File scan report
Verdict Safe
Is windhawk_
Two of the 69 antivirus engines that checked it flagged this widely distributed, verified-signed Windhawk installer, while major antivirus engines, completed sandboxing, and…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 69 flagged
- Flagged 2
- No detection 67
- No result 6
- Code signing Open Source Developer, Michael Maltsev
- Test run Completed
- First seen 10mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two detections appear more consistent with false positives caused by Windhawk's low-level system-modification features than with a confirmed Rugmi infection. The file is widely distributed, carries a verified signature, received no major detections, and produced no malicious sandbox verdict or known-bad network contact.
Only Malwarebytes and Zillya flagged the sample among 75 engines, and none of the 17 major antivirus engines did so. The installer has broad, established prevalence with 3,689 submitters and more than 30,000 submissions, which conflicts with the isolated downloader label. Its verified signature adds support, although the signer's one-sample history is too small to establish strong publisher trust. Reputation checks covered all observed domain and IP contacts and found no known malicious or suspicious host, while no file it created had a malicious saved verdict. Taken together, the detections are likely rule-based reactions to Windhawk's system customization behavior rather than corroborated malware activity.
What We Detected
Two of the 69 antivirus engines that checked it flagged the installer. Malwarebytes used a generic machine-learning label, while Zillya named the Rugmi downloader; none of the 17 major antivirus engines flagged it, and there was no family consensus.
Threat Behavior
These are security-sensitive capabilities that overlap with attacker techniques, but the evidence names no injected target and the sandbox returned a clean result. Reputation checks covered all 15 distinct observed domains and IPs, including GitHub release infrastructure, Windhawk update services, and certificate-status services, and found no known malicious or suspicious hosts.
Context
The executable has a verified signature from Open Source Developer and is broadly established, with 3,689 submitters and 30,260 submissions. The signer's history contains only one prior sample, so the signature should not be treated as conclusive by itself. Similar-file records are weak context because every match is based only on an import-table fingerprint shared with differently signed installers.
What To Do Now
Use the installer only if it came from the official Windhawk release channel, verify its SHA-256 as 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f, and keep security software enabled. Avoid copies from mirrors or unsolicited links because Windhawk's powerful modification features could be abused if the package were replaced.
Where this verdict could be wrong3 caveats
- Malwarebytes and Zillya independently flagged the installer, with Zillya naming the Rugmi downloader family.
- The verified signer has only one historical sample, so its apparently clean history is not yet well established.
- Nine dropped files lack saved verdicts, leaving their individual reputations unresolved even though none is currently identified as malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 17 major antivirus engines flagged the file.
- The executable has a valid signature from Open Source Developer.
- It is broadly established, with 3,689 submitters and 30,260 submissions.
- The completed sandbox did not return a malicious result.
- Reputation checks covering every observed domain and IP found no known malicious or suspicious hosts.
- Two independent engines flagged the installer, and one assigned the Rugmi downloader name.
- The publisher signature has only one historical sample behind it, limiting the value of its clean record.
- Nine extracted files do not have individual saved verdicts.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 37sandbox rule tags
- 2spawned processes
- 14network contacts
- 35filesystem & mutex artifacts
Includes the sandbox verdicts, 37 mapped techniques, every process, file, registry and network entry and 7 dropped files.
Show the technical evidenceChapter 04
Technical details
2 of the 69 antivirus engines that checked it flag it; signed by Open Source Developer, Michael Maltsev.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- MalwarebytesMalware.AI.2830472274
- ZillyaDownloader.Rugmi.Win64.1326
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:37 PM UTC
- SHA-256
5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f- SHA-1
8185ffb95f72fc75f0fc4d964b2438b59a1fa653- MD5
a1a8fbcbde2d70638957f3e69a8e034b
About this file
windhawk_setup.exe is a Win32 EXE file of 11.6 MB.
- Type and size
- Win32 EXE · 11.6 MB
- Signer
- Open Source Developer, Michael MaltsevValid code signature.
- First seen
- Dec 8, 2025On VirusTotal.
- Submitted by
- 3,689 distinct sources
- Packer
- None detected
- Entropy
- 5.11 of 8
First scanned Updated
Includes every engine result (75), 4 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is windhawk_setup.exe safe?
What is windhawk_setup.exe?
How many antivirus engines detected windhawk_setup.exe?
Is windhawk_setup.exe digitally signed?
What is the SHA-256 hash of windhawk_setup.exe?
Is it safe to install windhawk_setup.exe?
How up to date is this analysis of windhawk_setup.exe?
Community
Member reviews and reports for this exact file hash.