProgramData\windowsmangerprotect\protectwindowsmanager.exe

Digital Signature

Signed by:

Cherished Technology Limited

Authority:

GlobalSign nv-sa

Valid from:

2/28/2015 2:40:34 PM

Valid to:

10/21/2015 2:35:29 PM

Subject:

CN=Cherished Technology Limited, O=Cherished Technology Limited, L=香港, S=香港, C=HK

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121672837E6450CEC951EE141C34F9F8DC2

File PE Metadata

Compilation timestamp:

3/2/2015 2:43:12 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

6144:9X7Ju/fr7DssbcyqePnv1f+OZz/rYX8fZWZxTg7YE+6NxnyDUILtT2B8yWLp+V:97JKrkwbv1GOZzy8fZWYxNtyDUatZLc

Entry address:

0x1D26D

Entry point:

E8, 3F, EB, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 8B, 55, 14, 8B, 4D, 08, 56, 85, D2, 75, 0D, 85, C9, 75, 0D, 39, 4D, 0C, 75, 21, 33, C0, EB, 2E, 85, C9, 74, 19, 8B, 45, 0C, 85, C0, 74, 12, 85, D2, 75, 04, 88, 11, EB, E9, 8B, 75, 10, 85, F6, 75, 17, C6, 01, 00, E8, AD, 06, 00, 00, 6A, 16, 5E, 89, 30, E8, 47, 72, 00, 00, 8B, C6, 5E, 5D, C3, 53, 57, 8B, D9, 8B, F8, 83, FA, FF, 75, 11, 2B, DE, 8A, 06, 88, 04, 33, 46, 84, C0, 74, 1D, 4F, 75, F3, EB, 18, 2B, F1, 8A, 04, 1E, 88, 03, 43, 84, C0, 74, 06, 4F, 74... 
[+]

Code size:

318 KB (325,632 bytes)

Service

Display name:

WindowsMangerProtect Service

Service name:

WindowsMangerProtect

Description:

WindowsMangerProtect service

Type:

Win32OwnProcess

Group:

SchedulerGroup

The file protectwindowsmanager.exe has been discovered within the following program.

WindowsMangerProtect20.0.0.502 by Fuyu LIMITED

Developed by Ma Lin this is a potentially unwanted software program that is typically installed without the user's consent and is billed as a security product but instead bundles additional unwanted software.

87% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to server-54-230-216-241.mrs50.r.cloudfront.net (54.230.216.241:80)

TCP (HTTP):

Connects to server-54-230-216-15.mrs50.r.cloudfront.net (54.230.216.15:80)

TCP (HTTP):

Connects to a9.a2.a86c.ip4.static.sl-reverse.com (108.168.162.169:80)

Remove protectwindowsmanager.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.