File scan report
Verdict Safe
Is setup.
Only Webroot flagged this established installer as repack riskware, while major antivirus engines remained silent and its completed sandbox run produced no malicious verdict.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Unsigned
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Webroot was the sole detector among 75 engines, using a generic repack-riskware label; no major antivirus engines flagged the file. Its broad, long-standing prevalence and clean sandbox verdict outweigh that detection, although the unsigned origin, shellcode-rule match, and reported process injection warrant obtaining it from a trusted source.
Only 1 of the 66 antivirus engines that checked it flagged the executable, and that detection came from less reliable Webroot as generic repack riskware; no major antivirus engines identified malware. The file has circulated among 502 submitters over more than two years, reducing concern that it is a newly introduced payload. One completed sandbox run returned clean, with no persistence recorded and no malicious cached host among all 19 observed contacts, though and reported injection targets remain noteworthy. Five community YARA rules matched, but only the shellcode rule was specific, while the other four describe generic compiler, TLS, or obfuscation traits. The executable is unsigned, and its similar-file history is mixed, but those comparisons are import-table fingerprint-only framework matches without signer corroboration. Overall, the isolated generic detection is more consistent with a repacked-installer false positive than an established malware family.
What We Detected
Webroot was the only engine among 75 to flag the file, labeling it W32.Riskware.Repack. No major antivirus engines reported malware, and there was no family consensus. The executable is unsigned, so its publisher cannot be authenticated.
Threat Behavior
One completed sandbox run returned clean and recorded no persistence. It nevertheless mapped T1134 and listed injection targets including WMIADAP.EXE and several updater processes, which deserves caution. All 19 observed contacts received complete reputation coverage with no malicious or suspicious cached result; several listed contacts were analysis-system background traffic and were not attributed to the sample. Ten dropped files have no saved verdict, so they provide no assurance either way.
Additional Context
The file has 502 submitters and 532 submissions dating from April 2024, indicating established circulation. Code sections did not show high entropy or likely packing. Five community YARA rules matched, but four were generic and only the shellcode-pattern rule was specific. Similar-file results were based solely on a shared import-table fingerprint without a matching signer, making them weak because installers built with the same framework may share that fingerprint.
What To Do Now
Use the installer only if it came directly from the expected publisher or another trusted distribution channel. Keep security software enabled, verify the download hash where the publisher provides one, and avoid proceeding if the source or intended product is unclear.
Where this verdict could be wrong4 caveats
- The executable is unsigned, so there is no publisher identity or signer history to corroborate its origin.
- A shellcode-specific YARA rule matched, and data from the test run mapped while listing injection into WMIADAP.EXE and updater processes.
- Four files built with the same import table were previously treated cautiously and one was associated with Pomal, though these were matches on the import table alone without a matching signer.
- All ten dropped files lack saved verdicts, so their safety remains unverified even though none is recorded as malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 66 antivirus engines that checked it flagged the file, using a generic repack-riskware label.
- No major antivirus engines reported malware.
- A completed sandbox run returned clean and recorded no persistence.
- The file has broad, established circulation across 502 submitters and 532 submissions.
- No high-entropy code or likely packing was identified, and complete reputation coverage found no harmful observed host.
- The executable is unsigned, preventing publisher verification.
- A shellcode-pattern YARA rule matched the file.
- Data from the test run mapped token manipulation and reported injection into system or updater processes.
- Ten dropped components have no saved security verdict.
- Similar installer fingerprints have previously received cautious or harmful assessments, although those fingerprint matches are weak.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 14spawned processes
- 2network contacts
- 37filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1056· Keylogging
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1134
- T1529
- T1614
- T1614.001
Observed activity
Processes started
14Programs the file ran, with their command lines.
setup.exe"C:\Users\<USER>\AppData\Local\Temp\setup.exe"setup.tmp"C:\Users\<USER>\AppData\Local\Temp\is-78KF1.tmp\setup.tmp" /SL5="$20190,2475036,346112,C:\Users\<USER>\AppData\Local\Temp\setup.exe"setup.exe%SAMPLEPATH%\setup.exesetup.tmp%USERPROFILE%\AppData\Local\Temp\is-6K0DQ.tmp\setup.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.exe%SAMPLEPATH%\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.exe0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-EIEHK.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp
Show all 14 entries for processes started
0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-NCFIQ.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-OSK7D.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-AS2SB.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-APDNL.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-FHPF5.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-U64B4.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-O53KF.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp%USERPROFILE%\AppData\Local\Temp\is-NVGDH.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
23.6.103.183 - IP address
23.59.198.43
Files
30Files the file created, changed or deleted.
- Written
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is-AKQAO.tmp\0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345.tmp - Written
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is-6BNO8.tmp\_isetup\_shfoldr.dll - Written
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is-6BNO8.tmp\ISDone.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-QATOO.tmp\setup.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-KNTG6.tmp\_isetup\_setup64.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-KNTG6.tmp\_isetup\_shfoldr.dll
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\is-KNTG6.tmp\ISDone.dll - Written
C:\Program Files (x86)\TI - Written
C:\Program Files (x86)\TI\is-DK98F.tmp - Written
C:\Program Files (x86)\TI\is-JUU7V.tmp - Written
C:\Program Files (x86)\Unreal Lust Theory - Written
C:\Program Files (x86)\Unreal Lust Theory\is-QP39Q.tmp - Written
C:\Program Files (x86)\Unreal Lust Theory\unins000.dat - Written
C:\Users\Public\Desktop\??????? ??????.lnk - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1846.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1856.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1911.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1951.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1921.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1952.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER412.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER55B.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER599.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AA.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AB.tmp.txt - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Registry and auto-start
13Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Owner - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\SessionHash - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence
Show all 13 entries for registry and auto-start
- Set
Software\Microsoft\RestartManager\Session0000\Owner - Set
Software\Microsoft\RestartManager\Session0000\SessionHash - Set
Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers - Set
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Unreal Lust Theory_is1
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
Local\SM0:5712:168:WilStaging_02Local\SM0:5684:168:WilStaging_02Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000Local\SM0:5684:64:WilError_03\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Show all 7 entries for mutexes
\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Sandbox background — not the file
27The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google3836_738328742\bin\updater.exe - VM injection target
C:\Program Files\Google3864_1095839493\bin\updater.exe - VM injection target
C:\Program Files\Google8_469257481\bin\updater.exe - VM host
15.164.165.52.in-addr.arpa
Show all 27 entries for sandbox background — not the file
- VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
162.159.36.2 - VM host
a83f:8110:6d00:6500:6e00:7400:6300:6f00 - VM host
20.99.133.109 - VM host
192.229.211.108 - VM host
a83f:8110:100:0:9843:7e1d:82de:ffff - VM host
a83f:8110:0:0:beac:bf78:cce1:d301 - VM host
20.99.186.246 - VM host
131.253.33.203 - VM host
192.168.0.7 - VM host
23.213.37.172 - VM host
192.168.0.18 - VM host
184.25.191.235 - VM host
23.216.81.152 - VM host
20.99.185.48 - VM host
192.168.0.22 - VM host
52.185.73.156 - VM host
192.168.0.11 - VM host
a83f:8110:0:0:100:0:1800:0
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- ec9a6bb8ed490b4bd08b…16010dNot checkedno saved verdict
- 450b9b0ba25bf068afbc…fd0105Not checkedno saved verdict
- 75fb2984e1b06f4278fb…bc76bfNot checkedno saved verdict
- 9884e9d1b4f8a873ccbd…360d87Not checkedno saved verdict
- 68f42a7823ed7ee88a5c…aa172dNot checkedno saved verdict
- c3729545522fcff70db6…c872b2Not checkedno saved verdict
- bb8a0245dcc5c10a1c71…38ac71Not checkedno saved verdict
- a4c86fc4836ac728d7bd…95fd81Not checkedno saved verdict
- 3761a0b75c68bca3c1d8…76e42dNot checkedno saved verdict
- f93a64e002b04890b9f4…0670beNot checkedno saved verdict
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- WebrootW32.Riskware.Repack
File fingerprint
- Last analyzed
- Oct 12, 2026, 11:16 PM UTC
- SHA-256
0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345- SHA-1
494d82b46b026c99463d27bb816e1ea7689cf524- MD5
34abf59642d25fb2636cd7155beddf44
About this file
setup.exe is a Win32 EXE file of 3.1 MB.
- Type and size
- Win32 EXE · 3.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 14, 2024On VirusTotal.
- Submitted by
- 502 distinct sources
- Packer
- None detected
- Entropy
- 7.03 of 8
First scanned
Antivirus consensus
1 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-115 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- WebrootMalicious: W32.Riskware.Repack
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- shellcodegeneric
- Borlandgeneric
- HUNTING_SUSP_TLS_SECTIONgeneric
- pe_detect_tls_callbacksgeneric
- Sus_Obf_Enc_Spoof_Hide_PEgeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe?
What is setup.exe?
How many antivirus engines detected setup.exe?
What is the SHA-256 hash of setup.exe?
Is it safe to install setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.