File scan report
Verdict Safe
Is Window
Only 2 of the 71 antivirus engines that checked it raised generic rule-based detections, while long-term prevalence, major results, and observed behavior provide no corroborating…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The evidence supports treating the two generic detections as false positives. Keep security protection enabled and use a copy obtained from the original distribution source.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 71 flagged
- Flagged 2
- No detection 69
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 13y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two detections appear more likely to be false positives than evidence of a trojan. The file has circulated since Apr 30, 2013 across 299 submitters, no major antivirus engines flagged it, and the sandbox summary recorded no high-risk technique with supporting artefacts.
Two of the 71 antivirus engines that checked it flagged the executable, but both used generic rule labels and none of the major antivirus engines detected it. The file was first seen on Apr 30, 2013 and has been submitted by 299 distinct sources, providing a substantial history inconsistent with an unrecognized active threat. No malware-specific community rules, public sample-database listing, malicious child, persistence indicator, or named malware family corroborates the detections. The executable is unsigned and a complete host-reputation check was unavailable, but those limitations do not outweigh the strong false-positive pattern.
What We Detected
Two of the 71 antivirus engines that checked it flagged the executable. MaxSecure and VirIT used generic rule-based trojan labels, while none of the major antivirus engines detected it and no engine consensus identified a real malware family.
Threat Behavior
The combined sandbox summary contained mappings associated with process injection and security-control interference, but it recorded no injected target process or other supporting artefact. No persistence indicator or high-risk technique with corroboration was observed. A complete reputation result for all network contacts was not available.
Why the Detections Look Incorrect
The file was first seen on Apr 30, 2013 and has 299 distinct submitters across 318 submissions. No malware-specific rule, public sample-database entry, malicious file it created, or named family supports the two generic detections.
What To Do Now
Keep security software enabled. If the file came from an unexpected or unverified source, obtain a fresh copy from the original distribution channel before running it.
Where this verdict could be wrong3 caveats
- Two independent engines flagged the executable with generic trojan rules, so a false-positive interpretation is not certain.
- The executable is unsigned, leaving no verified publisher identity to support its provenance.
- A complete reputation check for all observed network contacts was not available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines flagged the file.
- The file was first seen on Apr 30, 2013 and has been submitted by 299 distinct sources.
- The sandbox summary recorded no corroborated high-risk technique or injected target process.
- No malware-specific rules, public sample-database listing, malicious child, or named malware family supported the detections.
- The executable does not appear packed or unusually high in code entropy.
- Two independent antivirus engines applied generic trojan rule labels.
- The executable has no verified digital signature.
- A complete reputation check for all observed network contacts was not available.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 2spawned processes
- 2network contacts
- 26filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1106
- T1562.001· Disables security
Observed activity
Processes started
2Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\Desktop\file.exe"c2d5d156ef4e5e09ed8811655df989d757b3e1ddd3c68d98ff66d24a292ac6c5.exe%SAMPLEPATH%\c2d5d156ef4e5e09ed8811655df989d757b3e1ddd3c68d98ff66d24a292ac6c5.exe
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
74.125.132.94 - IP address
23.40.197.184
Files
17Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\file.exe.log - Written
C:\Users\user\AppData\Roaming - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.1460.32552359 - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEA3.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFAD.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFEC.tmp.txt
Show all 17 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAA.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERABB.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERACB.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER17F7.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1930.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER196F.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A98.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AA9.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AD9.tmp.txt - Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE\KLT1I0ZU\update50[1].xml
Registry and auto-start
5Settings the file changed, including ways to start again after a restart.
- Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List
Mutexes
9Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 9 entries for mutexes
MSCTF.Shared.MUTEX.EBH\Sessions\1\BaseNamedObjects\Local\SM0:844:168:WilStaging_02\Sessions\1\BaseNamedObjects\Local\SM0:844:64:WilError_01
Sandbox background — not the file
19The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM host
a83f:8110:c85f:700:8875:700:c077:700 - VM host
192.168.0.134 - VM host
a83f:8110:106:0:0:5:5000:0 - VM host
a83f:8110:0:0:cc00:0:0:0 - VM host
20.62.24.77
Show all 19 entries for sandbox background — not the file
- VM host
23.216.147.76 - VM host
a83f:8110:ae01:0:d8ef:fcfe:ae01:0 - VM host
20.99.132.105 - VM host
a83f:8110:0:0:6784:21:0:0 - VM host
23.216.147.64 - VM host
a83f:8110:0:0:1400:1400:2800:3800 - VM host
a83f:8110:5f00:5f00:5f00:5f00:5f00:5f00 - VM host
a83f:8110:6c00:6c00:7900:2000:6c00:6f00 - VM host
20.99.184.37 - VM host
192.229.211.108 - VM host
20.99.186.246 - VM host
131.253.33.203 - VM host
192.168.0.75
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 9d7a8c7c5f3278daf8fb…37a6b5Not checkedno saved verdict
Chapter 04
Technical details
2 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- MaxSecureTrojan.Malware.300983.susgen
- VirITTrojan.Win32.MSIL_Heur.A
File fingerprint
- Last analyzed
- Jul 22, 2026, 2:37 PM UTC
- SHA-256
c2d5d156ef4e5e09ed8811655df989d757b3e1ddd3c68d98ff66d24a292ac6c5- SHA-1
731997a449d530ab5208ebb048def355c9bb0eba- MD5
42257edf7d67f3dc5fc4b98b3f274da9
About this file
WindowTitleChanger.exe is a Win32 EXE file of 13.3 kB.
- Type and size
- Win32 EXE · 13.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 30, 2013On VirusTotal.
- Submitted by
- 299 distinct sources
- Packer
- None detected
- Entropy
- 5.08 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
2 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines1flagged
- Low-trust17 engines1flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- VirITMalicious: Trojan.Win32.MSIL_Heur.A
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is WindowTitleChanger.exe safe?
What is WindowTitleChanger.exe?
How many antivirus engines detected WindowTitleChanger.exe?
What is the SHA-256 hash of WindowTitleChanger.exe?
Is it safe to run WindowTitleChanger.exe?
How up to date is this analysis of WindowTitleChanger.exe?
Community
Member reviews and reports for this exact file hash.