MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Unknown

Our AI analyst is temporarily unavailable.

Trust score50Caution
MT AI confidence · 30%
setup.exe
6.6 MB
16067dfb3f930c9621…cebebb1c37
Antivirus engines
3 of 75 flagged
Code signing
Unsigned
Age
First seen 3y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

30%Confidence
Exploratory
Reasoning

Our AI analyst is temporarily unavailable. Based on the raw antivirus data we have (3 malicious of 71 reporting engines), we can't commit to a verdict confidently — re-scan in a few minutes for the full AI assessment.

Key signals · 3

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. AI arbiter unavailable (reason: arbiter_exception:OpenRouter HTTP 402 for anthropic/claude-haiku-4.5: Insufficient credits. Add more using https://openrouter.ai/settings/credits)

  2. engines.tier1Malicious=1

  3. engines.reporting=71

What to do

Wait a few minutes and re-scan for the full AI assessment before deciding.

Threat family attribution

crack corroborated by 1 source

  • VT (75 engines)
    crack
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
26

Adversary techniques mapped to the MITRE ATT&CK framework.

T1012T1018T1027T1027.002T1027.009T1033T1036T1045T1056T1057T1059T1063T1070T1071T1082T1083T1129T1134T1140T1485T1497.001T1529T1539T1548+2 more
Spawned processes
15
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\executable.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-P9DT4.tmp\executable.tmp" /SL5="$2018A,6386556,140800,C:\Users\<USER>\AppData\Local\Temp\executable.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-MILDI.tmp\FlushFileCache.exe"
$(unnamed)
"C:\Games\Stray\unins000.exe" /VERYSILENT
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\Stray\unins000.exe" /FIRSTPHASEWND=$30236 /VERYSILENT
$(unnamed)
C:\Windows\Explorer.EXE
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
C:\Windows\system32\svchost.exe -k DcomLaunch -p
+7 more processes captured.
Network activity
22
IP addresses20
  • 204.79.197.203
  • 20.99.185.48
  • 192.229.211.108
  • 20.99.133.109
  • a83f:8110:0:0:1b00:100:2800:0
  • 20.99.184.37
  • a83f:8110:cce1:d301:10:0:0:0
  • 20.99.186.246
  • 23.216.147.64
  • 131.253.33.203
+10 more
URLs2
  • http://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4A8157B2FF422C259DDAA2D0E568C0C0AFAB940E1F6E0E482EF83E90DDBAD2D6/VC_redist.x86.exe
  • http://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/EE84FED2552E018E854D4CD2496DF4DD516F30733A27901167B8A9882119E57C/VC_redist.x64.exe
Filesystem & mutexes
40
Files written15
  • C:\Games\Stray\unins000.exe
  • C:\Games\Stray\_Redist\vc_redist.x86.exe
  • C:\Games\Stray\_Redist\vc_redist.x64.exe
  • C:\Games\Stray\_Windows 7 Fix\Hk_project\Binaries\Win64\d3d10.dll
  • C:\Games\Stray\_Windows 7 Fix\Hk_project\Binaries\Win64\d3d10core.dll
+10 more
Files deleted15
  • C:\Games\Stray\is-7JNAG.tmp
  • C:\Games\Stray\_Redist\is-NHDUD.tmp
  • C:\Games\Stray\_Redist\is-HB8I7.tmp
  • C:\Games\Stray\_Windows 7 Fix\Hk_project\Binaries\Win64\is-2V56J.tmp
  • C:\Games\Stray\_Windows 7 Fix\Hk_project\Binaries\Win64\is-API2K.tmp
+10 more
Mutexes created10
  • Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
  • Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
  • Local\DirectSound DllMain mutex (0x00001460)
  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 09af8004b85478e1eca0…47b449Never scanned
    never seen before
  • 4a8157b2ff422c259dda…bad2d6Never scanned
    never seen before
  • 0bb81d315a5c73509ea3…0b7a14Never scanned
    never seen before
  • d92f7c60256509f74e36…62ea29Never scanned
    never seen before
  • 450b9b0ba25bf068afbc…fd0105Never scanned
    never seen before
  • f84677643d9977aa1e8a…61f824Never scanned
    never seen before
  • 148fa9a255bfff3f7d8a…9a3483Never scanned
    never seen before
  • 3602213e591f15d97676…699aa8Never scanned
    never seen before
  • dbbe2c9857fcc613a470…a83712Never scanned
    never seen before
  • 19a5466ab1834f953662…6072f5Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

1 synthesis
MITRE ATT&CK profile
C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • DirectIpC2
    T1071
    medium

    Sample contacted 20 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    204.79.197.203 · 20.99.185.48 · 192.229.211.108
Antivirus engine breakdown

3 detections across 75 engines

3 malicious0 suspicious72 clean
Tier-117 engines
1flag
Top commercial AVs (low FP rate)
Tier-238 engines
1flag
Mainstream engines with mixed FP rates
Low-trust20 engines
1flag
Heuristic / generic-AI engines (high FP rate)
GData
malicious
Generic.Trojan.PSEB.V66IQ8
Malwarebytes
malicious
RiskWare.Crack
Webroot
malicious
W32.Hack.Tool
Hash 16067dfb3f93… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy8 sections
.text
6.48
.itext
6.02
.data
2.67
.bss
0.00
.idata
4.97
.tls
0.00
.rdata
0.19
.rsrc
4.16
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
988
Hundreds of people have uploaded this — common.
Total submissions
1,151
Includes repeat uploads by the same source.
First seen by VT
3y ago
Aug 16, 2023
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
8/16/2023, 11:03:05 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
6/5/2026, 3:00:36 PM
Scanned here
6/14/2026, 1:44:49 AM
File name
setup.exe
Size
6.59 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
16067dfb3f930c9621856a4977504f48f48bf2197c26e65c3017d7cebebb1c37
MD5
44b6e577846432cab833365b2f849890
SHA-1
44e95786742dbb856844de93a1deb59b083ee46e
PE imphash
483f0c4259a9148c34961abbda6146c1
First seen (VT)
8/16/2023, 11:03:05 PM
Last analysis (VT)
6/5/2026, 3:00:36 PM
First scan (MalwareTips)
6/14/2026, 1:44:49 AM
Last scan (MalwareTips)
6/14/2026, 1:44:49 AM
Community reputation
-1flagged
Behavior tags
checks-user-inputdetect-debug-environmentpeexeoverlaycve-2006-3869exploit
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.