MalwareTipsTools

File scan report

Scan another file

Verdict Suspicious

Analyzed , 1 day ago

Is ep_setup.exe safe? Treat it as suspicious.

Five of the 69 antivirus engines that checked it flag this unsigned shell-customisation installer, three of them major, but the labels are riskware and generic behaviour signatures rather than a named malware family.

Why Suspicious? 5 antivirus engines flag it; nothing else confirms it.

Limited evidence · One sign points to a problem; nothing else confirms it.

Don't install it until you know where it came from

Keep your protection enabled and only run this installer if you deliberately want a shell-modification utility and can confirm it came from the project's official release page. Avoid unofficial mirrors, and create a restore point before installing.

What to do now4 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

  1. Don't install it unless you're sure where it came from.

  2. Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.

  3. If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.

If you already installed it

  1. Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Share this file report

ep_setup.exe: Suspicious — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Antivirus results

5 of 69 flagged

  • Flagged 5
  • No detection 64
  • No result 6
Fileep_setup.exe12.3 MBSHA-256 2165c7d12f10…c8e9e6
  • Code signing Unsigned
  • Test run Completed
  • First seen 12d ago
Byte-identical to ep_setup.exe in valinet/ExplorerPatcher release 26100.9711.71.1 (published Oct 29, 2026). This is context, not evidence of safety: 3 independent antivirus engines report the file as malicious.

Chapter 02

Why we think so

4 points against it and 5 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

This unsigned installer modifies the Windows shell: the sandbox runs recorded it stopping Explorer, registering a shell DLL and creating a service, which matches the tool it claims to be. Three major antivirus engines flag it, one explicitly as riskware, but no engine names a real trojan family and no malicious sandbox verdict, host contact or dropped file was recorded.

Full reasoning

Five of the 69 antivirus engines that checked it flagged the file, three of them major: GData calls it riskware attached to this product's name, DrWeb applies a generic signature, and Fortinet uses a behaviour-based label. That is more than a lone unreliable engine, so the file cannot be described as clean, but the labels do not converge on a malware family — only one engine even mentions the product name and no consensus family exists. The file carries no digital signature, so there is no publisher identity to check and no signing history to weigh. Across five recorded sandbox runs there was no malicious sandbox verdict and no named process injection target; the process tree shows an installer that kills explorer.exe, stops and restarts a service it created, and registers a shell DLL, which is what this kind of shell-modification utility does. The remaining evidence is neutral: no malicious or suspicious contacted host, no malicious dropped file, no database listings or malware-specific rules, and wide but recent distribution.

Detailed assessment

What We Detected

Five of the 69 antivirus engines that checked it flagged this executable, three of them from the higher-trust group. GData labels it as riskware tied to the product name, DrWeb applies a generic signature, and Fortinet uses a behaviour-based detection; two less reliable engines added a generic malicious verdict and a machine-learning score. No engine named a recognisable malware family, and there is no agreement on a family between the engines that did flag it.

The file is not digitally signed, so there is no publisher identity to verify and no signing history on record for it. Static inspection of the executable showed no packer and no unusually high-entropy code sections.

Threat Behaviour

Five sandbox runs were recorded and none produced a malicious verdict. The process tree shows installer-shaped activity: Explorer is terminated, a service named with an "ep_dwm" prefix is stopped, deleted and started again, and a shell extension DLL is registered with regsvr32. Files are written into a program directory along with a DLL placed in the Windows directory — the usual mechanism for a tool that hooks the shell.

Network activity was limited to release distribution, cloud storage and Microsoft symbol servers. Our host-reputation cross-reference inspected 18 devices and returned no malicious or suspicious hosts. Ten files were dropped and none of those with a verdict was judged malicious.

What To Do Now

Because three major antivirus engines object to it, treat this installer with caution rather than running it blindly. Keep your security protection enabled and, if your antivirus blocks it, add an exclusion only after you have confirmed where the file came from and are comfortable with a tool that modifies core Windows shell components. One neutral detail: the bytes match an asset published in a well-known open-source project's release, which argues against tampering with the download — it does not clear the engines' riskware flags. Third-party shell patches can also be undone or broken by Windows updates, so keep a restore point.

Where this verdict could be wrong3 caveats
  • The flags come from generic and riskware-style signatures rather than a named trojan family, and the runtime summary recorded no malicious verdict, no named injection target and no malicious network contact — a harsher reading than 'mixed signals' is not supported by the evidence.
  • Shell-modification tools commonly earn riskware labels because they replace system components and restart Explorer, which is exactly what this installer was observed doing rather than any credential or data-theft activity.
  • The file is widely shared (219 distinct submitters) and none of the engines that flagged it agreed on a single family, which is the usual shape of rule-based false positives on niche system utilities — although the major flags still justify caution.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • No antivirus engine identified a named malware family; the labels are generic signatures and a riskware classification.
  • None of the sandbox runs returned a malicious verdict, and no named process injection target was recorded.
  • The contacted-host reputation check found no malicious or suspicious devices among 18 inspected.
  • No malicious dropped file, no database listing and no malware-specific detection rule matched this file.
  • The file has been shared by 219 distinct submitters, which is inconsistent with a private, targeted payload.
Points against
  • Three major antivirus engines object to this file, one of them classifying it as riskware tied to its product name.
  • The installer is unsigned, so there is no publisher identity or signing history to confirm who built and shipped it.
  • It stops Explorer, restarts a service it creates and registers a DLL into the Windows directory — behaviour that changes core shell components and is why behaviour-based engines flag it.
  • Distribution is recent and no engine agreed on a single malware family, so the classification rests on generic and riskware-style signatures.

7 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 5 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 5isolated sandbox runs
  • 47sandbox rule tags
  • 15spawned processes
  • 17network contacts
  • 31filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

  • Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).

  • Moderate concern: Ran commands or a script on the test computer.

  • Moderate concern: Checked whether it was running on a test computer.

  • Moderate concern: Hid files or windows on the test computer.

  • Note: Read the user name of the test computer.

  • Note: Listed the programs running on the test computer.

  • Note: Deleted files or logs during the test run (installers often clean up after themselves).

Sandbox labels we could not confirm (common in safe files too)

  • Not confirmed: A sandbox rule tagged this run as password-store access, but nothing touched the Windows password store.

  • Not confirmed: A sandbox rule tagged this run as creating a scheduled task; none was recorded.

  • Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.

  • Not confirmed: A sandbox rule tagged this run as creating a service; no new service was recorded.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

  1. Input file

    The submitted object

    1
    1. Evidence 1 of 7: FileSeen in the test run

      ep_setup.exe

      2165c7d12f10b1a137472de5b64abdc64dcdd9fc31362c7ff41d7c5b57c8e9e6

      Uploaded file

  2. Processes

    What ran

    2
    1. Evidence 2 of 7: ProcessSeen in the test run

      ep_setup.exe

      "C:\Users\<USER>\Desktop\ep_setup.exe"

      Test run
    2. Evidence 3 of 7: ProcessSeen in the test run

      taskkill.exe

      "C:\Windows\system32\taskkill.exe" /f /im explorer.exe

      Test run
    3. +1 more recorded observation

  3. Files

    Created or changed

    2
    1. Evidence 4 of 7: Written fileSeen in the test run

      ep_setup.exe

      C:\Program Files\ExplorerPatcher\ep_setup.exe

      Test run
    2. Evidence 5 of 7: Written fileSeen in the test run

      ExplorerPatcher.IA-32.dll

      C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll

      Test run
    3. +1 more recorded observation

  4. Network

    Hosts contacted

    2
    1. Evidence 6 of 7: Contacted hostSeen in the test run

      vsblobprodscussu5shard72.blob.core.windows.net

      Contacted during the test run.

      Test run
    2. Evidence 7 of 7: Contacted hostSeen in the test run

      github.com

      Contacted during the test run.

      Test run
    3. +1 more recorded observation

7 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 5 sandboxes and its runtime behaviour was observed.

Techniques observed in the sandbox

47

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1003· Credential theft
  • T1005
  • T1010
  • T1012
  • T1027· Obfuscated code
  • T1027.002· Obfuscated code
  • T1033· Reads user info
  • T1036
  • T1047
  • T1053· Scheduled task
  • T1055· Process injection
  • T1057· Lists programs
  • T1059· Runs commands
  • T1069
  • T1070.004· Covers its tracks
  • T1071· Application protocol
  • T1074
  • T1082· System recon
  • T1083· Scans your files
  • T1112
  • T1129· Loads modules
  • T1134
  • T1134.001
  • T1202
  • T1218.010
  • T1485
  • T1497· Sandbox evasion
  • T1497.001· Sandbox evasion
  • T1529
  • T1539
  • T1543.003· Service install
  • T1546.015· Event-triggered run
  • +15 more

Observed activity

Processes started
15

Programs the file ran, with their command lines.

  • ep_setup.exe"C:\Users\<USER>\Desktop\ep_setup.exe"
  • taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe
  • cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "
  • sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
  • sc.exe"C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
  • sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Show all 15 entries for processes started
  • sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
  • regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
  • regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
  • explorer.exeC:\Windows\explorer.exe /NoUACCheck
  • taskhostw.exe
  • mobsync.exeC:\Windows\System32\mobsync.exe -Embedding
  • ep_setup.exe"C:\Users\user\Desktop\ep_setup.exe"
  • taskkill.exeC:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
  • cmd.exeC:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "
Network contacts
17

17 hosts, listed as 8 domains, 8 addresses, 8 links. Links show the host and path only.

  • Domainvsblobprodscussu5shard72.blob.core.windows.net
  • Domaingithub.com
  • Domainrelease-assets.githubusercontent.com
  • Domainvsblobprodscussu5shard70.blob.core.windows.net
  • Domainvsblobprodscussu5shard62.blob.core.windows.net
  • Domainvsblobprodscussu5shard75.blob.core.windows.net
Show all 24 entries for network contacts
  • Domainvsblobprodscussu5shard53.blob.core.windows.net
  • Domainvsblobprodscussu5shard47.blob.core.windows.net
  • IP address20.209.197.33
  • IP address140.82.114.4
  • IP address185.199.110.133
  • IP address140.82.113.3
  • IP address185.199.109.133
  • IP address23.195.81.144
  • IP address135.130.24.65
  • IP address57.150.53.97
  • URLhttps://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe
  • URLhttps://github.com/valinet/ExplorerPatcher/releases/download/26100.8457.70.3/ep_setup.exe
  • URLhttps://release-assets.githubusercontent.com/github-production-release-asset/394318710/c5a757dc-94fd-4f00-b701-b8f72c8d4cfa
  • URLhttps://vsblobprodscussu5shard70.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/E5F84D71EF83A6E44417808A9A4402EA0B3EA9226677328BB263BEAA6AB2A4FF00.blob
  • URLhttp://msdl.microsoft.com/download/symbols/explorer.pdb/5810F62038D0F879A7E836E04D80C56B1/explorer.pdb
  • URLhttp://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/580C488135F4A3231F3E19CE1A6FB0D81/twinui.pcshell.pdb
  • URLhttp://msdl.microsoft.com/download/symbols/StartDocked.pdb/3E3C9F28BE16C5651409366F88FFB1BA1/StartDocked.pdb
  • URLhttp://msdl.microsoft.com/download/symbols/StartUI.pdb/3EEA89B8D3F17DCE3022D2D59C4AFC861/StartUI.pdb
Files
21

Files the file created, changed or deleted.

  • WrittenC:\Program Files\ExplorerPatcher\ep_setup.exe
  • WrittenC:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll
  • WrittenC:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll
  • WrittenC:\Program Files\ExplorerPatcher\ep_gui.dll
  • WrittenC:\Program Files\ExplorerPatcher\ep_dwm_svc.exe
  • WrittenC:\Program Files\ExplorerPatcher\ep_weather_host.dll
Show all 21 entries for files
  • WrittenC:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
  • WrittenC:\Program Files\ExplorerPatcher\WebView2Loader.dll
  • WrittenC:\Program Files\ExplorerPatcher\ep_taskbar.rs2.dll
  • WrittenC:\Windows\dxgi.dll
  • WrittenC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
  • WrittenC:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
  • WrittenC:\Windows\System32\Tasks\CreateExplorerShellUnelevatedTask
  • WrittenC:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask
  • WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
  • DeletedC:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job
  • DeletedC:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
  • DeletedC:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update
  • DeletedC:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000059.db
  • DeletedC:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000005a.db
  • DeletedC:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles
Registry and auto-start
28

Settings the file changed, including ways to start again after a restart.

  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\UninstallString
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\DisplayName
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\Publisher
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\NoModify
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\NoRepair
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\DisplayVersion
Show all 28 entries for registry and auto-start
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\VersionMajor
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\VersionMinor
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher\DisplayIcon
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\(Default)
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32\(Default)
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\(Default)
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods\(Default)
  • SetHKEY_CURRENT_USER\SOFTWARE\ExplorerPatcher\CrashCounter
  • SetHKEY_CURRENT_USER\SOFTWARE\ExplorerPatcher\MigratedFromOldSettings
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\GroupCollapseState
  • DeletedHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NlaSvc\Parameters\Internet\ManualProxies\(Default)
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DefaultStartLayout_UseWin8UpgradeBehavior
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LogonWork
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DefaultStartLayout_UseWin7UpgradeBehavior
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UpgradeOrPBRAttempts
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\SearchboxTaskbarModeForceGlyph
  • DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE\TelemetryCorrelation\FirstRunCorrelationID
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DesktopReadyTimeout
  • DeletedHKEY_CURRENT_USER\SOFTWARE\ExplorerPatcher\OSBuild
  • DeletedHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{12a011e2-0000-0000-0000-90d022000000}
  • DeletedHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
  • DeletedHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{12a011e2-0000-0000-0000-100000000000}
Mutexes
10

Named locks a program uses so only one copy runs; malware families often reuse them.

  • Local\ExplorerIsShellMutex
  • Global\EP_Weather_Killswitch_{A6EA9C2D-4982-4827-9204-0AC532959F6D}_bqltbyzfuyogreeupkxcwliddvvlmxqqrvozcgrxhlzselafilgzcgcbxzss
  • Local\SessionImmersiveColorMutex
  • 69884752-95BE-4032-8AF1-B300F0E2CB97-Mutex
  • Local\Shell.CMruPidlList
  • Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex
Show all 10 entries for mutexes
  • Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_16.db!dfMaintainer
  • Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_48.db!dfMaintainer
  • Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainer
  • Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainer
Sandbox background — not the file
1

The analysis machine's own processes and connections, recorded in every run.

  • VM hostwww.bing.com
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked
  • bb5fda5f2d3aae5e0977…5b6677Not checked
    no saved verdict
  • 06a75cb30fd2c37fb386…f36704Not checked
    no saved verdict
  • fdac566e0e980bac2856…2f79e0Not checked
    no saved verdict
  • b5d1244cddad6137e421…f38b6aNot checked
    no saved verdict
  • 80ea4b52b996311412e1…19d14bNot checked
    no saved verdict
  • 028b5ccebdb0a7de439d…7485ffNot checked
    no saved verdict
  • 2268014fe9e745f800e4…6fbaf0Not checked
    no saved verdict
  • d98d61558ea0ec034ae5…2d4fc5Not checked
    no saved verdict
  • 805342ae3d70bd0ec74a…7a7820Not checked
    no saved verdict
  • 9078db921d464fbee248…344e17Not checked
    no saved verdict

Chapter 04

Technical details

5 of the 69 antivirus engines that checked it flag it; no publisher signature.

Sources checked

Every check behind this verdict

7 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompleteRisk signal: 5 of 69 engines flagged it · 6 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · C2AE, CAPA, CAPE SandboxComplete5 runs, no sandbox verdict recorded Details for sandbox run
Contacted hostsMalwareTips URL scannerComplete18 contacted hosts checked Details for contacted hosts
Signature rulesYARAify community rules + MalwareTips rulesComplete2 MalwareTips behaviour rules Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match
GitHub releaseRelease asset digestCompleteSame file as the 26100.9711.71.1 release of valinet/ExplorerPatcher (context only)

Engines that flagged it 5

  • DrWeb (major engine)Trojan.Siggen36.59931
  • Fortinet (major engine)Malicious_Behavior.SB
  • GData (major engine)Win64.Riskware.ExplorerPatcher.B
  • APEXMalicious
  • Trapminemalicious.moderate.ml.score

File fingerprint

Last analyzed
Nov 10, 2026, 3:16 AM UTC
SHA-256
2165c7d12f10b1a137472de5b64abdc64dcdd9fc31362c7ff41d7c5b57c8e9e6
SHA-1
5143919c6895742e0ced0be2a8c55fdd62fb9c8e
MD5
c2ea2cd9d51c538c9062592cc5442b75

About this file

ep_setup.exe says it is ExplorerPatcher Setup Program (ExplorerPatcher), 12.3 MB.

Claims to be
ExplorerPatcher Setup Program (ExplorerPatcher)From the file's own version information, written by whoever built it.
Original name
ep_setup.exeMatches the shared file name.
Type and size
Win32 EXE · 12.3 MB
Signer
UnsignedNo code signature.
First seen
Oct 29, 2026On VirusTotal.
Submitted by
219 distinct sources
Packer
None detected
Entropy
7.95 of 8

First scanned

Antivirus consensus

5 of 69 engines flagged this file

5 malicious0 suspicious64 not flagged6 no result

6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

  • Tier-118 engines
    3flagged
  • Tier-235 engines
    0flagged
  • Low-trust16 engines
    2flagged
View all 75 engine results
  • APEXMalicious: Malicious
  • DrWebMalicious: Trojan.Siggen36.59931
  • FortinetMalicious: Malicious_Behavior.SB
  • GDataMalicious: Win64.Riskware.ExplorerPatcher.B
  • TrapmineMalicious: malicious.moderate.ml.score
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaClean
  • alibabacloudClean
  • ALYacClean
  • Antiy-AVLClean
  • ArcabitClean
  • AvastClean
  • Avast-MobileNo result
  • AVGClean
  • AviraClean
  • BitDefenderClean
  • BitDefenderFalxNo result
  • BkavClean
  • CAT-QuickHealClean
  • ClamAVNo result
  • CMCClean
  • CrowdStrikeClean
  • CTXClean
  • CylanceClean
  • CynetClean
  • DeepInstinctClean
  • ElasticClean
  • EmsisoftClean
  • ESET-NOD32Clean
  • F-SecureClean
  • GoogleClean
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • K7AntiVirusClean
  • K7GWClean
  • KasperskyClean
  • KingsoftClean
  • LionicClean
  • MalwarebytesClean
  • MaxSecureClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoClean
  • PandaClean
  • RisingNo result
  • SangforClean
  • SentinelOneClean
  • SkyhighClean
  • SophosClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisClean
  • TencentClean
  • TrellixENSClean
  • TrendMicroClean
  • TrendMicro-HouseCallClean
  • TrustlookNo result
  • VaristClean
  • VBA32Clean
  • VIPREClean
  • VirITClean
  • ViRobotClean
  • WebrootClean
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

2 heuristics
MITRE ATT&CK profile
Defense evasion× 1Cred access× 1
Behavior heuristics
Deterministic patterns derived from scan data and observed runtime behavior
  • ProcessInjection
    T1055
    low

    VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.

    Evidence
    T1055 (sandbox MITRE mapping)
  • CredentialDumper
    T1003T1003.001
    low

    VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.

    Evidence
    T1003 (sandbox MITRE mapping)
PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 7.95Unpacked
Section entropy7 sections
.text
6.47
.rdata
5.62
.data
1.96
.pdata
5.22
.fptable
0.00
.rsrc
7.99
.reloc
5.01
0.0Packed threshold 7.28.0
Prevalence

How widely this file has been seen

Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.

Common & new
Unique uploaders
219
Hundreds of people have uploaded this — common.
Total submissions
257
Includes repeat uploads by the same source.
First seen
12d ago
Oct 29, 2026
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is ep_setup.exe safe, or is it malware?
ep_setup.exe is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. 5 of the 69 antivirus engines that checked it flag it. Don't install it unless you're sure where it came from. If you need the software, download a fresh installer from the developer's own website.
What is ep_setup.exe?
ep_setup.exe is a software installer, about 12.3 MB. Its version information says it is “ExplorerPatcher Setup Program” (ExplorerPatcher). Version information is written by whoever built the file, so it is a claim, not proof of who made it. VirusTotal first saw it on Oct 29, 2026.
How many antivirus engines detected ep_setup.exe?
5 of the 69 antivirus engines that checked it flag ep_setup.exe, including Dr.Web and Fortinet. We weigh which engines flagged it and what else the scan found, not just the count.
What should I do if I already installed ep_setup.exe?
No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it. 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.
What is the SHA-256 hash of ep_setup.exe?
The SHA-256 fingerprint of ep_setup.exe is 2165c7d12f10b1a137472de5b64abdc64dcdd9fc31362c7ff41d7c5b57c8e9e6, and its MD5 is c2ea2cd9d51c538c9062592cc5442b75. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
How up to date is this analysis of ep_setup.exe?
This report reflects the scan on Nov 10, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Other files people checked with the same name, and recent reports with the same rating. A matching name does not make two files the same: only the SHA-256 fingerprint identifies a file.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.