File scan report
Verdict Safe
Is Test
Validly signed TestReach exam-proctoring installer, widely seen since 2021, with no detections from any of 74 antivirus engines and no high-risk behaviour in the test run.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer appears to be the legitimate TestReach proctoring client. Get it from your exam provider's official link and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 43 flagged
- Flagged 0
- No detection 43
- No result 31
- Code signing TestReach Ltd
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 43 antivirus engines that checked it flagged this installer. It carries a valid signature from TestReach Ltd and has been seen by 152 submitters over nearly five years. During the sandbox run it installed and launched the TestReach desktop app, with no injection into other processes.
No engine flagged the file, and the seven major antivirus engines that returned results reported it clean. The installer carries a valid TestReach Ltd signature, although our publisher history for this signer is thin. It has been circulating since late 2021 among 152 submitters, a pattern typical of legitimate software. The sandbox run showed msiexec installing an Electron-based TestReach application. Its environment checks for debuggers, USB devices and network adapters are expected for exam-proctoring software.
What We Detected
None of the 43 antivirus engines that checked it flagged this Windows Installer package. It has a valid signature from TestReach Ltd and has been submitted by 152 sources since December 2021.
Threat Behavior
The sandbox run installed the TestReach desktop application (an Electron app) into the user profile and launched it. No injection into other processes and no high-risk techniques were recorded. The network contacts were to cloud and CDN addresses; a complete host-reputation result is not available. The checks for debuggers, USB devices and system hardware match what exam-proctoring software does to prevent cheating.
What To Do Now
If you need TestReach for an exam, download it from your institution or the official TestReach site. Keep your antivirus enabled during installation.
Where this verdict could be wrong2 caveats
- Third-party sandbox comments report suspicious-to-malicious scores, likely driven by the proctoring features (debug, USB and network-adapter checks). These comments are unverified and their text was flagged as containing injection-like content.
- No host-reputation result is available for the IP addresses contacted during the sandbox run.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from any of the 74 antivirus engines
- Valid code signature from TestReach Ltd
- Seen by 152 submitters over nearly five years
- Sandbox run showed normal application installation with no injection into other processes
- The installer contacted several IP addresses without a recorded domain name, and their reputation has not been checked.
- Our publisher history for this signer is very limited.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 30sandbox rule tags
- 5spawned processes
- 6network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
30MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1018
- T1027· Obfuscated code
- T1036
- T1047
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1059· Runs commands
- T1059.001· Runs commands
- T1064
- T1070.004· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1091· USB spreading
- T1095· Custom network
- T1112
- T1120
- T1202
- T1485
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.003· Service install
- T1547.001· Auto-start
- T1553
- T1562.001· Disables security
- T1573
- T1574.001· Execution hijack
- T1574.002· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
msiexec.exe"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\install.msi" /qb ACCEPTEULA=1 LicenseAccepted=1TestReach.exe"C:\Users\<USER>\AppData\Local\Programs\TestReach\TestReach.exe"TestReach.exe"C:\Users\<USER>\AppData\Local\Programs\TestReach\TestReach.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,4098387333460222371,6755906700534177756,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=2112 /prefetch:8TestReach.exe"C:\Users\<USER>\AppData\Local\Programs\TestReach\TestReach.exe" --type=renderer --field-trial-handle=1668,4098387333460222371,6755906700534177756,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\<USER>\AppData\Local\Programs\TestReach\resources\app.asar" --node-integration --webview-tag --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-f…msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\installer.msi"
Network contacts
66 hosts, listed as 6 addresses. Links show the host and path only.
- IP address
18.238.176.23 - IP address
23.13.145.132 - IP address
13.224.241.41 - IP address
173.194.183.105 - IP address
142.250.187.206 - IP address
18.164.68.69
Files
30Files the file created, changed or deleted.
- Written
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log - Written
C:\Windows\Temp\~DF11BD8B13C282DAC4.TMP - Written
C:\Windows\Temp\~DF375AEE32FA27521B.TMP - Written
C:\Windows\Temp\~DFC1EB8745B02A5066.TMP - Written
C:\Windows\Temp\~DFDD3DCF109A030DCD.TMP - Written
C:\Config.Msi\fb0b.rbs
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\LICENSE.electron.txt - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\LICENSES.chromium.html - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\TestReach.exe - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\TestReachKM.exe - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\chrome_100_percent.pak - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\chrome_200_percent.pak - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\d3dcompiler_47.dll - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\ffmpeg.dll - Written
C:\Users\<USER>\AppData\Local\Programs\TestReach\icudtl.dat - Deleted
C:\Config.Msi\CMP961.tmp - Deleted
C:\Config.Msi - Deleted
C:\Windows\Installer\fb0c.msi - Deleted
C:\Config.Msi\CMP1FC7.tmp - Deleted
C:\Config.Msi\fb0b.rbs - Deleted
C:\Windows\Installer\fb09.msi - Deleted
C:\Windows\Installer\inprogressinstallinfo.ipi - Deleted
C:\Users\<USER>\AppData\Roaming\TestReach\Local Storage\leveldb\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Roaming\TestReach\Code Cache\wasm\index-dir\the-real-index - Deleted
C:\Users\<USER>\AppData\Roaming\TestReach\7eeb7492-cd96-496f-a357-3ecf83a4770e.tmp - Deleted
C:\Users\<USER>\AppData\Roaming\TestReach\Code Cache\js\index-dir\the-real-index - Deleted
C:\Users\<USER>\AppData\Roaming\TestReach\Code Cache\wasm\index-dir\temp-index - Deleted
C:\Users\<USER>\AppData\Roaming\TestReach\Code Cache\js\index-dir\temp-index - Deleted
C:\Users\<USER>\AppData\Roaming\TestReach\c9fcd314-1b7f-4e7e-a893-ce860ca4e8cb.tmp - Deleted
C:\MSIa0b47.tmp
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Global\_MSIExecuteLocal\AtomProcessSingletonStartup!\Sessions\1\BaseNamedObjects\Global\_MSIExecute\Sessions\1\BaseNamedObjects\Local\AtomProcessSingletonStartup!\BaseNamedObjects\Local\SM0:7544:304:WilStaging_02\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Show all 10 entries for mutexes
\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\BaseNamedObjects\Local\SM0:7544:120:WilError_01\BaseNamedObjects\Global\SyncRootManager\BaseNamedObjects\Local\SM0:2612:304:WilStaging_02
Sandbox background — not the file
10The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
msiexec.exeC:\Windows\system32\msiexec.exe /V - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Show all 10 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
msiexec.exeC:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V - VM host
8.8.8.8 - VM host
199.232.210.172
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- a4b8dc41b875f045b9e7…0d8424Not checkedno saved verdict
- a528f93d46bee34694b7…9382f3Not checkedno saved verdict
- 1e45b282c45b35f62fe4…e319feNot checkedno saved verdict
- 8f925cdf2ad02e4c2618…7674f2Not checkedno saved verdict
- be4b8924ab38e8acf350…d0b5deNot checkedno saved verdict
- 226eec4486509917aa33…21a974Not checkedno saved verdict
- 543cb2fe456ee600ff94…dd68b5Not checkedno saved verdict
- d27f11f439190c99c1b8…43d2beNot checkedno saved verdict
- c44607a865e7a6db0555…7c0e33Not checkedno saved verdict
Chapter 04
Technical details
None of the 43 antivirus engines that checked it flag it; signed by TestReach Ltd.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 12, 2026, 8:22 PM UTC
- SHA-256
6a245b728c63e1cb7c5a37958bad2f30556d451468b450b9a444ff373f310e33- SHA-1
0a4715eac3ab89791d9b8e78785475d7c263de20- MD5
47738dd90f3af440c055c644937227c1
About this file
TestReach-6.2.0.msi is a Windows Installer file of 63.8 MB.
- Type and size
- Windows Installer · 63.8 MB
- Signer
- TestReach LtdValid code signature.
- First seen
- Dec 19, 2021On VirusTotal.
- Submitted by
- 152 distinct sources
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 43 engines flagged this file
31 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-17 engines0flagged
- Tier-226 engines0flagged
- Low-trust10 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacNo result
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebNo result
- ElasticNo result
- EmsisoftClean
- ESET-NOD32No result
- F-SecureNo result
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWNo result
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingNo result
- SangforClean
- SentinelOneNo result
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookNo result
- VaristClean
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumNo result
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is TestReach-6.2.0.msi safe?
What is TestReach-6.2.0.msi?
How many antivirus engines detected TestReach-6.2.0.msi?
Is TestReach-6.2.0.msi digitally signed?
What is the SHA-256 hash of TestReach-6.2.0.msi?
Is it safe to install TestReach-6.2.0.msi?
How up to date is this analysis of TestReach-6.2.0.msi?
Community
Member reviews and reports for this exact file hash.