File name:

iview472_x64_setup.zip

Full analysis: https://app.any.run/tasks/038a35f7-6b2f-466c-9160-5783d0730b61
Verdict: Malicious activity
Analysis date: August 01, 2025, 02:43:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
arch-html
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

2B78EADDF07A54BEB2B23F4FBFF99E36

SHA1:

AFDA120A205D57DF2EF60B9ACB4EFE64702E1F57

SHA256:

9BC13A6E0CAC3673D8469DBCD604A8AA77AD6A7A1E24D614B7A202169A26C051

SSDEEP:

98304:ttRgo5+ckdla7vkkozjO7SbPPgDR9PjBHNImMKK8RgHbYs/ZuB36ykExebsDjApF:rZdu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6340)

    • Changes the autorun value in the registry

      • iview472_x64_setup.exe (PID: 5564)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

    • Executable content was dropped or overwritten

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

    • Process drops legitimate windows executable

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • MSASCui.exe (PID: 5124)
      • WinRAR.exe (PID: 6340)
      • wuauclt.exe (PID: 5352)

    • There is functionality for taking screenshot (YARA)

      • iview472_x64_setup.exe (PID: 5032)

    • The process creates files with name similar to system file names

      • iview472_x64_setup.exe (PID: 5032)

    • Creates a software uninstall entry

      • iview472_x64_setup.exe (PID: 5032)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6340)

    • Checks supported languages

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)
      • taskeng.exe (PID: 2432)
      • MSASCui.exe (PID: 5124)

    • The sample compiled with english language support

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • wuauclt.exe (PID: 5352)
      • MSASCui.exe (PID: 5124)
      • WinRAR.exe (PID: 6340)

    • IrfanView executable

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)

    • Create files in a temporary directory

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

    • Manual execution by a user

      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 2188)

    • Reads the computer name

      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • iview472_x64_setup.exe (PID: 2188)
      • taskeng.exe (PID: 2432)

    • Launching a file from a Registry key

      • iview472_x64_setup.exe (PID: 5564)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

    • Creates files in the program directory

      • iview472_x64_setup.exe (PID: 5032)

    • Reads product name

      • iview472_x64_setup.exe (PID: 5032)

    • Reads Environment values

      • iview472_x64_setup.exe (PID: 5032)

    • Reads the machine GUID from the registry

      • taskeng.exe (PID: 2432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:08:01 12:40:34
ZipCRC: 0x5f239068
ZipCompressedSize: 4428881
ZipUncompressedSize: 4472320
ZipFileName: iview472_x64_setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
10
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe iview472_x64_setup.exe iview472_x64_setup.exe no specs iview472_x64_setup.exe iview472_x64_setup.exe slui.exe no specs msascui.exe wuauclt.exe vgauthservice.exe taskeng.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2188"C:\Users\admin\Desktop\iview472_x64_setup.exe" C:\Users\admin\Desktop\iview472_x64_setup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
2147943140
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\desktop\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2432C:\Users\admin\AppData\Local\Temp\IXP003.TMP\taskeng.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\taskeng.exe—VGAuthService.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4520C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5032C:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exe
iview472_x64_setup.exe
User:
admin
Company:
Irfan Skiljan
Integrity Level:
HIGH
Description:
IrfanView 64-bit Installer
Exit code:
0
Version:
4.72.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5124C:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSASCui.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSASCui.exe
iview472_x64_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\msascui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5352C:\Users\admin\AppData\Local\Temp\IXP001.TMP\wuauclt.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\wuauclt.exe
MSASCui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\wuauclt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5564"C:\Users\admin\Desktop\iview472_x64_setup.exe" C:\Users\admin\Desktop\iview472_x64_setup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\desktop\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6340"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\iview472_x64_setup.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6508C:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exe—iview472_x64_setup.exe
User:
admin
Company:
Irfan Skiljan
Integrity Level:
MEDIUM
Description:
IrfanView 64-bit Installer
Exit code:
3221226540
Version:
4.72.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
6584C:\Users\admin\AppData\Local\Temp\IXP002.TMP\VGAuthService.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\VGAuthService.exe
wuauclt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\vgauthservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
4 147
Read events
4 025
Write events
122
Delete events
0

Modification events

(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\iview472_x64_setup.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
24
Suspicious files
1
Text files
22
Unknown types
12

Dropped files

PID
Process
Filename
Type
6340WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1486\iview472_x64_setup.exeexecutable
MD5:E33F2C9B8AF58C614F4A1E1E2EF356D4
SHA256:48A6D7357C7F656C4FF63CB226AB1C2B3CB8B63C5927637742A94E7ECD038F6A
5032iview472_x64_setup.exeC:\Users\admin\AppData\Local\Temp\iview_x64.zipcompressed
MD5:DD3758B03FAFC579B30C414F81022D5D
SHA256:6AB7B71E137D3A7AECC79C52DE47DB319556EB7597D264D892EB6B5C4AC0508A
5032iview472_x64_setup.exeC:\Program Files\IrfanView\Plugins\Slideshow.exeexecutable
MD5:7A0C00320760F09A172ACA44451DB76B
SHA256:CCED90019780DC6B9B24D1FAAD8455581F560C647B88F1C834C7E59C2D93E701
5032iview472_x64_setup.exeC:\Program Files\IrfanView\i_about.txttext
MD5:978342921F6F81C0C5B4E81FC7F33478
SHA256:7BD56C8AF3CA4831D0B1A421A961A4769F70D630FADBCC391BB5C2068EE02490
5032iview472_x64_setup.exeC:\Program Files\IrfanView\i_changes.txttext
MD5:5E3BBB34A844219EA767AE8A267EBF95
SHA256:1B48801C559F1101EAA0CBDD11F70A255592766EEE1098E2B5F8380AC6FCD06B
5564iview472_x64_setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSASCui.exeexecutable
MD5:BFEF2BE3BE5C0316243CAF610FDB0A67
SHA256:4A6E578A0226DEEA8AA797EB20FB27BF02F5E0EDB3FFC13F7C2D4FBE1BE47535
5032iview472_x64_setup.exeC:\Program Files\IrfanView\i_plugins.txttext
MD5:04EBFE4C4ECEFB2A43F8C841C4E7C205
SHA256:2ED0956055B48246F525D042993D960947ED7FB4D437C852DD0A5D3444CE78B6
5032iview472_x64_setup.exeC:\Program Files\IrfanView\i_options.txttext
MD5:0A536A50ADFA64FF85FB376544BBB976
SHA256:145419DA895183DEAC8CCC1C089288F1FDD09282A26164BDCB919EC8170FAAA0
5032iview472_x64_setup.exeC:\Program Files\IrfanView\Plugins\Effects.dllexecutable
MD5:5708224A335E8BC04B281D03A8700D53
SHA256:CFA3670E36731FFACF1870F68D85C019B2E5CDE0AFC6B039AFAA1FEB1DF027DB
5032iview472_x64_setup.exeC:\Program Files\IrfanView\iv_uninstall.exeexecutable
MD5:92D2C69FE445E4F7DB1FA19CCFE4525B
SHA256:7BCB4C03A98BAF59643BA3E4C46900551A3AF6A91282F0E7A6D4AAAFF7AC1BF6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6956
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
512
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
512
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5372
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6956
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6956
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.130
  • 20.190.159.75
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.129
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
self.events.data.microsoft.com
  • 20.42.73.24
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
iview472_x64_setup.zip