File scan report
Verdict Safe
Is Git-
None of the 64 antivirus engines that checked it flagged this Git installer, it carries a valid signature, and the sandbox runs showed only routine Inno Setup installer activity…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Safe to use if downloaded from the official Git for Windows site. Keep antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 11
- Code signing Johannes Schindelin
- Test run Completed
- First seen Today
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The sandbox runs showed standard installer setup commands, and no injected processes or malicious hosts were found. Sandbox mappings such as had no supporting evidence.
No engine flagged the file, and 14 major antivirus engines reported it clean. The signature is valid, although the signer has no history with us. The sandbox combined verdict was clean, and the observed commands (a session check and a symbolic-link test) are routine for Inno Setup installers. The mapping names no injected process, so it is not evidence of injection. No external database listed the file, and the only network contact was sandbox background traffic. The file is recently first seen, which limits the history available.
What We Detected
No detections from 75 engines. The file is a signed Win32 installer built with Inno Setup.
Threat Behavior
The sandbox runs showed the installer unpacking to temporary folders and running a session check and a symbolic-link test. No injection targets, persistence or malicious contacts were recorded.
What To Do Now
Download installers from the project's official site and keep antivirus protection enabled.
Where this verdict could be wrong2 caveats
- The signer has no history in our records and is not a curated trusted publisher, so the valid signature does not by itself establish the publisher's identity.
- The file was first seen on Oct 26, 2026 and has little reputation history, so engine silence is less established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No engine flagged the file.
- Valid digital signature.
- Combined sandbox verdict was clean.
- No external database listings.
- The file was first seen on Oct 26, 2026, so its history is short.
- The signer has no history in our records.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 12sandbox rule tags
- 6spawned processes
- 0network contacts
- 7filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1202
- T1553
- T1553.002
- T1574· Execution hijack
Observed activity
Processes started
6Programs the file ran, with their command lines.
cmd.exe"C:\Windows\system32\cmd.exe" /d /c net session >"C:\Users\<USER>\AppData\Local\Temp\is-OSSWOOL4CU.tmp\net-session.txt"Git-2.56.0.4-64-bit.exe"C:\Users\<USER>\Desktop\Git-2.56.0.4-64-bit.exe"Git-2.56.0.4-64-bit.tmp"C:\Users\<USER>\AppData\Local\Temp\is-7DSWLQ4KN7.tmp\Git-2.56.0.4-64-bit.tmp" /SL5="$2002A,64827986,1395200,C:\Users\<USER>\Desktop\Git-2.56.0.4-64-bit.exe"cmd.exe"C:\Windows\system32\cmd.exe" /d /c mklink /d "C:\Users\<USER>\AppData\Local\Temp\is-OSSWOOL4CU.tmp\symbolic link" "C:\Users\<USER>\AppData\Local\Temp\is-OSSWOOL4CU.tmp" >"C:\Users\<USER>\AppData\Local\Temp\is-OSSWOOL4CU.tmp\symlink test.txt"Git-2.56.0.4-64-bit.exe"C:\Users\user\Desktop\Git-2.56.0.4-64-bit.exe"Git-2.56.0.4-64-bit.tmp"C:\Users\user\AppData\Local\Temp\is-KD8A5U9BF3.tmp\Git-2.56.0.4-64-bit.tmp" /SL5="$3043E,64827986,1395200,C:\Users\user\Desktop\Git-2.56.0.4-64-bit.exe"
Files
7Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-7DSWLQ4KN7.tmp\Git-2.56.0.4-64-bit.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-OSSWOOL4CU.tmp\net-session.txt - Written
C:\Users\<USER>\AppData\Local\Temp\is-OSSWOOL4CU.tmp\symlink test.txt - Written
C:\Users\user\AppData\Local\Temp\is-B03YI1C35Y.tmp - Written
C:\Users\user\AppData\Local\Temp\is-B03YI1C35Y.tmp\_isetup - Written
C:\Users\user\AppData\Local\Temp\is-KD8A5U9BF3.tmp
Show all 7 entries for files
- Written
C:\Users\user\AppData\Local\Temp\is-KD8A5U9BF3.tmp\Git-2.56.0.4-64-bit.tmp
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
cl-glcb907925.gcdn.co - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- c4f9bb6d032a81c3fff8…f5c0a5Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it; signed by Johannes Schindelin.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 27, 2026, 12:06 AM UTC
- SHA-256
4961a4a8cc778d8b6e00a5819e5fe4d078b754555aff7aedc2d77a5d74c2de80- SHA-1
6de92255eabcfc35057f5d0cf5a37bc84df77e06- MD5
8a5ccd1b207885434205cb29df4c2730
About this file
Git-2.56.0.4-64-bit.exe says it is Git Setup (Git), 66.9 MB.
- Claims to be
- Git Setup (Git)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 66.9 MB
- Signer
- Johannes SchindelinValid code signature.
- First seen
- Oct 26, 2026On VirusTotal.
- Submitted by
- 91 distinct sources
- Packer
- None detected
- Entropy
- 5.77 of 8
First scanned
Antivirus consensus
0 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-114 engines0flagged
- Tier-233 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXNo result
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)Sample ran reconnaissance commands. On its own this is weak signal — admin scripts do this too — but combined with other red flags it fills in an attacker profile.
Evidencenet view/session/share
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Git-2.56.0.4-64-bit.exe safe?
What is Git-2.56.0.4-64-bit.exe?
How many antivirus engines detected Git-2.56.0.4-64-bit.exe?
Is Git-2.56.0.4-64-bit.exe digitally signed?
What is the SHA-256 hash of Git-2.56.0.4-64-bit.exe?
Is it safe to run Git-2.56.0.4-64-bit.exe?
How up to date is this analysis of Git-2.56.0.4-64-bit.exe?
Community
Member reviews and reports for this exact file hash.