File scan report
Verdict Suspicious
Is setup.
Only CrowdStrike flagged this unsigned installer as generic grayware, but uncorroborated and runtime mappings warrant caution despite broad major silence.
Read the whole reasonShow less
Why Suspicious? One antivirus engine (CrowdStrike) flags it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One of the 70 antivirus engines that checked it flagged the file with a generic grayware label, while all 17 major antivirus engines reported no detection.
CrowdStrike supplied the only detection among 75 engines, using a probabilistic grayware label rather than naming a malware family. All 17 major antivirus engines reported no detection, and neither researcher rules nor the malware sample database supplied corroboration. One completed sandbox mapped and T1134, but it named no injected process, recorded no persistence, and returned a clean result. The file is unsigned and lacks established publisher history, which weakens confidence in an otherwise installer-like execution pattern. Similar files were mostly assessed favorably, but those links share only an import-table fingerprint without signer confirmation and may reflect a common installer framework. No complete contacted-host reputation check is available, though the sandbox recorded no sample network contacts.
What We Detected
CrowdStrike was the only engine among 75 to flag the executable, labeling it probabilistic grayware. None of the 17 major antivirus engines detected it, and no engine consensus identified a malware family. The executable is unsigned, so there is no authenticated publisher identity or signer history.
Threat Behavior
One completed sandbox run mapped T1055 process injection and T1134 access-token manipulation. These mappings deserve caution, but the evidence names no injected target, the injected-process list is empty, and no persistence was recorded. The run produced a clean sandbox assessment and showed only installer-style temporary execution. No sample network contacts were observed during that run; a separate, complete host-reputation cross-check is unavailable.
Corroborating Evidence
No malware-specific researcher rules, malware-database match, malicious file it created, packing indicator, or brand mismatch was found. Four of five files sharing the import-table fingerprint previously received favorable assessments, but all were matches on the import table alone without signer confirmation, so they provide limited reassurance rather than proof.
What To Do Now
Verify the download source and obtain a publisher-supplied checksum or signed copy before running it. Keep security software enabled and use an isolated environment if the origin cannot be independently confirmed.
Where this verdict could be wrong4 caveats
- The lone CrowdStrike grayware detection may indicate unwanted software rather than a harmless false alarm.
- The test run mapped process injection and token manipulation techniques, although it identified no injected target and produced no malicious sandbox verdict.
- The executable is unsigned, so its publisher and integrity cannot be authenticated.
- No complete contacted-host reputation result is available; however, the completed sandbox recorded no sample network contacts to cross-check.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only one of the 70 antivirus engines that checked it flagged the file, and all 17 major antivirus engines reported no detection.
- The completed sandbox did not return a malicious assessment and recorded no persistence.
- No malware-specific researcher rule or malware-database match was found.
- No inspected file it created had a saved malicious assessment.
- The antivirus analysis found no packer or high-entropy code indicator.
- The executable is unsigned, leaving its publisher identity unauthenticated.
- CrowdStrike flagged it with a generic grayware detection.
- The test run mapped process injection and access-token manipulation techniques, without identifying a target process.
- Only four submitters have provided limited prevalence evidence.
- A complete reputation check for contacted hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 4spawned processes
- 0network contacts
- 3filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Note: Read the user name of the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
setup.exe
36a929d6fce6122de7cc2386b1dcb6320049740d611353b73de569a3472cfd41
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
setup.exe
"C:\Users\<USER>\Desktop\setup.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
setup.tmp
"C:\Users\<USER>\AppData\Local\Temp\is-UQUIP.tmp\setup.tmp" /SL5="$220194,2615641,294400,C:\Users\<USER>\Desktop\setup.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
setup.tmp
C:\Users\<USER>\AppData\Local\Temp\is-UQUIP.tmp\setup.tmp
Test run - Evidence 5 of 5: Written fileSeen in the test run
is-6K6QD.tmp
C:\Users\user\AppData\Local\Temp\is-6K6QD.tmp
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 14 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- CrowdStrikewin/grayware_confidence_60% (D)
File fingerprint
- Last analyzed
- Oct 9, 2026, 9:37 PM UTC
- SHA-256
36a929d6fce6122de7cc2386b1dcb6320049740d611353b73de569a3472cfd41- SHA-1
c6fe8866e71fd91c4fc09ca25921dc75765444d0- MD5
d7a40afe166e69e91dfdfef51e7bd079
About this file
setup.exe is a Win32 EXE file of 3.2 MB.
- Type and size
- Win32 EXE · 3.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 8, 2026On VirusTotal.
- Submitted by
- 4 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 4.53 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe, or is it malware?
What is setup.exe?
How many antivirus engines detected setup.exe?
What should I do if I already installed setup.exe?
What is the SHA-256 hash of setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.