File scan report
Verdict Safe
Is Flarial.
Only VBA32 flagged this widely submitted installer, while major antivirus engines, completed observations from the test run, and fully checked contacted hosts provided no…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
VBA32 supplied the only detection among 75 engines, using a generic MSIL trojan label; none of the major antivirus engines flagged the file. Five completed sandbox runs recorded no high-risk techniques, malicious verdict, injection target, or persistence, and the reputation checks covering all observed contacts found no known threat hosts.
One of the 71 antivirus engines that checked it flagged the executable, and that detection came from VBA32 without support from any major antivirus engine. The five completed sandbox runs produced no malicious verdict, named injection target, persistence indicator, or other high-risk technique. Reputation checks covered all distinct observed contacts and found none already associated with malicious or suspicious activity. Three community rules matched, but they were generic code or file characteristics and did not identify a malware family. The unsigned status and unavailable independent static inspection warrant ordinary caution, but the lone uncorroborated detection is most consistent with a false positive.
What We Detected
VBA32 was the only one of the 71 antivirus engines that checked it to flag the executable, assigning a generic MSIL trojan label. None of the major antivirus engines detected it, and the three community-rule matches described generic code or file characteristics rather than a specific malware family.
Threat Behavior
Five completed sandbox runs recorded no malicious sandbox verdict, named process-injection target, persistence indicator, or high-risk technique. The reputation check covered every distinct observed domain and IP contact after identified analysis-environment traffic was excluded, and none was already associated with malicious or suspicious activity. The executable also showed no packing or unusually high-entropy code.
What To Do Now
The evidence supports treating the VBA32 result as an isolated false positive. Because the executable is unsigned and our independent static inspection was unavailable, obtain it from the project's official release channel and keep security software enabled when installing it.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so no verified publisher identity supports it.
- VBA32 labels the sample TScope.Trojan.MSIL, although no other engine corroborates that generic detection.
- Our static analysis was unavailable because the executable bytes were not uploaded, so its code was not independently inspected.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines flagged the file.
- Five completed sandbox runs recorded no malicious verdict or high-risk behavior.
- All observed network contacts received reputation checks, with no known malicious or suspicious hosts found.
- The file has been submitted by 2,017 distinct sources a total of 2,389 times.
- The antivirus analysis found no packer or unusually high-entropy code.
- The Windows executable has no verified digital signature.
- VBA32 labels it as a generic MSIL trojan, though no other engine corroborates that result.
- Independent static inspection of the executable's contents was not available.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 9sandbox rule tags
- 1spawned processes
- 2network contacts
- 6filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1070· Covers its tracks
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1562.001· Disables security
- T1573
Observed activity
Processes started
1Programs the file ran, with their command lines.
Flarial.Launcher.Installer.exe"C:\Users\user\Desktop\Flarial.Launcher.Installer.exe"
Network contacts
22 hosts, listed as 1 domain, 1 address. Links show the host and path only.
- Domain
cdn.flarial.xyz - IP address
172.67.194.13
Files
2Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\tq5epsye.moa - Written
C:\Users\user\AppData\Roaming
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASAPI32\ConsoleTracingMask - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASAPI32\EnableConsoleTracing - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASAPI32\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASAPI32\FileDirectory - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASAPI32\FileTracingMask - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASAPI32\MaxFileSize
Show all 15 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASMANCS\ConsoleTracingMask - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASMANCS\EnableConsoleTracing - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASMANCS\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASMANCS\FileDirectory - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASMANCS\FileTracingMask - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RECNDUUZ77GL7EJF_RASMANCS\MaxFileSize - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0174E68C97DDF1E0EEEA415EA336A163D2B61AFD\Blob - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Flarial_RASAPI32
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
68AA5B94-789D-4278-AB90-DA91B9CCB418\Sessions\1\BaseNamedObjects\68AA5B94-789D-4278-AB90-DA91B9CCB418\Sessions\1\BaseNamedObjects\Local\__DDrawExclMode__\Sessions\1\BaseNamedObjects\Local\__DDrawCheckExclMode__
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
assets.msn.com - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- d5c09e0c6481d6e5c7f6…1730e0Not checkedno saved verdict
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- VBA32TScope.Trojan.MSIL
File fingerprint
- Last analyzed
- Nov 7, 2026, 4:43 PM UTC
- SHA-256
5ab365e78503f0215677f8bb353eb913cd85746dd97b93a9aa162e56a3d3e701- SHA-1
9703ff30644837f01babeafda6206c5564d2e6e7- MD5
017bd4ab598b31309ec520a3c626f84f
About this file
Flarial.Launcher.Installer.exe is a Win32 EXE file of 33.3 kB.
- Claims to be
- Flarial Launcher Installer (Launcher Installer)From the file's own version information, written by whoever built it.
- Original name
- Flarial.Launcher.Installer.exeMatches the shared file name.
- Type and size
- Win32 EXE · 33.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 12, 2026On VirusTotal.
- Submitted by
- 2,017 distinct sources
- Packer
- None detected
- Entropy
- 6.89 of 8
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- VBA32Malicious: TScope.Trojan.MSIL
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- NETgeneric
- pe_no_import_tablegeneric
- win32_dotnet_loadergeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Flarial.Launcher.Installer.exe safe?
What is Flarial.Launcher.Installer.exe?
How many antivirus engines detected Flarial.Launcher.Installer.exe?
What is the SHA-256 hash of Flarial.Launcher.Installer.exe?
Is it safe to install Flarial.Launcher.Installer.exe?
How up to date is this analysis of Flarial.Launcher.Installer.exe?
Community
Member reviews and reports for this exact file hash.