File scan report
Verdict Safe
Is Store
No engines flagged this verified Microsoft-signed installer, and its established history, sandbox results, host checks, and inspected files it created show no corroborated threat.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Microsoft Corporation
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it flagged the executable, and its Microsoft Corporation signature verified successfully. Its publisher history contains 38 safe samples and no malicious ones; completed observation from the test run, comprehensive host checks, and inspected file it created results provide no corroborated harmful evidence.
The executable has a valid Microsoft Corporation signature and matches the curated Microsoft publisher entry. None of the 70 antivirus engines that checked it flagged it, including the participating major antivirus engines. The combined sandbox verdict was clean, with no named process-injection target or other high-risk technique supported by a concrete artefact. The host-reputation check covered all 33 distinct observed contacts and found no malicious or suspicious hosts, while no inspected child was malicious. The file is also widely submitted and was first seen on Oct 30, 2024, which is consistent with established commodity software. Mixed outcomes for files built with the same import table are weak context because those files do not share this file's verified signer.
What We Detected
None of the 70 antivirus engines that checked it flagged this executable. Its code signature verified as Microsoft Corporation, the publisher matched the curated Microsoft entry, and the available publisher history contains 38 safe samples with no malicious samples.
Threat Behavior
The combined sandbox verdict was clean. Two automated technique mappings appeared, but neither had the concrete artefact it described: no injected process was identified and no supported defence-tampering action was recorded. The reputation check covered all 33 distinct observed contacts and found no malicious or suspicious hosts. No inspected file it created was malicious, and four were known-software reference entries.
What To Do Now
The evidence supports normal use when the file came from the expected distribution channel. Keep security software enabled and obtain another copy from the official source if the file arrived unexpectedly or its origin cannot be verified.
Where this verdict could be wrong2 caveats
- The sandbox summary mapped and T1562.001, but recorded neither a named injection target nor the artefacts those mappings describe.
- Similar files sharing the import-table fingerprint have mixed prior outcomes, including two malicious results, but none shares this file's signer and the match can arise from common build frameworks.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The executable carries a valid Microsoft Corporation signature.
- None of the 70 antivirus engines that checked it flagged the file.
- The publisher history contains 38 safe samples and no malicious samples.
- The combined sandbox verdict was clean and recorded no named injection target.
- All 33 distinct observed contacts were covered by the reputation check, with no malicious or suspicious results.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 6 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 6isolated sandbox runs
- 20sandbox rule tags
- 9spawned processes
- 28network contacts
- 39filesystem & mutex artifacts
What this file did when executed
This file was detonated in 6 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
20MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1018
- T1027· Obfuscated code
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1106
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1539
- T1562· Disables security
- T1562.001· Disables security
- T1574.002· Execution hijack
- T1620· In-memory loading
Observed activity
Processes started
9Programs the file ran, with their command lines.
msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9WZDNCRFJ140?ocid=&referrer=psiTwitter Installer.exe"C:\Users\<USER>\Desktop\Twitter Installer.exe"Twitter Installer.exe%SAMPLEPATH%\Twitter Installer.exetwitter-windows-10.exe%SAMPLEPATH%\twitter-windows-10.exetwitter-windows-8.exe%SAMPLEPATH%\twitter-windows-8.exeTwitter_Installer.exe%SAMPLEPATH%\Twitter_Installer.exe
Show all 9 entries for processes started
509c3e05cc31ebad6853b84b93655aab19780b924b4f9601b0bc3e88b76efb5f.exe%SAMPLEPATH%\509c3e05cc31ebad6853b84b93655aab19780b924b4f9601b0bc3e88b76efb5f.exeTwitter Installer.exe"C:\Users\user\Desktop\Twitter Installer.exe"smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding
Network contacts
2828 hosts, listed as 8 domains, 20 addresses. Links show the host and path only.
- Domain
bzib.nelreports.net - Domain
sparkcdneus2.azureedge.net - Domain
www.clarity.ms - Domain
login.microsoftonline.com - Domain
w.clarity.ms - Domain
xpaywalletcdn.azureedge.net
Show all 28 entries for network contacts
- Domain
northcentralus-0.in.applicationinsights.azure.com - Domain
store-images.s-microsoft.com - IP address
13.107.6.158 - IP address
23.219.78.74 - IP address
72.21.81.200 - IP address
20.190.151.133 - IP address
23.96.124.156 - IP address
52.240.245.67 - IP address
23.216.147.78 - IP address
23.216.147.61 - IP address
173.222.198.144 - IP address
23.55.185.172 - IP address
23.216.147.70 - IP address
23.216.147.75 - IP address
23.216.147.71 - IP address
23.44.175.79 - IP address
23.44.175.73 - IP address
96.7.158.166 - IP address
23.53.122.137 - IP address
23.219.78.68 - IP address
217.20.54.36 - IP address
23.197.238.105
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\Tmp7D73.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp7FE5.tmp - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Twitter Installer.exe.log - Written
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - Written
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2367C848C1C8A11F6F3502EDA2855348 - Written
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Show all 30 entries for files
- Written
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2367C848C1C8A11F6F3502EDA2855348 - Written
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 - Written
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Twitter Installer.exe.log - Written
C:\Users\user\AppData\Local\Microsoft\Windows\History - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\local - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpED5D.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpEE68.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpF627.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpF6D4.tmp - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpB6.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\Tmp192.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpF84A.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpF8F7.tmp - Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE\KLT1I0ZU\update50[1].xml - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpFA6D.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpFAEB.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpFC71.tmp - Deleted
%USERPROFILE%\AppData\Local\Temp\TmpFD3D.tmp
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASAPI32\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASAPI32\EnableAutoFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASAPI32\EnableConsoleTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASAPI32\FileTracingMask
Show all 15 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASAPI32\ConsoleTracingMask - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASAPI32\MaxFileSize - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASAPI32\FileDirectory - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASMANCS\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASMANCS\EnableAutoFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASMANCS\EnableConsoleTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASMANCS\FileTracingMask - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASMANCS\ConsoleTracingMask - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Twitter Installer_RASMANCS\MaxFileSize
Mutexes
9Named locks a program uses so only one copy runs; malware families often reuse them.
Local\__DDrawExclMode__Local\__DDrawCheckExclMode__Global\{f6bec8ba-58ff-4dfc-9981-2ec5ebd23734}-9WZDNCRFJ140Local\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutex\Sessions\1\BaseNamedObjects\Local\__DDrawExclMode__
Show all 9 entries for mutexes
\Sessions\1\BaseNamedObjects\Local\__DDrawCheckExclMode__\Sessions\1\BaseNamedObjects\Global\{f6bec8ba-58ff-4dfc-9981-2ec5ebd23734}-9WZDNCRFJ140\Sessions\1\BaseNamedObjects\Microsoft-Windows-Safety-SmartScreen
Sandbox background — not the file
13The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding - VM process
WerFault.exeC:\Windows\System32\WerFault.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3624_161033296\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
Show all 13 entries for sandbox background — not the file
- VM injection target
C:\Program Files\Google3624_161033296\bin\updater.exe - VM host
edge-mobile-static.azureedge.net - VM host
business.bing.com - VM host
edge-consumer-static.azureedge.net - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM URL
http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4daf8c784795a5c98ae9…cd8365Not checkedno saved verdict
- 28c871238311d40287c5…2286c6Not checkedno saved verdict
- b33efcb95235b98b4850…29307fNot checkedno saved verdict
- ed71e51d9390850034cd…dc62a7Not checkedno saved verdict
- 27dc89aba8bd4dc46f45…0d30eaCleantrust 85known-software reference set · not scanned here
- 54c51d766697b3c2ad79…c8d6b4Cleantrust 85known-software reference set · not scanned here
- f81b7b9ce24f5a2b9418…121f32Cleantrust 85known-software reference set · not scanned here
- c741f70f4b2a8d88bf2e…3073e0Cleantrust 85known-software reference set · not scanned here
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 4, 2026, 4:03 AM UTC
- SHA-256
509c3e05cc31ebad6853b84b93655aab19780b924b4f9601b0bc3e88b76efb5f- SHA-1
29208a0b188f935f18c1321a646c55c3ee918a4b- MD5
4ac2e6bed084acf9ad010006acc4e24e
About this file
StoreInstaller.exe is a Win32 EXE file of 1.1 MB.
- Claims to be
- Store InstallerFrom the file's own version information, written by whoever built it.
- Original name
- StoreInstaller.exeMatches the shared file name.
- Type and size
- Win32 EXE · 1.1 MB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Oct 30, 2024On VirusTotal.
- Submitted by
- 178 distinct sources
- Packer
- None detected
- Entropy
- 6.83 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is StoreInstaller.exe safe?
What is StoreInstaller.exe?
How many antivirus engines detected StoreInstaller.exe?
Is StoreInstaller.exe digitally signed?
What is the SHA-256 hash of StoreInstaller.exe?
Is it safe to run StoreInstaller.exe?
How up to date is this analysis of StoreInstaller.exe?
Community
Member reviews and reports for this exact file hash.