File scan report
Verdict Safe
Is setup.
One generic detection among 75 engines is outweighed by long-established prevalence, a clean combined sandbox verdict, and fully checked contacts with no hostile reputation.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 8y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Skyhigh alone raised a generic behavioural detection; none of the major antivirus engines flagged the executable. Its history spans 582 submitters since Jul 18, 2018, the combined sandbox verdict was clean, and reputation checks found no hostile contacts, making the isolated alert very likely a false positive.
Only 1 of the 71 antivirus engines that checked it flagged the executable, using a generic behavioural label rather than naming a malware family. None of the major antivirus engines detected it, and no second engine corroborated Skyhigh's result. The file has broad, long-established prevalence, with 582 submitters and a first-seen date of Jul 18, 2018. Across nine sandbox runs, the combined verdict was clean, no named injection target was recorded, and no high-risk technique was corroborated. Reputation checks covered every listed contact and found none with a hostile reputation, while public malware databases and malware-specific community rules produced no hits. The unsigned status and unavailable static inspection limit publisher attribution, but they do not outweigh the consistent benign evidence.
What We Detected
Skyhigh was the only engine to flag the executable, assigning a generic behavioural label. The other 74 of the 71 antivirus engines that checked it did not flag it, including every major antivirus engine represented in the results, and no engine consensus identified a malware family.
Threat Behavior
The combined verdict across nine sandbox runs was clean. No named process-injection target, persistence indicator, malicious dropped file, or other corroborated high-risk technique was recorded. Reputation checks covered every listed network contact and found no known malicious or suspicious host.
What To Do Now
The isolated Skyhigh alert is most consistent with a false positive, particularly given the file's 582 submitters and history since Jul 18, 2018. Because the executable is unsigned, obtain it from the expected official source and keep security software enabled when running it.
Where this verdict could be wrong3 caveats
- Skyhigh labels the file BehavesLike.Win32.Infected.th, although no other engine corroborates that generic behavioural detection.
- The executable is unsigned, so there is no verified publisher identity.
- Our static analysis was unavailable because the file bytes were not uploaded; the conclusion therefore relies on antivirus, reputation, and evidence from the test run.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines flagged the executable.
- The file has been submitted by 582 distinct sources and was first seen on Jul 18, 2018.
- The combined sandbox verdict was clean, with no corroborated high-risk technique or named injection target.
- Every listed network contact was reputation-checked, with no known malicious or suspicious host found.
- No malicious dropped file, packing indicator, malware-specific community rule, or public malware-database listing was found.
- Skyhigh issued one generic behavioural detection.
- The executable has no verified publisher signature.
- The file bytes were not available for our own static inspection.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 9 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 9isolated sandbox runs
- 25sandbox rule tags
- 2spawned processes
- 10network contacts
- 32filesystem & mutex artifacts
What this file did when executed
This file was detonated in 9 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
25MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1018
- T1027· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1056.001· Keylogging
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1087
- T1095· Custom network
- T1112
- T1113
- T1129· Loads modules
- T1134
- T1135
- T1222
- T1529
- T1564.003· Hides artifacts
- T1573
- T1614
- T1614.001
Observed activity
Processes started
2Programs the file ran, with their command lines.
software.exe"C:\Users\<USER>\AppData\Local\Temp\software.exe"3c754a3cd2465b5c649c2b49c4d3753168aae20e50ce6a9dc4ec884ab9df7aa5.exe%SAMPLEPATH%\3c754a3cd2465b5c649c2b49c4d3753168aae20e50ce6a9dc4ec884ab9df7aa5.exe
Network contacts
1010 hosts, listed as 6 domains, 4 addresses. Links show the host and path only.
- Domain
img-prod-cms-rt-microsoft-com.akamaized.net - Domain
login.live.com - Domain
firefox.settings.services.mozilla.com - Domain
prod.ingestion-edge.prod.dataops.mozgcp.net - Domain
incoming.telemetry.mozilla.org - Domain
telemetry-incoming.r53-2.services.mozilla.com
Show all 10 entries for network contacts
- IP address
20.22.113.133 - IP address
104.98.118.155 - IP address
65.9.83.38 - IP address
35.227.207.240
Files
22Files the file created, changed or deleted.
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - Written
C:\Users\user\AppData\Local\Microsoft\Windows\History - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies - Written
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\18FDE40B-6A9F-4A94-8FE6-84E119B8C639
Show all 22 entries for files
- Written
\Device\ConDrv\\Connect - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14FA.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER172C.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER176C.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3061.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3073.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3074.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3469.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER347A.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER347B.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER140F.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14EA.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER152A.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B8D.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B9E.tmp.csv
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Set
HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\A70D59A1-8EAD-4F40-AAAB-FBFC460800A4\FriendlyName - Set
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent\CurrentDefault - Set
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent\LastPingSentAt - Set
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent\PingCurrentDefault
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
MSCTF.Shared.MUTEX.EBH\Sessions\1\BaseNamedObjects\MozillaFirefoxDefaultBrowserAgentRegistryMutex\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
Sandbox background — not the file
22The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3840_270873283\bin\updater.exe - VM injection target
C:\Program Files\Google3840_270873283\bin\updater.exe - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft
Show all 22 entries for sandbox background — not the file
- VM host
204.79.197.203 - VM host
23.216.147.76 - VM host
192.229.211.108 - VM host
a83f:8110:0:0:1400:1400:2800:3800 - VM host
20.99.184.37 - VM host
20.99.133.109 - VM host
a83f:8110:3ce7:d901:beac:bf78:cce1:d301 - VM host
20.99.185.48 - VM host
23.216.147.64 - VM host
192.168.0.20 - VM host
23.216.81.152 - VM host
192.168.0.29 - VM host
192.168.0.11 - VM host
192.168.0.17 - VM host
20.69.140.28 - VM host
23.196.145.221
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- c0d6974c960e74660b28…55c3deNot checkedno saved verdict
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- SkyhighBehavesLike.Win32.Infected.th
File fingerprint
- Last analyzed
- Nov 4, 2026, 7:24 AM UTC
- SHA-256
3c754a3cd2465b5c649c2b49c4d3753168aae20e50ce6a9dc4ec884ab9df7aa5- SHA-1
38ad3516fbf64fe2c0089561cd7d5eb4ca1eafef- MD5
c19a0e7d3b498c3037745697b46fd84c
About this file
setup.exe says it is Setup/Uninstall, 1.4 MB.
- Claims to be
- Setup/UninstallFrom the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 1.4 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 18, 2018On VirusTotal.
- Submitted by
- 582 distinct sources
- Packer
- None detected
- Entropy
- 6.57 of 8
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines1flagged
- Low-trust17 engines0flagged
View all 75 engine results
- SkyhighMalicious: BehavesLike.Win32.Infected.th
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe?
What is setup.exe?
How many antivirus engines detected setup.exe?
What is the SHA-256 hash of setup.exe?
Is it safe to install setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.