Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinlockerVB6Blacksod.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinlockerVB6Blacksod.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target WinlockerVB6Blacksod.exe
- Size 2.4MB
- Sample260702-axt8zaav7z
- SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
- MD5 dbfbf254cfb84d991ac3860105d66fc6
- SHA1 893110d8c8451565caa591ddfccf92869f96c242
- SHA512 5e9ccdf52ebdb548c3fa22f22dd584e9a603ca1163a622db5707dbcc5d01e4835879dcfd28cb1589cbb25aed00f352f7a0a0962b1f38b68fc7d6693375e7666d
- SSDEEP 49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y
- TLSH T1A9C5D022B7E3C077E57716B01929E36DD1F9BD609A32808FA3945B1E6B30991D538F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe" msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 5200 fatalerror.exe - Loads dropped DLL 16 IoCs
pid Process 5644 WinlockerVB6Blacksod.exe 5644 WinlockerVB6Blacksod.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 1688 MsiExec.exe 6452 MsiExec.exe 1688 MsiExec.exe 5644 WinlockerVB6Blacksod.exe 1688 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 1688 MsiExec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: WinlockerVB6Blacksod.exe File opened (read-only) \??\V: WinlockerVB6Blacksod.exe File opened (read-only) \??\W: WinlockerVB6Blacksod.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: WinlockerVB6Blacksod.exe File opened (read-only) \??\J: WinlockerVB6Blacksod.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: WinlockerVB6Blacksod.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: WinlockerVB6Blacksod.exe File opened (read-only) \??\R: WinlockerVB6Blacksod.exe File opened (read-only) \??\X: WinlockerVB6Blacksod.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\D: WinlockerVB6Blacksod.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: WinlockerVB6Blacksod.exe File opened (read-only) \??\G: WinlockerVB6Blacksod.exe File opened (read-only) \??\N: WinlockerVB6Blacksod.exe File opened (read-only) \??\T: WinlockerVB6Blacksod.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: WinlockerVB6Blacksod.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: WinlockerVB6Blacksod.exe File opened (read-only) \??\M: WinlockerVB6Blacksod.exe File opened (read-only) \??\Z: WinlockerVB6Blacksod.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: WinlockerVB6Blacksod.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: WinlockerVB6Blacksod.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: WinlockerVB6Blacksod.exe File opened (read-only) \??\O: WinlockerVB6Blacksod.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe msiexec.exe File created C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav msiexec.exe - Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIAC68.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD93.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE40.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFAFE75FC7524731B4.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB1A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB29F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD15.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE11.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE90.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAEEE.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF8779322D2D5E2F3D.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA65B62702D946862.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606} msiexec.exe File opened for modification C:\Windows\Installer\e58ab8d.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFD7D88957667B15B9.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAFDC.tmp msiexec.exe File created C:\Windows\Tasks\sys.job MsiExec.exe File opened for modification C:\Windows\Installer\MSIAF6C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAF7D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB02B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB0D8.tmp msiexec.exe File created C:\Windows\Installer\e58ab8d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinlockerVB6Blacksod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fatalerror.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\GPU fatalerror.exe Set value (str) \REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.26100.1301\"hypervisor=\"No Hypervisor (Microsoft Hypervisor with SLAT support detected)\"" fatalerror.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5924 msiexec.exe 5924 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 5924 msiexec.exe Token: SeCreateTokenPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeAssignPrimaryTokenPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeLockMemoryPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeIncreaseQuotaPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeMachineAccountPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeTcbPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeSecurityPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeTakeOwnershipPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeLoadDriverPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeSystemProfilePrivilege 5644 WinlockerVB6Blacksod.exe Token: SeSystemtimePrivilege 5644 WinlockerVB6Blacksod.exe Token: SeProfSingleProcessPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeIncBasePriorityPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeCreatePagefilePrivilege 5644 WinlockerVB6Blacksod.exe Token: SeCreatePermanentPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeBackupPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeRestorePrivilege 5644 WinlockerVB6Blacksod.exe Token: SeShutdownPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeDebugPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeAuditPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeSystemEnvironmentPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeChangeNotifyPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeRemoteShutdownPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeUndockPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeSyncAgentPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeEnableDelegationPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeManageVolumePrivilege 5644 WinlockerVB6Blacksod.exe Token: SeImpersonatePrivilege 5644 WinlockerVB6Blacksod.exe Token: SeCreateGlobalPrivilege 5644 WinlockerVB6Blacksod.exe Token: SeShutdownPrivilege 4436 msiexec.exe Token: SeIncreaseQuotaPrivilege 4436 msiexec.exe Token: SeCreateTokenPrivilege 4436 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4436 msiexec.exe Token: SeLockMemoryPrivilege 4436 msiexec.exe Token: SeIncreaseQuotaPrivilege 4436 msiexec.exe Token: SeMachineAccountPrivilege 4436 msiexec.exe Token: SeTcbPrivilege 4436 msiexec.exe Token: SeSecurityPrivilege 4436 msiexec.exe Token: SeTakeOwnershipPrivilege 4436 msiexec.exe Token: SeLoadDriverPrivilege 4436 msiexec.exe Token: SeSystemProfilePrivilege 4436 msiexec.exe Token: SeSystemtimePrivilege 4436 msiexec.exe Token: SeProfSingleProcessPrivilege 4436 msiexec.exe Token: SeIncBasePriorityPrivilege 4436 msiexec.exe Token: SeCreatePagefilePrivilege 4436 msiexec.exe Token: SeCreatePermanentPrivilege 4436 msiexec.exe Token: SeBackupPrivilege 4436 msiexec.exe Token: SeRestorePrivilege 4436 msiexec.exe Token: SeShutdownPrivilege 4436 msiexec.exe Token: SeDebugPrivilege 4436 msiexec.exe Token: SeAuditPrivilege 4436 msiexec.exe Token: SeSystemEnvironmentPrivilege 4436 msiexec.exe Token: SeChangeNotifyPrivilege 4436 msiexec.exe Token: SeRemoteShutdownPrivilege 4436 msiexec.exe Token: SeUndockPrivilege 4436 msiexec.exe Token: SeSyncAgentPrivilege 4436 msiexec.exe Token: SeEnableDelegationPrivilege 4436 msiexec.exe Token: SeManageVolumePrivilege 4436 msiexec.exe Token: SeImpersonatePrivilege 4436 msiexec.exe Token: SeCreateGlobalPrivilege 4436 msiexec.exe Token: SeRestorePrivilege 5924 msiexec.exe Token: SeTakeOwnershipPrivilege 5924 msiexec.exe Token: SeRestorePrivilege 5924 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4436 msiexec.exe 4436 msiexec.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5924 msiexec.exe 4436 msiexec.exe 1688 MsiExec.exe 6452 MsiExec.exe 5200 fatalerror.exe 5200 fatalerror.exe 5200 fatalerror.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5644 wrote to memory of 4436 5644 WinlockerVB6Blacksod.exe 90 PID 5924 wrote to memory of 1688 5924 msiexec.exe 91 PID 5924 wrote to memory of 6452 5924 msiexec.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe"C:\Users\Admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4436
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 73FA6A67D861D5985DE672E119F402D92⤵
- Loads dropped DLL
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1688
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9A55AFAE401FA9E6180034FEA40D2949 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6452
-
-
C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe"C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5200
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000508 0x000000000000050C1⤵PID:6764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58ab90.rbs
- Size 99KB
- SHA256 95cead6c493ecfa5d22b654d27416ef9d861b31d96ee784c18880735cf5ca601
- MD5 9a303ab667798b0cbbb96dd7fe1ed425
- SHA1 cf7aee235ecdfcfb2f7e4395941e8a49b04bf5cc
- SHA512 4edc6b49186faed66b24df821d1d1d227ff31060a1e1a59f8218b4d6be4d586965e0bbe8b7bfbcb6eaec9964fd206f0cff79e75fe76f189d7838abbf65ffcb89
- SSDEEP 1536:aDCPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32Ia:TPYEI0T9kfV8m2+b3da
- TLSH T164A39E1239E0C132C19F5F79885EE7A09B7EB5209DF484073B6807BE6F716919E3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini
- Size 84B
- SHA256 4b6f0e45f9830749a7ce4e9972a64b5e5f336b27d7411dbc661954fd2b4273c1
- MD5 45164ef3cf477fb27434c22c02617969
- SHA1 5ce14ef364fd239db67ae4b4ab585b1b01553433
- SHA512 33f0785c83140fd2a6f6405e4b394ad394d3725a53b76a771e61bc69539e8e423227c8529cc5f2555a8e92382f4b2aa5f16613679dd55b5c918204bbd6504a04
- TLSH T106A0126D1D41303DCC605503120740858C3A60C271361160254641C15224A8CC70920C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini
- Size 84B
- SHA256 84d7bc43e6aa12241710aefe9b4882d146bc9dd07cc76263321411b2061a09be
- MD5 7d7347e6199a7af031d3854d771d78c7
- SHA1 af60272178a561cfb7031c912ec25b59b4af7796
- SHA512 d390feba3881d7a8c17fa6098b04e42b5e79ac59d910e7b4b452caecb3fa9aeb584635429d308d611a9705d4acafa0182e1b29bfab8f98ddb43b1a5645fd1731
- TLSH T17CA0121A454230398C114B0119338241993005D131393030519D04496101B90CBC601C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{A4C6F60D-57CF-450F-8AD3-52E5A12CBCD1}.session
- Size 4KB
- SHA256 cb611c5628d73f8246a2327566c09b9986929990a9c1e29507cb16ad5d32e8be
- MD5 07b5985a3550de82508031b37cea5d12
- SHA1 3d4886968fc668aa73df93142bedec3833076735
- SHA512 74f090bf7fa82ad65cf15437c70599a5d48b397d292226d52a5892e3a834586a5002416dd5ba0ca0cb945fef5bc00456eac3344944b61642abfbb5e1bfd3236b
- SSDEEP 96:smTFzGbTF2+96TF2z1F8nTF2/85g3TF2KrGuTF2g+eTF2nGVqTF2TKhTF20DTF2S:5F4FiFhFiDFnSsFh3FrgF4+FJFZHFMFY
- TLSH T11DA1C5FC0A4A22F088E2B192722096D3BEFD23C55F3721047B92D45C171665DDB1E32B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{A4C6F60D-57CF-450F-8AD3-52E5A12CBCD1}.session
- Size 2KB
- SHA256 f5d02c61f810c58a8e017dc374452ce15e49f19848f6aede456adf1d057c53fd
- MD5 432d9ce66d839b29d8b46e4f59b7b67d
- SHA1 0f740a69a6b284c8b81beeb40e834f26c877a628
- SHA512 fb420a1be8e40df22ff91f008f7484e42752111ebd60260818aa9cd79222c9d7d0fde043b70f7c538388224b2bdf2b36f7274f54074fa12eabcd03f9ec7c8d16
- TLSH T19141B1FD0A4A52F088E2F183735092D2BEFD23C59F762108BB92D41C561665EDB1E32B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{A4C6F60D-57CF-450F-8AD3-52E5A12CBCD1}.session
- Size 3KB
- SHA256 78d9a88ea0c6c9435dd3dd1c67545cb15bc2c7d7988992f2a095f3dc4dab8d6c
- MD5 6502c88a2da3d2215d8c3e2009fac4ff
- SHA1 bf61c25386f7ada61b728def82e94576b4cf53a7
- SHA512 56489cbb3ecb1b8116d9518b93ceb144883b39c7f3f7ef608fb8bfdc8cf74de6d58d3390b30726019de785da99568afb63429586a0ce581c2d6435cc8a8fdb62
- TLSH T12F5191FC0A4A62F088E6F192726096D3BFFD23C55E262108BB92D41C571675ED71E32B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{A4C6F60D-57CF-450F-8AD3-52E5A12CBCD1}.session
- Size 3KB
- SHA256 8cf9e831492b1886bb213c9c234ba8cb2d857f055ada657737873190156fd6da
- MD5 9203c6ebbf9d9ca009dd6a4331646c4b
- SHA1 10028df875d3393706ff3b8dc9678ca00e6268df
- SHA512 64e7014eb662a65d9912b44a3fab73082b8b802d503ab064f5236172cb67895dae9043e4da1feabb44ca57426b87681dfeddecb3baf8dc05080b5acdf972c08a
- TLSH T1A281C3FD0A4A22F048E2F192736096D2BEFD23C55F362108BB92D41C171665EDB1E32B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi
- Size 1010KB
- SHA256 05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a
- MD5 27bc9540828c59e1ca1997cf04f6c467
- SHA1 bfa6d1ce9d4df8beba2bedf59f86a698de0215f3
- SHA512 a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848
- SSDEEP 24576:yAgEr3Zw5abtZ3L60uRaCXEYDmbnreAgC:PgxabtZ320uRa+EYDmbreAg
- TLSH T13D25BF1377E0C132D5EB16305A6AD7649BB9F8709A71C00BB3940A1E2FB1791EB36793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav
- Size 724KB
- SHA256 bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344
- MD5 bab1293f4cf987216af8051acddaf97f
- SHA1 00abe5cfb050b4276c3dd2426e883cd9e1cde683
- SHA512 3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49
- SSDEEP 12288:Avw1QKgDpt4/U3xid1CzNVT+DY3YmTEytodUmvnR:b1Q8/UBiKpZY6jtc
- TLSH T151F4DF52F241CA00D8665E378E52E9E80732FD49EE1A670B30C2BF5F7A732D1AD26355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\fatalerror.exe
- Size 24KB
- SHA256 e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2
- MD5 e579c5b3c386262e3dd4150eb2b13898
- SHA1 5ab7b37956511ea618bf8552abc88f8e652827d3
- SHA512 9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb
- SSDEEP 96:/lxmXVZV52WcuHiPbclq6t2YayIj+WJjR9jutoCPrLDpKVZClILvBUZneUwNQzsw:/TO5TcywKHPfDwvOT3wjSPekd5D2KbZP
- TLSH T1A0B2874AFA6B4023F94C4A714E674BD0173EBC6331826F1FBA687B1D19713411CA1ABE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll
- Size 126KB
- SHA256 76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089
- MD5 3531cf7755b16d38d5e9e3c43280e7d2
- SHA1 19981b17ae35b6e9a0007551e69d3e50aa1afffe
- SHA512 7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd
- SSDEEP 3072:pJzYRnR1UrYpMxbkpG2/wI/Bf6zWcvEm+6MG:zYPqrKM5kA2jy
- TLSH T1C1C3AE213380C032F11B113E8547E7B59BBF7AA1C9A0968B7FA40A655F35392DF3935A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAC68.tmp
- Size 88KB
- SHA256 252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a
- MD5 4083cb0f45a747d8e8ab0d3e060616f2
- SHA1 dcec8efa7a15fa432af2ea0445c4b346fef2a4d6
- SHA512 26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133
- SSDEEP 1536:adQe5dWJ5PQrYbcdv06DoY4J70eVsRckW1HhYpK5EubsF:pGdWJ5PGc6DoYu7hSWhYpwXsF
- TLSH T1E1933C4173E451B9F5E36AB03FFAD615CA76F8A5A5B2C51F4724080B58E0A42FB26333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAD15.tmp
- Size 180KB
- SHA256 a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5
- MD5 d552dd4108b5665d306b4a8bd6083dde
- SHA1 dae55ccba7adb6690b27fa9623eeeed7a57f8da1
- SHA512 e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969
- SSDEEP 3072:uVvQSjk1ZA65w4m2Qhy8beP7bNhDbKYpPlsB2KNndf:ovnqZzxmH7G7bnrhQ/
- TLSH T19A049D1236A0C03BD2BF263544798768A6BCE9615F71C40BB3688E6E1F70782EE75357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAF7D.tmp
- Size 96KB
- SHA256 604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd
- MD5 3cab78d0dc84883be2335788d387601e
- SHA1 14745df9595f190008c7e5c190660361f998d824
- SHA512 df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820
- SSDEEP 1536:9CPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32I:wPYEI0T9kfV8m2+b3d
- TLSH T128A39E2239E0C132C55F5F79485EE7A09B7EB5219DF4840B3B6807BE5F70291AA3A317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAFDC.tmp
- Size 128KB
- SHA256 59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f
- MD5 7e6b88f7bb59ec4573711255f60656b5
- SHA1 5e7a159825a2d2cb263a161e247e9db93454d4f6
- SHA512 294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c
- SSDEEP 1536:BZTfyLkhcCrnxivk2tychAFPsrc2tlNY6hHLThRn0CWihVrePB4E+URMVQKa:BT2fhKUNf1hjZV6SE+UREQKa
- TLSH T1E7D38E1235E0C032C1AB1A3D8519EBA09FBFB621D97445077BA40BBE6F717909B3D34A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB02B.tmp
- Size 312KB
- SHA256 9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437
- MD5 aa82345a8f360804ea1d8d935f0377aa
- SHA1 c09cf3b1666d9192fa524c801bb2e3542c0840e2
- SHA512 c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db
- SSDEEP 6144:2yULssarl2Qr7DsSb45R+V573Wj2quM3o4cBo4NeRiAmf:2/9arvr7Q0FP73Lqz0uRa
- TLSH T160648C22B6E4C032E5AF15746B65C76CC5FDF4B166A1C00BF3D0161E1FB2A82DA25B27
- MD5 SHA1 SHA512 SSDEEP TLSH