File name:

viewer.exe

Full analysis: https://app.any.run/tasks/235d5884-d44d-4559-a2d3-98df35e4982b
Verdict: Malicious activity
Analysis date: January 22, 2025, 02:05:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D5B160FCA295AB5C6F945872D403D48F

SHA1:

E8554537C550D0AEF743096D83F94583C13F969E

SHA256:

1094BDD453A53439E21BA67FBB224D041B9A52C1A1193B49180CCEF19A40E549

SSDEEP:

12288:40Plbycgwxnyi9GgtW46ftzXEAHNCdaSidW+:Xby76yAn617aFidW+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • viewer.exe (PID: 6412)

  • SUSPICIOUS

    • Executes application which crashes

      • viewer.exe (PID: 6412)

  • INFO

    • The sample compiled with english language support

      • viewer.exe (PID: 6412)

    • Checks supported languages

      • viewer.exe (PID: 6412)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6512)

    • Reads the software policy settings

      • WerFault.exe (PID: 6512)

    • Checks proxy server information

      • WerFault.exe (PID: 6512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:10 11:54:57+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.41
CodeSize: 320512
InitializedDataSize: 109568
UninitializedDataSize: -
EntryPoint: 0x2a0f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 22.3.0.0
ProductVersionNumber: 22.3.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Caphyon LTD
FileDescription: File that launches another file
FileVersion: 22.3.0.0
InternalName: viewer.exe
LegalCopyright: (c) Caphyon LTD. All rights reserved.
OriginalFileName: viewer.exe
ProductName: Advanced Installer
ProductVersion: 22.3.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start viewer.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6412"C:\Users\admin\AppData\Local\Temp\viewer.exe" C:\Users\admin\AppData\Local\Temp\viewer.exe
explorer.exe
User:
admin
Company:
Caphyon LTD
Integrity Level:
MEDIUM
Description:
File that launches another file
Exit code:
3221225477
Version:
22.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\viewer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
6512C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6412 -s 236C:\Windows\SysWOW64\WerFault.exe
viewer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 080
Read events
3 080
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_viewer.exe_9cf261b0efa230fe231f655b4df2d4828e0cf27_a5e89076_9fc0a9ba-1841-435a-bf8e-731e9182d418\Report.wer —
MD5:—
SHA256:—
6512WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6512WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\viewer.exe.6412.dmpbinary
MD5:4DB1D7E7D54753FCEC05BC38C002EA3E
SHA256:0214836EA0B2746CB85F3E8BEFC5F6F46243271E7B088CCC506AE0F15780DBB8
6512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE1AB.tmp.xmlxml
MD5:9F0653339CA3A41BEDECAC2349411419
SHA256:9FF44ECBCB9856725C4BE514B1572C7774855B43A669436C0B4A90E24422BCB4
6512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD93C.tmp.dmpbinary
MD5:F7A43BC86B2506C40561DAEC1216A5F7
SHA256:712DA0F71E50142E5969D9F454B43E549B81691758040A78DA53856ABACF6433
6512WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE081.tmp.WERInternalMetadata.xmlxml
MD5:8AA3CBA31AC5E094F302F17E23C71C3A
SHA256:DB55EED98FC430BFB9EB87184C3FBB4F08D4DD20742BF8240075CC8D393BFA4C
6512WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:E917FF8FF7B528849A7BD2841DF0076D
SHA256:61CC395FEBD21A0E6D77EE152D4979BFDDE372178123674C4F47D46335291A37
6512WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:680B0331A3CC8FCCE16367586EC7A721
SHA256:19F1B5D2C7F62663C14D97578411DC610E5F33E6CE4165977314442435F15305
6512WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:FA6E44A7895520E53321398E1F27918F
SHA256:79F661AD17B645EC5584BED25B2F892E5926B9F94FED5A0121D571E52ED6B228
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
33
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6512
WerFault.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6512
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6244
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6360
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6360
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.23.227.208:443
—
Ooredoo Q.S.C.
QA
unknown
5064
SearchApp.exe
2.23.227.208:443
—
Ooredoo Q.S.C.
QA
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
1176
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.69
  • 40.126.31.71
  • 40.126.31.67
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.21
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
viewer.exe