68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c

max time kernel
120s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ransomware/WinlockerVB6Blacksod.exe
Size 2.4MB
Sample261111-cb2f9sts2r
SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
MD5 dbfbf254cfb84d991ac3860105d66fc6
SHA1 893110d8c8451565caa591ddfccf92869f96c242
SHA512 5e9ccdf52ebdb548c3fa22f22dd584e9a603ca1163a622db5707dbcc5d01e4835879dcfd28cb1589cbb25aed00f352f7a0a0962b1f38b68fc7d6693375e7666d
SSDEEP 49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y
TLSH
T1A9C5D022B7E3C077E57716B01929E36DD1F9BD609A32808FA3945B1E6B30991D538F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
620	fatalerror.exe

Loads dropped DLL 16 IoCs

pid	Process
3128	WinlockerVB6Blacksod.exe
3128	WinlockerVB6Blacksod.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
840	MsiExec.exe
5976	MsiExec.exe
840	MsiExec.exe
3128	WinlockerVB6Blacksod.exe
840	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	840	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\M:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\X:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Z:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\U:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\V:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\N:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Y:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\R:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\L:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Q:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e598b00.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E51.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI903A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA758B420E6AAD325.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FDB.tmp	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI9184.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DD2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E02.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF738D0158022AC78F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e598b00.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEDF1AC1E3BDC80B8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9241.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC11F1636D38E6D98.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fatalerror.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fatalerror.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fatalerror.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinlockerVB6Blacksod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1360	msiexec.exe
1360	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1360	msiexec.exe
Token: SeCreateTokenPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeAssignPrimaryTokenPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeLockMemoryPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeIncreaseQuotaPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeMachineAccountPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeTcbPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeSecurityPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeTakeOwnershipPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeLoadDriverPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeSystemProfilePrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeSystemtimePrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeProfSingleProcessPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeIncBasePriorityPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeCreatePagefilePrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeCreatePermanentPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeBackupPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeRestorePrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeShutdownPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeDebugPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeAuditPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeSystemEnvironmentPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeChangeNotifyPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeRemoteShutdownPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeUndockPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeSyncAgentPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeEnableDelegationPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeManageVolumePrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeImpersonatePrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeCreateGlobalPrivilege	3128	WinlockerVB6Blacksod.exe
Token: SeShutdownPrivilege	5948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5948	msiexec.exe
Token: SeCreateTokenPrivilege	5948	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5948	msiexec.exe
Token: SeLockMemoryPrivilege	5948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5948	msiexec.exe
Token: SeMachineAccountPrivilege	5948	msiexec.exe
Token: SeTcbPrivilege	5948	msiexec.exe
Token: SeSecurityPrivilege	5948	msiexec.exe
Token: SeTakeOwnershipPrivilege	5948	msiexec.exe
Token: SeLoadDriverPrivilege	5948	msiexec.exe
Token: SeSystemProfilePrivilege	5948	msiexec.exe
Token: SeSystemtimePrivilege	5948	msiexec.exe
Token: SeProfSingleProcessPrivilege	5948	msiexec.exe
Token: SeIncBasePriorityPrivilege	5948	msiexec.exe
Token: SeCreatePagefilePrivilege	5948	msiexec.exe
Token: SeCreatePermanentPrivilege	5948	msiexec.exe
Token: SeBackupPrivilege	5948	msiexec.exe
Token: SeRestorePrivilege	5948	msiexec.exe
Token: SeShutdownPrivilege	5948	msiexec.exe
Token: SeDebugPrivilege	5948	msiexec.exe
Token: SeAuditPrivilege	5948	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5948	msiexec.exe
Token: SeChangeNotifyPrivilege	5948	msiexec.exe
Token: SeRemoteShutdownPrivilege	5948	msiexec.exe
Token: SeUndockPrivilege	5948	msiexec.exe
Token: SeSyncAgentPrivilege	5948	msiexec.exe
Token: SeEnableDelegationPrivilege	5948	msiexec.exe
Token: SeManageVolumePrivilege	5948	msiexec.exe
Token: SeImpersonatePrivilege	5948	msiexec.exe
Token: SeCreateGlobalPrivilege	5948	msiexec.exe
Token: SeRestorePrivilege	1360	msiexec.exe
Token: SeTakeOwnershipPrivilege	1360	msiexec.exe
Token: SeRestorePrivilege	1360	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5948	msiexec.exe
5948	msiexec.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1360	msiexec.exe
5948	msiexec.exe
840	MsiExec.exe
5976	MsiExec.exe
620	fatalerror.exe
620	fatalerror.exe
620	fatalerror.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 5948	3128	WinlockerVB6Blacksod.exe	90
PID 1360 wrote to memory of 840	1360	msiexec.exe	91
PID 1360 wrote to memory of 5976	1360	msiexec.exe	92

C:\Users\Admin\AppData\Local\Temp\Ransomware\WinlockerVB6Blacksod.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\WinlockerVB6Blacksod.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Ransomware\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Ransomware\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5948

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1031BA67A815657BFEB2887AF07D5AD7
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E0FE932A588996DCECD745F384A910B1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5976

C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe
"C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C4
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598b03.rbs

Path C:\Config.Msi\e598b03.rbs
Size 99KB
SHA256 b9f21a1136a9e5adcccc63da49d28f8b6261c05ce4c48b9640bda6fd73b551f5
MD5 01930c7b3d81b24e4b87c5741df28c0a
SHA1 cc5a8379ea82103fcffb3149e9b88801ca0b5623
SHA512 569fe080287ac1a0e17c526df96f64faed9861976f3684aac15ab1a60749b8e0e862c107937aa7486d255e26cc8df7445b50cd74d46837ea841f117f7ec22f82
SSDEEP 1536:VDCPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32IF:kPYEI0T9kfV8m2+b3dF
TLSH
T15BA39F1239E0C132C15F5F79885EE7A09B7FB5209DF484073B6807BE6F71691AA3A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracking.ini

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini
Size 84B
SHA256 660a99445cffd50e66b95b15dfdc5247fda295a6758df4be6027574cba37ee11
MD5 2ec53db8d3129dcc0a8f58d324bcd02a
SHA1 997476d6941270bd42e8dcfe6474fd3a96410799
SHA512 ea156afba24e09a23ce413e7285ca3fc157639f3b4ccdce314bf5585d0061556a764999cac5e97afb88acf77c8a45b6146569fe540508ff9a9558f80ae31cd28
TLSH
T109A0241D0505313445F7571510D751D35570C0F03475355073570CC1D10F710CFC440D
MD5 SHA1 SHA512 TLSH

Submit Download

tracking.ini

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini
Size 84B
SHA256 800a604baa132c7edd91cebfaf6762b228ba86af6b0e7cbf5fda7b728790556d
MD5 ef86fe2d9bb99e14e49687b6513069d2
SHA1 aefc106ebbe05c196559ec1eb81e3b922c4f6d58
SHA512 7a1802be904e9424d8139702d9861b5d534ee26a3a5de55b855f957a9472679c45cdb6daa8ac873b3e3ee2fd1db432abffced054aa861751abfb4d1a77482710
TLSH
T131A0121909C17034842F418E248D4844D8B000903035316252964080F704A42CB8290E
MD5 SHA1 SHA512 TLSH

Submit Download

{5126AA3F-9C08-4167-BF99-151531DD7620}.session

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{5126AA3F-9C08-4167-BF99-151531DD7620}.session
Size 4KB
SHA256 0690e9d9481fd4fac5936084089c49ad01306d74bc727916191c919d59ca30e2
MD5 bf3e626a6fcd51b6c6a16943b2b31858
SHA1 4d178f12019752a3e48ccd58195d13d834375bdd
SHA512 a80ab8507519d2858851f998973d6f83e629b90fe63748fe3e32773ca2f1252e78ffa271a6e36492b4b0e1b48d71ffd20d343e8c92593f49cb8e99bdf73e2c08
SSDEEP 96:sPXnhCfDCXGFCMUYrBCuIlI/CHIXUCFICgyiECYi/YCbppCL4CX:bRP5dHQ4
TLSH
T1F9A1EEE8864B62F044F6AB93912473E37EF916D95F3A3504B760D41C830762ADF0E627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5126AA3F-9C08-4167-BF99-151531DD7620}.session

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{5126AA3F-9C08-4167-BF99-151531DD7620}.session
Size 4KB
SHA256 30ddb2888bd86e652e148c9b5aa02471ca4389364e27ed2de7cb0bb6e796a80e
MD5 01050eb74ea1f660bedfb248457337d9
SHA1 137ef993cd95d67d65e14e0614f810c81f0a14e5
SHA512 c6dac9a1261f830b0ef0287e0493fa57cba7219b1a8f576a7da37b7f9ebf99dffaaa3dc80157279e7f0dd753c2bc8c3ef7aa4ead5d0ebb575524e72bb9317ebf
SSDEEP 96:sPXnhCfDCXGFCMUYrBCuIlI/CHIXUCFICgyiECYi/YCbppCL4CJJCm1:bRP5dHQw1
TLSH
T1AAA1CDD8864B62F048FAAB92912473E37EF916D95F3A3504F761D41CC20762ADF0E627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Error file remover.msi

Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi
Size 1010KB
SHA256 05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a
MD5 27bc9540828c59e1ca1997cf04f6c467
SHA1 bfa6d1ce9d4df8beba2bedf59f86a698de0215f3
SHA512 a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848
SSDEEP 24576:yAgEr3Zw5abtZ3L60uRaCXEYDmbnreAgC:PgxabtZ320uRa+EYDmbreAg
TLSH
T13D25BF1377E0C132D5EB16305A6AD7649BB9F8709A71C00BB3940A1E2FB1791EB36793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Logoff Sound.wav

Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav
Size 724KB
SHA256 bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344
MD5 bab1293f4cf987216af8051acddaf97f
SHA1 00abe5cfb050b4276c3dd2426e883cd9e1cde683
SHA512 3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49
SSDEEP 12288:Avw1QKgDpt4/U3xid1CzNVT+DY3YmTEytodUmvnR:b1Q8/UBiKpZY6jtc
TLSH
T151F4DF52F241CA00D8665E378E52E9E80732FD49EE1A670B30C2BF5F7A732D1AD26355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fatalerror.exe

Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\fatalerror.exe
Size 24KB
SHA256 e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2
MD5 e579c5b3c386262e3dd4150eb2b13898
SHA1 5ab7b37956511ea618bf8552abc88f8e652827d3
SHA512 9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb
SSDEEP 96:/lxmXVZV52WcuHiPbclq6t2YayIj+WJjR9jutoCPrLDpKVZClILvBUZneUwNQzsw:/TO5TcywKHPfDwvOT3wjSPekd5D2KbZP
TLSH
T1A0B2874AFA6B4023F94C4A714E674BD0173EBC6331826F1FBA687B1D19713411CA1ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll
Size 126KB
SHA256 76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089
MD5 3531cf7755b16d38d5e9e3c43280e7d2
SHA1 19981b17ae35b6e9a0007551e69d3e50aa1afffe
SHA512 7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd
SSDEEP 3072:pJzYRnR1UrYpMxbkpG2/wI/Bf6zWcvEm+6MG:zYPqrKM5kA2jy
TLSH
T1C1C3AE213380C032F11B113E8547E7B59BBF7AA1C9A0968B7FA40A655F35392DF3935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8BFA.tmp

Path C:\Windows\Installer\MSI8BFA.tmp
Size 88KB
SHA256 252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a
MD5 4083cb0f45a747d8e8ab0d3e060616f2
SHA1 dcec8efa7a15fa432af2ea0445c4b346fef2a4d6
SHA512 26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133
SSDEEP 1536:adQe5dWJ5PQrYbcdv06DoY4J70eVsRckW1HhYpK5EubsF:pGdWJ5PGc6DoYu7hSWhYpwXsF
TLSH
T1E1933C4173E451B9F5E36AB03FFAD615CA76F8A5A5B2C51F4724080B58E0A42FB26333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8C78.tmp

Path C:\Windows\Installer\MSI8C78.tmp
Size 180KB
SHA256 a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5
MD5 d552dd4108b5665d306b4a8bd6083dde
SHA1 dae55ccba7adb6690b27fa9623eeeed7a57f8da1
SHA512 e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969
SSDEEP 3072:uVvQSjk1ZA65w4m2Qhy8beP7bNhDbKYpPlsB2KNndf:ovnqZzxmH7G7bnrhQ/
TLSH
T19A049D1236A0C03BD2BF263544798768A6BCE9615F71C40BB3688E6E1F70782EE75357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8F7D.tmp

Path C:\Windows\Installer\MSI8F7D.tmp
Size 96KB
SHA256 604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd
MD5 3cab78d0dc84883be2335788d387601e
SHA1 14745df9595f190008c7e5c190660361f998d824
SHA512 df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820
SSDEEP 1536:9CPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32I:wPYEI0T9kfV8m2+b3d
TLSH
T128A39E2239E0C132C55F5F79485EE7A09B7EB5219DF4840B3B6807BE5F70291AA3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8FDB.tmp

Path C:\Windows\Installer\MSI8FDB.tmp
Size 128KB
SHA256 59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f
MD5 7e6b88f7bb59ec4573711255f60656b5
SHA1 5e7a159825a2d2cb263a161e247e9db93454d4f6
SHA512 294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c
SSDEEP 1536:BZTfyLkhcCrnxivk2tychAFPsrc2tlNY6hHLThRn0CWihVrePB4E+URMVQKa:BT2fhKUNf1hjZV6SE+UREQKa
TLSH
T1E7D38E1235E0C032C1AB1A3D8519EBA09FBFB621D97445077BA40BBE6F717909B3D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI903A.tmp

Path C:\Windows\Installer\MSI903A.tmp
Size 312KB
SHA256 9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437
MD5 aa82345a8f360804ea1d8d935f0377aa
SHA1 c09cf3b1666d9192fa524c801bb2e3542c0840e2
SHA512 c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db
SSDEEP 6144:2yULssarl2Qr7DsSb45R+V573Wj2quM3o4cBo4NeRiAmf:2/9arvr7Q0FP73Lqz0uRa
TLSH
T160648C22B6E4C032E5AF15746B65C76CC5FDF4B166A1C00BF3D0161E1FB2A82DA25B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download