GridinSoft Threat Intelligence

A0003300.exe threat report

Detected as Adware.InstallIQ File reputation report
MD5 132905e8a5ff89f5cda5c88e9a536c03
Latest seen 2024-08-07 23:07:33 (2 years ago)
First seen 2024-08-07 23:07:33 (2 years ago)
Size 1 MB
Publisher W3i, LLC
Product InstallIQ Installation Utility
Signed by W3i, LLC

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Adware.InstallIQ. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Adware.InstallIQ
Recommended action
Scan and remove
Last analysis
2024-08-07 23:07:33 (2 years ago)
File hash
132905e8a5ff89f5cda5c88e9a536c03
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Adware.InstallIQ.

Timeline

First seen 2024-08-07 23:07:33 (2 years ago); latest analysis 2024-08-07 23:07:33 (2 years ago).

Publisher context

Company metadata: W3i, LLC. Product metadata: InstallIQ Installation Utility.

Digital signature

Signed by W3i, LLC. The signature is reported as valid, but signed files can still be bundled or abused.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

File context

A0003300.exe is a Windows file recorded in the ThreatInfo database. It is associated with InstallIQ Installation Utility. The reported company name is W3i, LLC. The current detection status is Adware.InstallIQ, based on the latest analysis from 2024-08-07 23:07:33 (2 years ago).

If A0003300.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Adware.InstallIQ.

File Details

Product Name: InstallIQ Installation Utility
Company Name: W3i, LLC
MD5: 132905e8a5ff89f5cda5c88e9a536c03
Size: 1 MB
First Published: 2024-08-07 23:07:33 (2 years ago)
Latest Published: 2024-08-07 23:07:33 (2 years ago)
Status: Adware.InstallIQ (on last analysis)
Analysis Date: 2024-08-07 23:07:33 (2 years ago)

Detection screenshot

A0003300.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Overview

Signed By: W3i, LLC
Status: Valid

The signature on A0003300.exe is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

Common Places:

%sysdrive%\system volume information\_restore{1c0cace0-8262-4395-8db6-654541d9cc6a}

ThreatInfo has observed A0003300.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geography:

1 observed countries
100.0%

The strongest geographic signal for this file is France with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 8.1 100.0%

The most common operating system signal for A0003300.exe is Windows 8.1 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

A0003300.exe is identified as pe for 32-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Windows GUI
Entry point 0x000038d4
Image base 0x00400000

PE Sections:

Sections 31
Raw data 1640960

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 115712 bytes · 7.1% of section data
MD5 e8c70732e7964788a5f2d5a5b37c29e6
.text-co 16384 bytes · 1.0% of section data
Uncommon name
MD5 387d2d0726e403bce8e1af290d872cfc
.text-co 100864 bytes · 6.1% of section data
Uncommon name
MD5 cc5250d25603fe65a23aab672abf3de3
.text-co 123392 bytes · 7.5% of section data
Uncommon name
MD5 eb7fdc33dd197fb75ec34f7fa6466ef7
.text-co 38912 bytes · 2.4% of section data
Uncommon name
MD5 d8db54c383d08c4cbf3ebce4f65b9da2
.text-co 57856 bytes · 3.5% of section data
Uncommon name
MD5 2c36f897506951d336f608012c473fbc
.text-co 11776 bytes · 0.7% of section data
Uncommon name
MD5 1c75c3e6baf2313512bf4f9314e6f7cc
.text-co 258048 bytes · 15.7% of section data
Uncommon name
MD5 5a637d22db7dac891722531ac1b1f0dd
.text-co 20480 bytes · 1.2% of section data
Uncommon name
MD5 4e96fad16d47b66ab9692f69332eab4c
.text-co 13824 bytes · 0.8% of section data
Uncommon name
MD5 646e85d2d4c381a2a5fb14973b67e0d5
.text-co 56320 bytes · 3.4% of section data
Uncommon name
MD5 6187dd8c6cfdff9cb5a26cbb9e4ec55f
.text-co 36864 bytes · 2.2% of section data
Uncommon name
MD5 31be3a80f4aa3a6173888209f2e53fd2
.text-co 73216 bytes · 4.5% of section data
Uncommon name
MD5 4ecd89ff2c6d3b4b8016ad42aac0fa79
.text-co 12288 bytes · 0.7% of section data
Uncommon name
MD5 ce3c087845f1cd598025bd6b1a58d9ac
.text-co 10752 bytes · 0.7% of section data
Uncommon name
MD5 66173fcf224a428b167b573109c88097
.text-co 26112 bytes · 1.6% of section data
Uncommon name
MD5 688c7cc12cfb3aa2cbceba4be8b79c68
.text-ti 41984 bytes · 2.6% of section data
Uncommon name
MD5 3842b998053d9c84616d574308241cf8
.text-co 9728 bytes · 0.6% of section data
Uncommon name
MD5 e40efcaf0e694df0072e7695f9d40374
.text-de 88064 bytes · 5.4% of section data
Uncommon name
MD5 7e7cfd2a2ee6d551c622dc5c8c96a59c
.rdata 285184 bytes · 17.4% of section data
MD5 0b4cd5fed43e0d9c560c2e892f6edeb8
.data 14848 bytes · 0.9% of section data
MD5 16235c83c1f665d0a3a6eb97f99f44ba
.data-de 512 bytes · 0.0% of section data
Uncommon name
MD5 9475a59226943a3ad422e18169989f66
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 bf619eac0cdf3f68d496ea9344137e8b
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 44edfb83569bbb45033af37f1dd02cf2
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 a91e89437fbde4f92937ca0d78ba3321
.data-ti 1536 bytes · 0.1% of section data
Uncommon name
MD5 7c4263540834d6720b334a2103b06834
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 6947bd017820d1f6d0758e15c9dab76d
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 9475a59226943a3ad422e18169989f66
.data-co 3072 bytes · 0.2% of section data
Uncommon name
MD5 0fbc7588e61e0d883119dee9a2877416
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 045e84e9f24ac86085eac938ddba1ffb
.rsrc 220160 bytes · 13.4% of section data
MD5 88aa8c4939cf4ec672b11a9fc645c7a9

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Adware.InstallIQ

This report identifies A0003300.exe by MD5 132905e8a5ff89f5cda5c88e9a536c03. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with 132905e8a5ff89f5cda5c88e9a536c03.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found.