Malware analysis WinlockerVB6Blacksod.exe Malicious activity

Add for printing

File name:	WinlockerVB6Blacksod.exe
Full analysis:	https://app.any.run/tasks/fe98b19a-6f6a-4ec1-a010-417e639fe02d
Verdict:	Malicious activity
Threats:	Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. Malware Trends Tracker >>>
Analysis date:	May 16, 2025, 16:29:57
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	advancedinstaller adware takemyfile
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	DBFBF254CFB84D991AC3860105D66FC6
SHA1:	893110D8C8451565CAA591DDFCCF92869F96C242
SHA256:	68B0E1932F3B4439865BE848C2D592D5174DBDBAAB8F66104A0E5B28C928EE0C
SSDEEP:	49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: on
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Creates a new scheduled task via Registry
  - msiexec.exe (PID: 5380)
- Changes the login/logoff helper path in the registry
  - msiexec.exe (PID: 7720)
- ADWARE has been detected (SURICATA)
  - msiexec.exe (PID: 8028)
SUSPICIOUS
- ADVANCEDINSTALLER mutex has been found
  - WinlockerVB6Blacksod.exe (PID: 7652)
- Process drops legitimate windows executable
  - WinlockerVB6Blacksod.exe (PID: 7652)
- Reads the Windows owner or organization settings
  - WinlockerVB6Blacksod.exe (PID: 7652)
  - msiexec.exe (PID: 7720)
- Executable content was dropped or overwritten
  - WinlockerVB6Blacksod.exe (PID: 7652)
- Reads security settings of Internet Explorer
  - msiexec.exe (PID: 8028)
- Access to an unwanted program domain was detected
  - msiexec.exe (PID: 8028)
INFO
- Create files in a temporary directory
  - WinlockerVB6Blacksod.exe (PID: 7652)
  - msiexec.exe (PID: 8028)
- Reads Environment values
  - WinlockerVB6Blacksod.exe (PID: 7652)
  - msiexec.exe (PID: 8028)
- The sample compiled with english language support
  - WinlockerVB6Blacksod.exe (PID: 7652)
  - msiexec.exe (PID: 7720)
- Checks supported languages
  - WinlockerVB6Blacksod.exe (PID: 7652)
  - msiexec.exe (PID: 7720)
  - msiexec.exe (PID: 5380)
  - msiexec.exe (PID: 8028)
- Reads the computer name
  - WinlockerVB6Blacksod.exe (PID: 7652)
  - msiexec.exe (PID: 7720)
  - msiexec.exe (PID: 8028)
  - msiexec.exe (PID: 5380)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 7720)
- Checks proxy server information
  - msiexec.exe (PID: 8028)
- Creates files or folders in the user directory
  - WinlockerVB6Blacksod.exe (PID: 7652)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (78.5)
.exe	\|	Win32 Executable (generic) (11.3)
.exe	\|	Generic Win/DOS Executable (5)
.exe	\|	DOS Executable Generic (5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2015:09:23 13:36:22+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	9
CodeSize:	1034240
InitializedDataSize:	428544
UninitializedDataSize:	-
EntryPoint:	0xc684c
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows GUI
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	Debug
FileOS:	Win32
ObjectFileType:	Dynamic link library
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
CompanyName:	Windows
FileDescription:	This installer database contains the logic and data required to install Error file remover.
FileVersion:	1.0.0.0
InternalName:	Error file remover
LegalCopyright:	Copyright (C) 2016 Windows
OriginalFileName:	Error file remover.exe
ProductName:	Error file remover
ProductVersion:	1.0.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

134

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

5380

C:\Windows\syswow64\MsiExec.exe -Embedding FB7C3E12A41987929C3B6F108C981E35 E Global\MSI0000

C:\Windows\SysWOW64\msiexec.exe

—

msiexec.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

7652

"C:\Users\admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe"

C:\Users\admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe

explorer.exe

User:

admin

Company:

Windows

Integrity Level:

MEDIUM

Description:

This installer database contains the logic and data required to install Error file remover.

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\winlockervb6blacksod.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

7720

C:\WINDOWS\system32\msiexec.exe /V

C:\Windows\System32\msiexec.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

7876

"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "

C:\Windows\SysWOW64\msiexec.exe

—

WinlockerVB6Blacksod.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

8028

C:\Windows\syswow64\MsiExec.exe -Embedding FD6E4968B7331C7AF99427414F343203

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

Add for printing

Total events

1 948

Read events

1 914

Write events

Delete events

Modification events


(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:	write	Name:	C:\Config.Msi\
Value:
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:	write	Name:	C:\Config.Msi\10ce31.rbs
Value: 31180415
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:	write	Name:	C:\Config.Msi\10ce31.rbsLow
Value:
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D45F152E5BE7289449F90D588F84BD5D
Operation:	write	Name:	2E4D254C42ED6B845B3CCA2B040A6160
Value: C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2ED206DB688193B489E86537451F75D7
Operation:	write	Name:	2E4D254C42ED6B845B3CCA2B040A6160
Value: C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4FEC4D8CE9091D3499C19390B8C387CF
Operation:	write	Name:	2E4D254C42ED6B845B3CCA2B040A6160
Value: 02:\Software\Caphyon\Advanced Installer\LZMA\{C452D4E2-DE24-48B6-B5C3-ACB240A01606}\1.0.0.0\AI_ExePath
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19FD36884EFA5E041805E77DDE0ABD3B
Operation:	write	Name:	2E4D254C42ED6B845B3CCA2B040A6160
Value: 02:\Software\Windows\{C452D4E2-DE24-48B6-B5C3-ACB240A01606}\AI_IA_ENABLE
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08220BA658A8A834AA4408D695C989DF
Operation:	write	Name:	2E4D254C42ED6B845B3CCA2B040A6160
Value: 02:\Software\Windows\Error file remover\Version
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6D6C8B1B0459D44BBC71CDA2E1D7680
Operation:	write	Name:	2E4D254C42ED6B845B3CCA2B040A6160
Value: 01:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
(PID) Process:	(7720) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF995B7322EB1E4448DD6A5F36E66D37
Operation:	write	Name:	2E4D254C42ED6B845B3CCA2B040A6160
Value: 02:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7652	WinlockerVB6Blacksod.exe	C:\Users\admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi		executable
		MD5:27BC9540828C59E1CA1997CF04F6C467	SHA256:05C18698C3DC3B2709AFD3355AD5B91A60B2121A52E5FCC474E4E47FB8E95E2A
7652	WinlockerVB6Blacksod.exe	C:\Users\admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll		executable
		MD5:3531CF7755B16D38D5E9E3C43280E7D2	SHA256:76133E832C15AA5CBC49FB3BA09E0B8DD467C307688BE2C9E85E79D3BF62C089
7652	WinlockerVB6Blacksod.exe	C:\Users\admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\holder0.aiph		binary
		MD5:0E7079D29F5BE29C8406DE6F4FD175F2	SHA256:205D938ED0540A568E5F1150CC37A733CB76E7945A17A56CA57715419B9EC87F
7652	WinlockerVB6Blacksod.exe	C:\Users\admin\AppData\Local\Temp\shiB9AD.tmp		executable
		MD5:CE85F5D941EBCA72DA2A55835B303EB9	SHA256:6CF60B8101CBB475F3803E18617172CC180AFA4BC0CA8CA261C2AB6ED1C93EA1
8028	msiexec.exe	C:\Users\admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini		text
		MD5:6E50AEBF7F7C81E6BB0A2ECE020C8AD8	SHA256:36A9E0FDDA6794A8F42E45DCA18769E6968EC56076C4DF214218EB5543EE98A6
7720	msiexec.exe	C:\Windows\Installer\MSID180.tmp		executable
		MD5:4083CB0F45A747D8E8AB0D3E060616F2	SHA256:252B7423B01FF81AEA6FE7B40DE91ABF49F515E9C0C7B95AA982756889F8AC1A
8028	msiexec.exe	C:\Users\admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{F88EC141-AA6F-4464-B13C-D733CC9EF38C}.session		text
		MD5:16EF0CA34BF1F628A25301A999D1246C	SHA256:8191E926C2CA90C1391BF3BE18B9178BF06C4AAF87FC877D077E685C82E189A8
7720	msiexec.exe	C:\Windows\Installer\MSID15F.tmp		executable
		MD5:D552DD4108B5665D306B4A8BD6083DDE	SHA256:A0367875B68B1699D2647A748278EBCE64D5BE633598580977AA126A81CF57C5
7720	msiexec.exe	C:\Windows\Installer\inprogressinstallinfo.ipi		binary
		MD5:329F730D1506D618649498A22B27816D	SHA256:D1BEBDF862D2B28618152CA7C4CFF18E4B78A522B7A6A8616704041DFD641E6A
7720	msiexec.exe	C:\Windows\Installer\MSID1B0.tmp		executable
		MD5:D552DD4108B5665D306B4A8BD6083DDE	SHA256:A0367875B68B1699D2647A748278EBCE64D5BE633598580977AA126A81CF57C5

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted
8028	msiexec.exe	POST	404	44.197.1.6:80	http://collect.installeranalytics.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2104	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2112	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3216	svchost.exe	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6544	svchost.exe	20.190.160.3:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2104	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
8028	msiexec.exe	44.197.1.6:80	collect.installeranalytics.com	AMAZON-AES	US	whitelisted
5116	SIHClient.exe	4.245.163.56:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.104.136.2 20.73.194.208	whitelisted
google.com	142.250.186.142	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
login.live.com	20.190.160.3 20.190.160.14 20.190.160.131 20.190.160.20 20.190.160.22 20.190.160.4 20.190.160.64 40.126.32.68	whitelisted
collect.installeranalytics.com	44.197.1.6 3.217.0.227	whitelisted
slscr.update.microsoft.com	4.245.163.56	whitelisted
fe3cr.delivery.mp.microsoft.com	13.85.23.206 2603:1030:c02:2::284	whitelisted
206.23.85.13.in-addr.arpa	—	unknown
4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa	—	unknown

Threats

PID	Process	Class	Message
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA
8028	msiexec.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] TakeMyFile UA

Add for printing

No debug info

General Info

WinlockerVB6Blacksod.exe

DBFBF254CFB84D991AC3860105D66FC6

893110D8C8451565CAA591DDFCCF92869F96C242

68B0E1932F3B4439865BE848C2D592D5174DBDBAAB8F66104A0E5B28C928EE0C

49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Creates a new scheduled task via Registry

Changes the login/logoff helper path in the registry

ADWARE has been detected (SURICATA)

SUSPICIOUS

ADVANCEDINSTALLER mutex has been found

Process drops legitimate windows executable

Reads the Windows owner or organization settings

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Access to an unwanted program domain was detected

INFO

Create files in a temporary directory

Reads Environment values

The sample compiled with english language support

Checks supported languages

Reads the computer name

Executable content was dropped or overwritten

Checks proxy server information

Creates files or folders in the user directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings