File scan report
Verdict Safe
Is Beholder.
Only Jiangmin flagged this widely submitted executable, while major antivirus engines, observations from the test run, host checks, and threat-intelligence sources supplied no…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The isolated detection can reasonably be treated as a false positive. Keep security protection enabled and use a copy obtained from the expected source with a matching SHA-256 hash.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 9y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone Jiangmin detection is most consistent with a false positive. None of the other 74 engines flagged the file, the test run produced no malicious verdict or high-risk technique, and all 21 inspected hosts lacked malicious or suspicious classifications.
Only 1 of the 71 antivirus engines that checked it flagged the executable, and that result came from Jiangmin; all reporting major antivirus engines were clean. The file has substantial history, with 571 sources and 713 submissions since it was first seen on Nov 9, 2016. Eight completed observations from the test run supplied no malicious verdict, named injection target, or high-risk technique. The complete host cross-check inspected 21 contacts and found no malicious or suspicious classifications, while three external intelligence checks returned no hits. Although the executable is unsigned and one behaviour rule noted direct-IP traffic, neither point corroborates the lone detection.
What We Detected
Jiangmin was the only engine to flag the executable, using the label Backdoor.MSIL.fdwk. None of the other 74 engines flagged it, including every reporting major antivirus engine. The file has also accumulated 713 submissions from 571 sources since it was first seen on Nov 9, 2016.
Threat Behavior
Eight completed observations from the test run produced no malicious verdict, named process-injection target, persistence indicator, dropped file, or high-risk technique. One behaviour rule noted direct-IP traffic, but the complete reputation check of 21 contacted hosts found no malicious or suspicious classifications. Three external intelligence checks also supplied no matching threat entry.
What To Do Now
The evidence strongly indicates that Jiangmin's isolated alert is a false positive. Keep security software enabled, obtain the executable from its expected source, and verify its hash before running it if provenance remains uncertain.
Where this verdict could be wrong3 caveats
- Jiangmin labels the file Backdoor.MSIL.fdwk, although no other engine or evidence from the test run corroborates that label.
- The executable is unsigned, so its publisher cannot be authenticated.
- One behaviour rule noted direct-IP traffic, but the inspected host set contained no malicious or suspicious hosts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 71 antivirus engines that checked it flagged the file, and every reporting major antivirus engine was clean.
- Eight completed observations from the test run produced no malicious verdict or high-risk technique.
- All 21 inspected contacted hosts had neither malicious nor suspicious classifications.
- No matching entry appeared in the three checked external threat-intelligence sources.
- The file has 713 submissions from 571 sources and was first seen on Nov 9, 2016.
- The executable has no digital signature, so its publisher cannot be authenticated.
- Jiangmin labels it Backdoor.MSIL.fdwk.
- One behaviour rule noted direct-IP traffic during analysis.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 8 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 8isolated sandbox runs
- 6sandbox rule tags
- 2spawned processes
- 8network contacts
- 25filesystem & mutex artifacts
What this file did when executed
This file was detonated in 8 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1056· Keylogging
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1518.001· Checks your AV
- T1560
Observed activity
Processes started
2Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\AppData\Local\Temp\file.exe"734006303f1964a742ddef0fdd7905d19db91f275eb9ccb69e65db5c48153b8b.exe%SAMPLEPATH%\734006303f1964a742ddef0fdd7905d19db91f275eb9ccb69e65db5c48153b8b.exe
Network contacts
88 hosts, listed as 8 addresses. Links show the host and path only.
- IP address
23.55.185.172 - IP address
104.98.118.178 - IP address
23.32.75.20 - IP address
23.32.75.157 - IP address
23.215.176.113 - IP address
104.98.118.155
Show all 8 entries for network contacts
- IP address
23.46.228.49 - IP address
<MACHINE_DNS_SERVER>
Files
15Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CA.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DC.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER24A9.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2594.tmp.csv
Show all 15 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER25C4.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER36CB.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER36CC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER36DD.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER16DE.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER16DF.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER17A9.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER17AA.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER17EB.tmp.txt
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\Start - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\ImagePath - Set
\REGISTRY\MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name - Set
\REGISTRY\MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\ID
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\SM0:1516:168:WilStaging_02DDrawWindowListMutexDDrawDriverObjectListMutex__DDrawExclMode____DDrawCheckExclMode__CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Sandbox background — not the file
30The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google2952_32610382\bin\updater.exe - VM process
updater.exeC:\Program Files\Google1112_124122420\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2480_2084398880\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2548_1179880617\bin\updater.exe
Show all 30 entries for sandbox background — not the file
- VM process
updater.exeC:\Program Files\Google1376_1936935126\bin\updater.exe - VM process
updater.exeC:\Program Files\Google4028_1382330683\bin\updater.exe - VM process
updater.exeC:\Program Files\Google1468_797823253\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3744_1815474255\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google2952_32610382\bin\updater.exe - VM injection target
C:\Program Files\Google1112_124122420\bin\updater.exe - VM injection target
C:\Program Files\Google2480_2084398880\bin\updater.exe - VM injection target
C:\Program Files\Google2548_1179880617\bin\updater.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
20.99.132.105 - VM host
23.216.147.76 - VM host
20.99.133.109 - VM host
20.99.185.48 - VM host
192.229.211.108 - VM host
23.216.147.64 - VM host
20.99.186.246 - VM host
20.99.184.37 - VM host
192.168.0.1 - VM host
184.25.191.235 - VM host
192.168.0.76 - VM host
23.216.81.152
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- JiangminBackdoor.MSIL.fdwk
File fingerprint
- Last analyzed
- Oct 24, 2026, 8:31 PM UTC
- SHA-256
734006303f1964a742ddef0fdd7905d19db91f275eb9ccb69e65db5c48153b8b- SHA-1
c6dc3741c7fef673b02e3644dbaa04a90159f86a- MD5
1078e34456b405811a9d6bbb2587227c
About this file
Beholder.exe is a Win32 EXE file of 17.7 MB.
- Type and size
- Win32 EXE · 17.7 MB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 9, 2016On VirusTotal.
- Submitted by
- 571 distinct sources
- Packer
- None detected
- Entropy
- 6.53 of 8
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- JiangminMalicious: Backdoor.MSIL.fdwk
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence<MACHINE_DNS_SERVER>
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Beholder.exe safe?
What is Beholder.exe?
How many antivirus engines detected Beholder.exe?
What is the SHA-256 hash of Beholder.exe?
Is it safe to run Beholder.exe?
How up to date is this analysis of Beholder.exe?
Community
Member reviews and reports for this exact file hash.