File scan report
Verdict Safe
Is nw.
This widely distributed NW.js runtime executable, first seen on May 15, 2021, is flagged by none of the 71 antivirus engines that checked it and showed a clean combined sandbox…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This file can be kept if it came with an application you trust; download such apps only from their original source and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged this file, and it has been submitted by thousands of independent sources since May 15, 2021. The sandbox runs produced a clean combined verdict, and the only injection recorded targeted the program's own process, which is normal for Chromium-based app runtimes.
All 18 major antivirus engines and every other reporting engine returned no detection. The file is very common, with 3,650 distinct submitters over more than five years, which is typical of a legitimate runtime component shipped with many applications. The combined sandbox verdict was clean, and the recorded injection only involved the sample's own process rather than a separate system or user process. All 39 contacted hosts were checked against our reputation cache with no malicious or suspicious results, and no external threat database lists the hash. The lack of a code signature is the main gap, but it does not outweigh this body of clean evidence.
What We Detected
None of the 71 antivirus engines that checked it flagged this 64-bit Windows executable, including all 18 major antivirus engines. It has been submitted by 3,650 distinct sources since it was first seen on May 15, 2021, and no public malware database or community rule set lists it. The file is not code-signed.
Threat Behavior
The combined sandbox verdict was clean. One of our behaviour rules noted code injection, but the only target was the program's own process, consistent with how multi-process Chromium-based runtimes such as NW.js operate. Network contacts went to Microsoft and Mozilla infrastructure, and all 39 checked hosts had no malicious or suspicious reputation. No persistence was recorded.
What To Do Now
No action is needed if this file came with an application you installed. As with any unsigned executable, keep it only if you obtained it from the application's original source, and keep your security software enabled.
Where this verdict could be wrong2 caveats
- The file is unsigned, so no publisher identity backs it.
- One of our behaviour rules recorded code injection, though the only target named is the program's own process, which multi-process Chromium-based runtimes routinely do.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- Submitted by 3,650 independent sources since May 15, 2021.
- The combined sandbox verdict was clean.
- All 39 contacted hosts checked had no malicious or suspicious reputation.
- No listing in public malware databases or malware-specific rule sets.
- The executable carries no digital signature identifying its publisher.
- The sandbox recorded the program injecting code into its own process, a pattern that also appears in malware but here names no outside target.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 21sandbox rule tags
- 4spawned processes
- 25network contacts
- 34filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
21MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1016· Network recon
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1112
- T1129· Loads modules
- T1140· Deobfuscation
- T1222
- T1497.001· Sandbox evasion
- T1543.003· Service install
- T1547.008· Auto-start
- T1562.001· Disables security
- T1574.002· Execution hijack
- T1614.001
Observed activity
Processes started
4Programs the file ran, with their command lines.
nw.exe%SAMPLEPATH%\nw.exe95594fb98d0e77575e1fde1602dfaa8c01cef66b0159db0e7bbe0a0a6f76573b.exe%SAMPLEPATH%\95594fb98d0e77575e1fde1602dfaa8c01cef66b0159db0e7bbe0a0a6f76573b.exesoftware.exe"C:\Users\user\Desktop\software.exe"file.exe"C:\Users\user\Desktop\file.exe"
Code injected into
2Other programs the file wrote its code into while it ran.
%SAMPLEPATH%\nw.exe%SAMPLEPATH%\95594fb98d0e77575e1fde1602dfaa8c01cef66b0159db0e7bbe0a0a6f76573b.exe
Network contacts
2525 hosts, listed as 5 domains, 20 addresses. Links show the host and path only.
- Domain
prod-azurecdn-akamai-iris.azureedge.net - Domain
msftstore.s.llnwi.net - Domain
prod.ingestion-edge.prod.dataops.mozgcp.net - Domain
prda.aadg.msidentity.com - Domain
telemetry-incoming.r53-2.services.mozilla.com - IP address
23.59.190.203
Show all 25 entries for network contacts
- IP address
72.21.81.240 - IP address
23.215.176.152 - IP address
23.40.197.137 - IP address
168.62.242.76 - IP address
13.107.39.203 - IP address
23.40.197.184 - IP address
20.22.113.133 - IP address
104.86.182.8 - IP address
23.53.122.133 - IP address
104.98.118.163 - IP address
23.64.191.115 - IP address
23.53.122.135 - IP address
104.112.185.183 - IP address
23.195.231.244 - IP address
23.62.209.152 - IP address
23.6.103.183 - IP address
23.215.176.139 - IP address
23.64.157.53 - IP address
23.62.210.8
Files
24Files the file created, changed or deleted.
- Written
C:\Windows\Temp\HighPerformancePlan.log - Written
C:\Windows\Temp\PowerPlan.log - Written
C:\Windows\Temp\ipconfig.out - Written
C:\Windows\system32\config\systemprofile\AppData\Local\PeerDistRepub - Written
\Device\ConDrv\\Connect - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER81DB.tmp
Show all 24 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER81DB.tmp.csv - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER84CA.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER84CA.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE98.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF92.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFE1.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE05.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE16.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE17.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D85.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E22.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E61.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER22D6.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER22E6.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER22E7.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDF7.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEB3.tmp.csv
Registry and auto-start
20Settings the file changed, including ways to start again after a restart.
- Set
HKLM\Software\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading - Set
HKLM\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces - Set
HKLM\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup\BITS_LOG - Set
HKLM\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup\BITS_BAK - Set
HKLM\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance\Performance Refresh - Set
HKLM\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance\Performance Refreshed
Show all 20 entries for registry and auto-start
- Set
HKLM\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance\Performance Data - Set
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last Counter - Set
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last Help - Set
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Updating - Set
HKLM\Software\Microsoft\WBEM\WDM\DREDGE\%windir%\system32\DRIVERS\en-US\intelppm.sys.mui[PROCESSORWMI] - Set
HKLM\Software\Microsoft\WBEM\WDM\DREDGE\%windir%\system32\DRIVERS\HDAudBus.sys[HDAudioMofName] - Set
HKLM\Software\Microsoft\WBEM\WDM\DREDGE\%windir%\System32\Drivers\en-US\portcls.SYS.mui[PortclsMof] - Set
HKLM\Software\Microsoft\WBEM\WDM\DREDGE\%windir%\system32\advapi32.dll[MofResourceName] - Set
HKLM\Software\Microsoft\WBEM\WDM\DREDGE\%windir%\system32\en-US\advapi32.dll.mui[MofResourceName] - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
\BaseNamedObjects\Local\SM0:6964:304:WilStaging_02\BaseNamedObjects\Local\SM0:6964:120:WilError_01\BaseNamedObjects\Local\SM0:7140:304:WilStaging_02\BaseNamedObjects\Local\SM0:7140:120:WilError_01\BaseNamedObjects\Local\SM0:3904:304:WilStaging_02\BaseNamedObjects\Global\RasPbFile
Show all 10 entries for mutexes
\BaseNamedObjects\Local\SM0:6700:304:WilStaging_02\BaseNamedObjects\Local\SM0:6700:120:WilError_01\BaseNamedObjects\Local\SM0:6256:304:WilStaging_02\BaseNamedObjects\Local\SM0:6256:120:WilError_01
Sandbox background — not the file
30The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
updater.exeC:\Program Files (x86)\Google2176_2015795585\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google912_1388751930\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google840_728367056\bin\updater.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3776_1203542394\bin\updater.exe
Show all 30 entries for sandbox background — not the file
- VM process
updater.exeC:\Program Files\Google3720_193711853\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2396_1799084741\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3140_280199935\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2896_222831879\bin\updater.exe - VM process
updater.exeC:\Program Files\Google348_244108023\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files (x86)\Google2176_2015795585\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google912_1388751930\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google840_728367056\bin\updater.exe - VM injection target
C:\Program Files\Google3776_1203542394\bin\updater.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
245.50.188.52.in-addr.arpa - VM host
fp2E7A.wpc.2BE4.phicdn.net - VM host
254.55.238.8.in-addr.arpa - VM host
59.28.101.95.in-addr.arpa - VM host
161.19.199.152.in-addr.arpa - VM host
0.204.248.87.in-addr.arpa - VM host
33.28.101.95.in-addr.arpa - VM host
183.209.82.20.in-addr.arpa - VM host
fp2e7a.wpc.phicdn.net - VM host
240.221.184.93.in-addr.arpa - VM host
assets.msn.com
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- ec5526b24e9bd32e2d03…9e6167Not checkedno saved verdict
- 5a08cd9ba3d16f45368f…77526aNot checkedno saved verdict
- accf036232d2570796bf…f36af8Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 24, 2026, 10:11 PM UTC
- SHA-256
95594fb98d0e77575e1fde1602dfaa8c01cef66b0159db0e7bbe0a0a6f76573b- SHA-1
a2df0c4dc933b3dbc746f41864907a6a22977384- MD5
5721d83bd9e88c5be3a08fc206e0a39d
About this file
nw.exe says it is nwjs, 2.2 MB.
- Claims to be
- nwjsFrom the file's own version information, written by whoever built it.
- Original name
- nw.exeMatches the shared file name.
- Type and size
- Win32 EXE · 2.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- May 15, 2021On VirusTotal.
- Submitted by
- 3,650 distinct sources
- Packer
- None detected
- Entropy
- 6.20 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The sandbox recorded code injection into the process quoted below (MITRE T1055). Injecting into another process is a common way to hide malicious code inside a legitimate one.
Evidence%SAMPLEPATH%\nw.exe
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is nw.exe safe?
What is nw.exe?
How many antivirus engines detected nw.exe?
What is the SHA-256 hash of nw.exe?
Is it safe to run nw.exe?
How up to date is this analysis of nw.exe?
Community
Member reviews and reports for this exact file hash.