File scan report
Verdict Safe
Is Window
This unsigned WindowTop installer was flagged by none of the 66 antivirus engines that checked it.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This installer appears consistent with the WindowTop utility; obtain it from the official WindowTop website and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 9
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 66 antivirus engines that checked it flagged this WindowTop installer, which was first seen on Jun 28, 2026 and shared by 74 sources. In four sandbox runs it unpacked a standard setup program and checked whether WindowTop was already installed. It contacted only the product's own website, and none of the contacted hosts are known to be malicious.
None of the 66 antivirus engines that checked it flagged the file, and fifteen major antivirus engines returned clean results. The four sandbox runs show a typical setup flow: a temporary setup program and a PowerShell command that checks for an existing WindowTop package. The runs recorded no injection into other processes and no persistence. The only network contact was the product's own update feed, and our host reputation check found nothing malicious. The file is unsigned and carries a protector label, which is why one of our behaviour rules matched, but neither point is backed by any hostile observation.
What We Detected
None of the 66 antivirus engines that checked it flagged this installer. The file has been shared by 74 sources since it was first seen on Jun 28, 2026. It has no digital signature, and the antivirus analysis attributes a code protector to it.
Threat Behavior
In four sandbox runs the installer launched a temporary setup component and ran a PowerShell command. That command only checks whether a WindowTop app package is already installed. The installer contacted the WindowTop website's update feed. No injection into other processes, persistence or malicious sandbox verdict was recorded, and the contacted hosts have no malicious reputation in our records.
What To Do Now
The evidence does not point to malicious behaviour. Because the installer is unsigned, download it only from the official WindowTop website and keep your antivirus protection enabled during installation.
Where this verdict could be wrong3 caveats
- The installer is unsigned, so no publisher identity backs it.
- The antivirus analysis labels the file as protected with a .NET Reactor protector, and one of our behaviour rules matched an unsigned, packed file making network contact.
- Files built with the same import table include two earlier samples that engines flagged as a bundling adware family, although that table is shared by many unrelated installers.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 66 antivirus engines that checked it flagged the file.
- Four sandbox runs showed only normal installer activity.
- Network contact was limited to the product's own website, which has no malicious reputation.
- Shared by 74 different sources since it was first seen on Jun 28, 2026.
- No listings in public malware databases or matches against malware rule sets.
- The installer has no digital signature.
- The antivirus analysis reports a code protector on the file.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 11sandbox rule tags
- 7spawned processes
- 2network contacts
- 19filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1059.001· Runs commands
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
Observed activity
Processes started
7Programs the file ran, with their command lines.
WindowTop.5.32.3.x64.-.setup.exe"C:\Users\<USER>\Desktop\WindowTop.5.32.3.x64.-.setup.exe"WindowTop.5.32.3.x64.-.setup.tmp"C:\Users\<USER>\AppData\Local\Temp\is-R9RQ970WDV.tmp\WindowTop.5.32.3.x64.-.setup.tmp" /SL5="$12002C,25940502,893952,C:\Users\<USER>\Desktop\WindowTop.5.32.3.x64.-.setup.exe"WindowTop.5.32.3.x64.-.setup.exeC:\Users\<USER>\AppData\Local\Temp\is-WCC1G9ME2J.tmp\WindowTop.5.32.3.x64.-.setup.tmp /SL5=$201CE,25940502,893952,C:\Users\<USER>\Downloads\WindowTop.5.32.3.x64.-.setup.exepowershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command if (Get-AppxPackage -Name '25571BiGilSoft.WindowTop' -AllUsers) { exit 1 } else { exit 0 }WindowTop.5.32.3.x64.-.setup.exe"C:\Users\user\Desktop\WindowTop.5.32.3.x64.-.setup.exe"WindowTop.5.32.3.x64.-.setup.tmp"C:\Users\user\AppData\Local\Temp\is-X3NI48VFO0.tmp\WindowTop.5.32.3.x64.-.setup.tmp" /SL5="$30274,25940502,893952,C:\Users\user\Desktop\WindowTop.5.32.3.x64.-.setup.exe"
Show all 7 entries for processes started
powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-AppxPackage -Name '25571BiGilSoft.WindowTop' -AllUsers) { exit 1 } else { exit 0 }"
Network contacts
22 hosts, listed as 1 domain, 1 address, 1 link. Links show the host and path only.
- Domain
windowtop.info - IP address
192.0.78.142 - URL
http://windowtop.info/category/stable_versions_win10_2004/feed/
Files
17Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-R9RQ970WDV.tmp\WindowTop.5.32.3.x64.-.setup.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-WCC1G9ME2J.tmp\WindowTop.5.32.3.x64.-.setup.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-OH2SEGX7PS.tmp\_isetup\_setup64.tmp - Written
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzgdiwxj.um0.psm1 - Written
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txrwdgqb.2y0.ps1 - Written
C:\Users\user\AppData\Local\Temp\is-9071CFJF6H.tmp
Show all 17 entries for files
- Written
C:\Users\user\AppData\Local\Temp\is-9071CFJF6H.tmp\_isetup - Written
C:\Users\user\AppData\Local\Temp\is-9071CFJF6H.tmp\_isetup\_setup64.tmp - Written
C:\Users\user\AppData\Local\Temp\is-X3NI48VFO0.tmp - Written
C:\Users\user\AppData\Local\Temp\is-X3NI48VFO0.tmp\WindowTop.5.32.3.x64.-.setup.tmp - Written
C:\Users\user\AppData\Roaming - Written
C:\Users\user\Documents\20260627 - Written
C:\Users\user\Documents\20260627\PowerShell_transcript.DESKTOP-OYF2376.Gn840t9T.20260627232442.txt - Written
C:\Windows\system32\catroot - Written
C:\Windows\system32\catroot2 - Deleted
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzgdiwxj.um0.psm1 - Deleted
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txrwdgqb.2y0.ps1
Registry and auto-start
7Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Owner - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\SessionHash - Set
Software\Microsoft\RestartManager\Session0000\Owner - Set
Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager
Show all 7 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Sandbox background — not the file
8The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 8 entries for sandbox background — not the file
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 7f91a31d3318b3cd7ea7…4ff9f8Not checkedno saved verdict
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 27, 2026, 1:09 PM UTC
- SHA-256
16031364a1a55d9f8438beb620b783ad9f1402f84117b2ea2449c4ad1ff2d9e0- SHA-1
2bfa19b9f074c515867e31be5e65199a3ab2d3a3- MD5
fa17574caa4559033ac00893adf7e92a
About this file
WindowTop_V5.32.3.exe says it is WindowTop Setup (WindowTop), 27.1 MB.
- Claims to be
- WindowTop Setup (WindowTop)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 27.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 28, 2026On VirusTotal.
- Submitted by
- 74 distinct sources
- Packer
- .NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
- Entropy
- 6.16 of 8
First scanned
Antivirus consensus
0 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-115 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)Unsigned, packed PE with sandbox-observed network activity. The packing step hides the payload until execution; the network call fetches / reports for the next stage. Classic dropper / stager behaviour.
Evidencewindowtop.info
Section entropy & packers
A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is WindowTop_V5.32.3.exe safe?
What is WindowTop_V5.32.3.exe?
How many antivirus engines detected WindowTop_V5.32.3.exe?
What is the SHA-256 hash of WindowTop_V5.32.3.exe?
Is it safe to run WindowTop_V5.32.3.exe?
How up to date is this analysis of WindowTop_V5.32.3.exe?
Community
Member reviews and reports for this exact file hash.