File name:

iview472_x64_setup.zip

Full analysis: https://app.any.run/tasks/038a35f7-6b2f-466c-9160-5783d0730b61
Verdict: Malicious activity
Analysis date: August 01, 2025, 02:43:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
arch-html
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

2B78EADDF07A54BEB2B23F4FBFF99E36

SHA1:

AFDA120A205D57DF2EF60B9ACB4EFE64702E1F57

SHA256:

9BC13A6E0CAC3673D8469DBCD604A8AA77AD6A7A1E24D614B7A202169A26C051

SSDEEP:

98304:ttRgo5+ckdla7vkkozjO7SbPPgDR9PjBHNImMKK8RgHbYs/ZuB36ykExebsDjApF:rZdu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6340)

    • Changes the autorun value in the registry

      • iview472_x64_setup.exe (PID: 5564)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)
      • MSASCui.exe (PID: 5124)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6340)
      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)

    • Starts a Microsoft application from unusual location

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

    • Executable content was dropped or overwritten

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

    • There is functionality for taking screenshot (YARA)

      • iview472_x64_setup.exe (PID: 5032)

    • Creates a software uninstall entry

      • iview472_x64_setup.exe (PID: 5032)

    • The process creates files with name similar to system file names

      • iview472_x64_setup.exe (PID: 5032)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6340)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6340)
      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)

    • Reads the computer name

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • taskeng.exe (PID: 2432)

    • Checks supported languages

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • wuauclt.exe (PID: 5352)
      • MSASCui.exe (PID: 5124)
      • VGAuthService.exe (PID: 6584)
      • taskeng.exe (PID: 2432)

    • Manual execution by a user

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)

    • Create files in a temporary directory

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)
      • iview472_x64_setup.exe (PID: 5032)
      • MSASCui.exe (PID: 5124)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)

    • IrfanView executable

      • iview472_x64_setup.exe (PID: 2188)
      • iview472_x64_setup.exe (PID: 5564)

    • Launching a file from a Registry key

      • iview472_x64_setup.exe (PID: 5564)
      • wuauclt.exe (PID: 5352)
      • VGAuthService.exe (PID: 6584)
      • MSASCui.exe (PID: 5124)

    • Creates files in the program directory

      • iview472_x64_setup.exe (PID: 5032)

    • Reads Environment values

      • iview472_x64_setup.exe (PID: 5032)

    • Reads product name

      • iview472_x64_setup.exe (PID: 5032)

    • Reads the machine GUID from the registry

      • taskeng.exe (PID: 2432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:08:01 12:40:34
ZipCRC: 0x5f239068
ZipCompressedSize: 4428881
ZipUncompressedSize: 4472320
ZipFileName: iview472_x64_setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
10
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe iview472_x64_setup.exe iview472_x64_setup.exe no specs iview472_x64_setup.exe iview472_x64_setup.exe slui.exe no specs msascui.exe wuauclt.exe vgauthservice.exe taskeng.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2188"C:\Users\admin\Desktop\iview472_x64_setup.exe" C:\Users\admin\Desktop\iview472_x64_setup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
2147943140
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\desktop\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2432C:\Users\admin\AppData\Local\Temp\IXP003.TMP\taskeng.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\taskeng.exe—VGAuthService.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4520C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5032C:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exe
iview472_x64_setup.exe
User:
admin
Company:
Irfan Skiljan
Integrity Level:
HIGH
Description:
IrfanView 64-bit Installer
Exit code:
0
Version:
4.72.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5124C:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSASCui.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSASCui.exe
iview472_x64_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\msascui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5352C:\Users\admin\AppData\Local\Temp\IXP001.TMP\wuauclt.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\wuauclt.exe
MSASCui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\wuauclt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5564"C:\Users\admin\Desktop\iview472_x64_setup.exe" C:\Users\admin\Desktop\iview472_x64_setup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\desktop\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6340"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\iview472_x64_setup.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6508C:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\iview472_x64_setup.exe—iview472_x64_setup.exe
User:
admin
Company:
Irfan Skiljan
Integrity Level:
MEDIUM
Description:
IrfanView 64-bit Installer
Exit code:
3221226540
Version:
4.72.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\iview472_x64_setup.exe
c:\windows\system32\ntdll.dll
6584C:\Users\admin\AppData\Local\Temp\IXP002.TMP\VGAuthService.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\VGAuthService.exe
wuauclt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
6.0.6001.18000 (longhorn_rtm.080118-1840)
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\vgauthservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
4 147
Read events
4 025
Write events
122
Delete events
0

Modification events

(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\iview472_x64_setup.zip
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
24
Suspicious files
1
Text files
22
Unknown types
12

Dropped files

PID
Process
Filename
Type
5032iview472_x64_setup.exeC:\Users\admin\AppData\Local\Temp\iview_x64.zipcompressed
MD5:DD3758B03FAFC579B30C414F81022D5D
SHA256:6AB7B71E137D3A7AECC79C52DE47DB319556EB7597D264D892EB6B5C4AC0508A
5032iview472_x64_setup.exeC:\Program Files\IrfanView\Plugins\Slideshow.exeexecutable
MD5:7A0C00320760F09A172ACA44451DB76B
SHA256:CCED90019780DC6B9B24D1FAAD8455581F560C647B88F1C834C7E59C2D93E701
5032iview472_x64_setup.exeC:\Program Files\IrfanView\i_languages.txttext
MD5:97AB52F18CC61F0867445520F02C48DE
SHA256:1582F3F3EB1996F65110E6CE2B36417D1733699CF804EB41E1980D0900D5DB27
5032iview472_x64_setup.exeC:\Program Files\IrfanView\Plugins\Video.dllexecutable
MD5:BAF102263743085A16A714C9091FEC5C
SHA256:409461D271D23BD6BCE09020A45A55FF5DF42E14D57225AD25BFD31222FFDAB1
5032iview472_x64_setup.exeC:\Program Files\IrfanView\Plugins\Icons.dllexecutable
MD5:39D9B94B71C432859EAD3513E82E9DE4
SHA256:4A2EAE12A9C53B74A2E1833A090E8572150AD2E46A01554280D23A75C84D2E01
5032iview472_x64_setup.exeC:\Program Files\IrfanView\i_changes.txttext
MD5:5E3BBB34A844219EA767AE8A267EBF95
SHA256:1B48801C559F1101EAA0CBDD11F70A255592766EEE1098E2B5F8380AC6FCD06B
6340WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1486\iview472_x64_setup.exeexecutable
MD5:E33F2C9B8AF58C614F4A1E1E2EF356D4
SHA256:48A6D7357C7F656C4FF63CB226AB1C2B3CB8B63C5927637742A94E7ECD038F6A
5032iview472_x64_setup.exeC:\Program Files\IrfanView\iv_uninstall.exeexecutable
MD5:92D2C69FE445E4F7DB1FA19CCFE4525B
SHA256:7BCB4C03A98BAF59643BA3E4C46900551A3AF6A91282F0E7A6D4AAAFF7AC1BF6
5032iview472_x64_setup.exeC:\Program Files\IrfanView\Html\thumbnails.htmlhtml
MD5:1AC8A9A77F1A5C674463F925431D14BD
SHA256:CCA0218B31DACEA39F1A73C7504E4DB720A8038A275DAE552BF29A807FA8877D
5032iview472_x64_setup.exeC:\Program Files\IrfanView\Html\frame.htmlhtml
MD5:E5AF395AE5F829D29357701872C9C731
SHA256:E4D580FAAF8FDEAF507BCB0948887611271702732236F2E9321FBC647C7A9498
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6956
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
512
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
512
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5372
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6956
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6956
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.130
  • 20.190.159.75
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.129
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
self.events.data.microsoft.com
  • 20.42.73.24
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
iview472_x64_setup.zip