File scan report
Verdict Safe
Is Burst.
Only 2 of the 71 antivirus engines that checked it flagged this older executable, both using less reliable generic rules, with no higher-trust, behavioral, or malware-specific…
Read the whole reasonShow less
Strong evidence · Listed in a database of known software.
Keep security protection enabled and use the file only if it came from a trusted source. Because it is unsigned, verify its SHA-256 hash and provenance before execution.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 71 flagged
- Flagged 2
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 10y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two detections come exclusively from less reliable engines and use generic rule labels; none of the 71 antivirus engines that checked it supplied a higher-trust malware detection. One completed sandbox run found no offensive techniques or malicious verdict, while the recorded Dr. Watson activity is consistent with legacy crash handling.
MaxSecure and Trapmine flagged the sample, but both detections are less reliable and generic rather than a shared named family. None of the 71 antivirus engines that checked it produced a detection from a major antivirus engine, which makes those isolated alerts likely false positives. The completed observation from the test run produced no malicious sandbox verdict, offensive technique, persistence indicator, or sample network contact. Its Dr. The executable is also unpacked, lacks high-entropy code, and has reference-database context, although its unsigned status limits publisher assurance. No complete contacted-host reputation check is available, so network reputation is not being treated as exonerating evidence.
What We Detected
Only 2 of the 71 antivirus engines that checked it raised alerts: MaxSecure used a generic trojan label, and Trapmine used a generic machine-learning score. Both are less reliable detections, while higher-trust engines such as Kaspersky, BitDefender, ESET, Fortinet, and Avast did not flag the file. No engine consensus identified a malware family.
Threat Behavior
One completed sandbox run produced no malicious verdict and mapped no offensive techniques. It recorded a legacy Dr. Watson crash-handler command, creation of a Dr. Watson log, and an association with dwwin.exe; in this context, those events do not establish hostile injection. No persistence indicator or sample network contact was observed. A complete contacted-host reputation cross-check was not available.
What To Do Now
The evidence supports treating the two alerts as false positives. Keep security software enabled, obtain the executable from its original trusted source when possible, and verify its hash before use because the file lacks a publisher signature.
Where this verdict could be wrong4 caveats
- MaxSecure and Trapmine issued generic malware or machine-learning detections, although no higher-trust engine corroborated them.
- The executable is unsigned, so publisher identity cannot be authenticated.
- The sandbox recorded dwwin.exe under processesInjected, but the surrounding Dr. Watson crash-handler activity and absence of offensive techniques substantially weaken that concern.
- No complete contacted-host reputation result is available, although the observed run recorded no sample network contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No higher-trust antivirus engine flagged the file.
- The completed sandbox run produced no malicious verdict or offensive technique.
- No persistence or sample network activity was observed during the run.
- The executable is not packed and does not contain high-entropy code.
- The hash appears in a reference-file database, providing weak supporting context.
- The executable is unsigned, preventing verification of its publisher.
- Two less reliable engines issued generic rule-based detections.
- The sandbox recorded an association with dwwin.exe, although surrounding evidence indicates legacy crash handling rather than confirmed hostile injection.
- A complete reputation check for contacted hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 1spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027.005· Obfuscated code
- T1033· Reads user info
- T1082· System recon
- T1083· Scans your files
- T1087
- T1129· Loads modules
- T1497.001· Sandbox evasion
Observed activity
Processes started
1Programs the file ran, with their command lines.
drwtsn32C:\WINDOWS\system32\drwtsn32 -p 984 -e 192 -g
Files
1Files the file created, changed or deleted.
- Written
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
ShimCacheMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM injection target
dwwin.exe
Chapter 04
Technical details
2 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 13, 2026, 1:45 AM UTC
- SHA-256
2894434828ed0ed414e3d7f4d79de0a42a7c36e1100d70af399b07a3f3e3e719- SHA-1
f00329c21e3ccce2e3712a8042c287e6521f8ed2- MD5
0f2426f96ab3f387232534e1dcc531de
About this file
Burst.EXE is a Win32 EXE file of 430.1 kB.
- Type and size
- Win32 EXE · 430.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 13, 2015On VirusTotal.
- Submitted by
- 7 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.62 of 8
First scanned
Antivirus consensus
2 of 71 engines flagged this file
5 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-238 engines0flagged
- Low-trust15 engines2flagged
View all 76 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- TrapmineMalicious: malicious.moderate.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CybereasonClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- McAfeeClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Burst.EXE safe?
What is Burst.EXE?
How many antivirus engines detected Burst.EXE?
What is the SHA-256 hash of Burst.EXE?
Is it safe to run Burst.EXE?
How up to date is this analysis of Burst.EXE?
Community
Member reviews and reports for this exact file hash.