File scan report
Verdict Safe
Is Aav_
All 62 antivirus engines that checked it were free of detections, including 17 major antivirus engines, and the installer has been observed since 2011.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 14
- Code signing Unsigned
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One sandbox mapped activity to and recorded a direct-IP contact, but produced no malicious runtime verdict; the unsigned package should still be sourced and verified carefully.
The strongest evidence is the absence of detections across 76 antivirus engines, including no alerts from 17 major antivirus engines. The file has also been observed for more than 15 years across 69 sources and 80 submissions, making an undiscovered widespread threat less likely. One completed sandbox run recorded and mappings, but it did not issue a malicious verdict, and no inspected child was identified as malware. Research feeds supplied no family, signature, or YARA corroboration. Confidence is reduced because the MSI is unsigned, every file it created remains unclassified, and no complete saved host-reputation check exists for the contacted IP.
What We Detected
No detections were reported among 76 antivirus engines, and all 17 reporting major antivirus engines were free of alerts. The MSI has been observed since 2011, with 69 sources and 80 submissions, and no matching malware family was supplied by the available research feeds.
Threat Behavior
One completed sandbox run mapped activity to T1055 and T1485 and recorded contact with 142.251.183.94. These mappings can be concerning, but the sandbox did not issue a malicious verdict, no persistence indicator was recorded, and none of the 10 inspected children was identified as malicious. However, those children remain unclassified, and no complete saved host-reputation result is available for the contacted IP.
What To Do Now
Use the installer only if it came from the developer or another trusted distribution channel. Because the package is unsigned, verify its SHA-256 value, keep security software enabled, and avoid installation if its origin cannot be established.
Where this verdict could be wrong4 caveats
- The installer is unsigned: code signing applies to this file type and the file is unsigned, so publisher identity cannot be authenticated.
- One of our behaviour rules fired from a mapping, and was also recorded; neither technique was corroborated by an explicit malicious sandbox verdict.
- One of our behaviour rules fired for 142.251.183.94, but the missing contacted-host reputation result means the address did not receive a complete saved reputation cross-check.
- All 10 inspected files it created have unknown verdicts, so the absence of a known-malicious dropped file is not equivalent to confirmed-clean files it created.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/62 antivirus engines detected the file
- No malicious sandbox verdict
- No inspected child identified as malicious
- Observed since 2011 across 69 sources and 80 submissions
- Unsigned Windows Installer despite signing being applicable
- Sandbox mapped possible process injection to T1055
- Sandbox recorded T1485
- Direct-IP contact to 142.251.183.94 lacks a complete saved host-reputation check
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 1spawned processes
- 1network contact
- 39filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1070.004· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1091· USB spreading
- T1120
- T1485
- T1566.002
- T1574.002· Execution hijack
Observed activity
Processes started
1Programs the file ran, with their command lines.
msiexec.exe"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\install.msi" /qb ACCEPTEULA=1 LicenseAccepted=1
Network contacts
11 host, listed as 1 address. Links show the host and path only.
- IP address
142.251.183.94
Files
30Files the file created, changed or deleted.
- Written
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log - Written
C:\Windows\Temp\~DFB74D91E55AB1AA7C.TMP - Written
C:\Windows\Temp\~DF7451BB60C3382136.TMP - Written
C:\Windows\Temp\~DF1E09CDB7F5142B6E.TMP - Written
C:\Windows\Temp\~DFBBF33C60FF47B6C0.TMP - Written
C:\Config.Msi\24473.rbs
Show all 30 entries for files
- Written
C:\Program Files\AAV ColorLab 64-bit\ColorLab.dll - Written
C:\Program Files\AAV ColorLab 64-bit\AAV ColorLab Readme.pdf - Written
C:\Program Files\AAV ColorLab 64-bit\ColorLabUI.dll - Written
C:\Windows\WinSxS\InstallTemp\20241009232914363.0\atl90.dll - Written
C:\Windows\WinSxS\InstallTemp\20241009232914363.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.cat - Written
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.cat - Written
C:\Windows\WinSxS\InstallTemp\20241009232914363.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.manifest - Written
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.manifest - Written
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\msvcm90.dll - Deleted
C:\Config.Msi\CMP48F6.tmp - Deleted
C:\Config.Msi - Deleted
C:\Windows\Installer\24474.msi - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914426.0 - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.cat - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.manifest - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\msvcm90.dll - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\msvcp90.dll - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914426.0\msvcr90.dll - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914363.0 - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914363.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.cat - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914363.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.manifest - Deleted
C:\Windows\WinSxS\InstallTemp\20241009232914363.0\atl90.dll - Deleted
C:\Config.Msi\CMP5569.tmp - Deleted
C:\Config.Msi\24473.rbs
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents
Mutexes
9Named locks a program uses so only one copy runs; malware families often reuse them.
Global\_MSIExecuteLocal\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\Sessions\1\BaseNamedObjects\Global\_MSIExecute\Sessions\1\BaseNamedObjects\Global\MSILOG_f121c5081d8dd5aGOL.4fb51ISM_pmeT_lacoL_ataDppA_egroeg_sresU_:C\BaseNamedObjects\Local\SM0:2340:304:WilStaging_02
Show all 9 entries for mutexes
\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\BaseNamedObjects\Local\SM0:2340:120:WilError_01
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
msiexec.exeC:\Windows\system32\msiexec.exe /V
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 3cd011617319709b2d20…1bc476Not checkedno saved verdict
- 3e5aefa515dd45c78d75…548b51Not checkedno saved verdict
- 49e22b24d757e08e0933…86e257Not checkedno saved verdict
- e5f2cf93deb7c430ae6d…1f0fe5Not checkedno saved verdict
- 0f47291635c5b2a6879c…305edeNot checkedno saved verdict
- 6f9fbb683aaf3529b134…6bef73Not checkedno saved verdict
- cb4a75549139007bf6ce…e070beNot checkedno saved verdict
- ebe17688c7dcea0bf887…234dabNot checkedno saved verdict
- 9ebb560f3efa2a55c926…518ff8Not checkedno saved verdict
- f20398cee3fef2afc996…a7854bNot checkedno saved verdict
Chapter 04
Technical details
None of the 62 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 8, 2026, 2:57 PM UTC
- SHA-256
6208766af9251cac1764a0e62ed3a8d19878251f287aea1fea8e5b91dddd939f- SHA-1
08cc1d005654ff7f2e8c4194bceb39499ea093eb- MD5
4a3bd47f8a08551ad35f5de566c3b4cc
About this file
Aav_ColorLab_1_0_rc2_x64.msi is a Windows Installer file of 2.3 MB.
- Type and size
- Windows Installer · 2.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 24, 2011On VirusTotal.
- Submitted by
- 69 distinct sources
First scanned
Antivirus consensus
0 of 62 engines flagged this file
14 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust11 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Aav_ColorLab_1_0_rc2_x64.msi safe?
What is Aav_ColorLab_1_0_rc2_x64.msi?
How many antivirus engines detected Aav_ColorLab_1_0_rc2_x64.msi?
What is the SHA-256 hash of Aav_ColorLab_1_0_rc2_x64.msi?
Is it safe to install Aav_ColorLab_1_0_rc2_x64.msi?
How up to date is this analysis of Aav_ColorLab_1_0_rc2_x64.msi?
Community
Member reviews and reports for this exact file hash.