File scan report
Verdict Safe
Is windhawk_
Two of the 69 antivirus engines that checked it flagged this widely distributed, verified-signed Windhawk installer, while major antivirus engines, completed sandboxing, and…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 69 flagged
- Flagged 2
- No detection 67
- No result 6
- Code signing Open Source Developer, Michael Maltsev
- Test run Completed
- First seen 10mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two detections appear more consistent with false positives caused by Windhawk's low-level system-modification features than with a confirmed Rugmi infection. The file is widely distributed, carries a verified signature, received no major detections, and produced no malicious sandbox verdict or known-bad network contact.
Only Malwarebytes and Zillya flagged the sample among 75 engines, and none of the 17 major antivirus engines did so. The installer has broad, established prevalence with 3,689 submitters and more than 30,000 submissions, which conflicts with the isolated downloader label. Its verified signature adds support, although the signer's one-sample history is too small to establish strong publisher trust. Reputation checks covered all observed domain and IP contacts and found no known malicious or suspicious host, while no file it created had a malicious saved verdict. Taken together, the detections are likely rule-based reactions to Windhawk's system customization behavior rather than corroborated malware activity.
What We Detected
Two of the 69 antivirus engines that checked it flagged the installer. Malwarebytes used a generic machine-learning label, while Zillya named the Rugmi downloader; none of the 17 major antivirus engines flagged it, and there was no family consensus.
Threat Behavior
These are security-sensitive capabilities that overlap with attacker techniques, but the evidence names no injected target and the sandbox returned a clean result. Reputation checks covered all 15 distinct observed domains and IPs, including GitHub release infrastructure, Windhawk update services, and certificate-status services, and found no known malicious or suspicious hosts.
Context
The executable has a verified signature from Open Source Developer and is broadly established, with 3,689 submitters and 30,260 submissions. The signer's history contains only one prior sample, so the signature should not be treated as conclusive by itself. Similar-file records are weak context because every match is based only on an import-table fingerprint shared with differently signed installers.
What To Do Now
Use the installer only if it came from the official Windhawk release channel, verify its SHA-256 as 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f, and keep security software enabled. Avoid copies from mirrors or unsolicited links because Windhawk's powerful modification features could be abused if the package were replaced.
Where this verdict could be wrong3 caveats
- Malwarebytes and Zillya independently flagged the installer, with Zillya naming the Rugmi downloader family.
- The verified signer has only one historical sample, so its apparently clean history is not yet well established.
- Nine dropped files lack saved verdicts, leaving their individual reputations unresolved even though none is currently identified as malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 17 major antivirus engines flagged the file.
- The executable has a valid signature from Open Source Developer.
- It is broadly established, with 3,689 submitters and 30,260 submissions.
- The completed sandbox did not return a malicious result.
- Reputation checks covering every observed domain and IP found no known malicious or suspicious hosts.
- Two independent engines flagged the installer, and one assigned the Rugmi downloader name.
- The publisher signature has only one historical sample behind it, limiting the value of its clean record.
- Nine extracted files do not have individual saved verdicts.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 37sandbox rule tags
- 2spawned processes
- 14network contacts
- 35filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
37MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1036
- T1053· Scheduled task
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1059· Runs commands
- T1059.001· Runs commands
- T1064
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1105· Network file transfer
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1202
- T1222
- T1485
- T1497.001· Sandbox evasion
- T1529
- T1539
- T1547· Auto-start
- T1547.001· Auto-start
- T1547.009· Auto-start
- T1548
- +5 more
Observed activity
Processes started
2Programs the file ran, with their command lines.
windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -servicewinlogon.exe
Network contacts
1414 hosts, listed as 8 domains, 6 addresses, 5 links. Links show the host and path only.
- Domain
github.com - Domain
release-assets.githubusercontent.com - Domain
update.windhawk.net - Domain
mods.windhawk.net - Domain
ocsp.comodoca.com.cdn.cloudflare.net - Domain
ocsp.sectigo.com
Show all 19 entries for network contacts
- Domain
ocsp.comodoca.com - Domain
ocsp.usertrust.com - IP address
140.82.116.3 - IP address
185.199.108.133 - IP address
104.21.16.237 - IP address
140.82.114.3 - IP address
172.64.149.23 - IP address
104.18.38.233 - URL
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1 - URL
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd - URL
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ= - URL
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU= - URL
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m/WqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac=
Files
30Files the file created, changed or deleted.
- Written
C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx - Written
C:\Windows\System32\Tasks\WindhawkRunUITask - Written
C:\Windows\System32\Tasks\WindhawkUpdateTask - Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF23.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\LangDLL.dll
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\modern-header.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\nsDialogs.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\INetC.dll - Written
C:\Program Files\Windhawk\Compiler\windhawk-compiler.7z - Written
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\nsis7z.dll - Written
C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32 - Written
C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\bin - Written
C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\lib - Deleted
C:\Windows\Tasks\WindhawkRunUITask.job - Deleted
C:\Windows\Tasks\WindhawkUpdateTask.job - Deleted
C:\Program Files\Windhawk\Compiler\windhawk-compiler.7z - Deleted
C:\Program Files\Windhawk\Compiler\include\winrt\windhawk-compiler-winrt.7z - Deleted
C:\Program Files\Windhawk\UI\windhawk-ui.7z - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\AccessControl.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\ApplicationID.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\INetC.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\LangDLL.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\modern-header.bmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\modern-wizard.bmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\nsDialogs.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\nsExec.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\nsis7z.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoEF72.tmp\SimpleSC.dll
Registry and auto-start
18Settings the file changed, including ways to start again after a restart.
- Auto-start
Windhawk - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\VFUProvider\StartTime - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Windhawk\install_dir - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Windhawk\language - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\DisplayName - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\UninstallString
Show all 18 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\InstallLocation - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\Publisher - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\DisplayIcon - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\DisplayVersion - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\URLInfoAbout - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\NoModify - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windhawk\NoRepair - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Windhawk\Engine\Warning - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Windhawk\Engine\ModsWritable\Warning - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Windhawk\Settings\Language - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Windhawk\Settings\InjectIntoCriticalProcesses - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Windhawk\Engine\Settings\LoadModsInCriticalSystemProcesses
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Global\WindhawkServiceMutexProcessInitAPCMutex-pid=3576ProcessInitAPCMutex-pid=5636windhawk_instmutex\Sessions\1\BaseNamedObjects\windhawk_instmutex
Sandbox background — not the file
14The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Show all 14 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DevQueryBroker - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder - VM host
bg.microsoft.map.fastly.net
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4cf25411f28f639f7215…2d5b7eNot checkedno saved verdict
- 09a58561aad834d841c6…0c55a9Not checkedno saved verdict
- 85e03805f90f72257dd4…1dccb9Not checkedno saved verdict
- 42023baf6ab9cc3daf47…4928a5Not checkedno saved verdict
- 4653f410dcb67a35e280…563984Not checkedno saved verdict
- 16352e7dfa65d092af7b…d9a2d0Not checkedno saved verdict
- b393f05e8ff919ef0711…adf592Not checkedno saved verdict
Chapter 04
Technical details
2 of the 69 antivirus engines that checked it flag it; signed by Open Source Developer, Michael Maltsev.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- MalwarebytesMalware.AI.2830472274
- ZillyaDownloader.Rugmi.Win64.1326
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:37 PM UTC
- SHA-256
5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f- SHA-1
8185ffb95f72fc75f0fc4d964b2438b59a1fa653- MD5
a1a8fbcbde2d70638957f3e69a8e034b
About this file
windhawk_setup.exe is a Win32 EXE file of 11.6 MB.
- Type and size
- Win32 EXE · 11.6 MB
- Signer
- Open Source Developer, Michael MaltsevValid code signature.
- First seen
- Dec 8, 2025On VirusTotal.
- Submitted by
- 3,689 distinct sources
- Packer
- None detected
- Entropy
- 5.11 of 8
First scanned Updated
Antivirus consensus
2 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines2flagged
- Low-trust17 engines0flagged
View all 75 engine results
- MalwarebytesMalicious: Malware.AI.2830472274
- ZillyaMalicious: Downloader.Rugmi.Win64.1326
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
The sandbox recorded persistence through a service or scheduled task. Installers set these up legitimately for their own updaters and services, so this is context, not proof of malicious intent.
EvidenceWindhawkVirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is windhawk_setup.exe safe?
What is windhawk_setup.exe?
How many antivirus engines detected windhawk_setup.exe?
Is windhawk_setup.exe digitally signed?
What is the SHA-256 hash of windhawk_setup.exe?
Is it safe to install windhawk_setup.exe?
How up to date is this analysis of windhawk_setup.exe?
Community
Member reviews and reports for this exact file hash.