File scan report
Verdict Safe
Is Fingerprint.
Only 2 of the 57 antivirus engines that checked it raised generic alerts, while higher-trust engines, completed sandbox runs, host checks, and malware-intelligence sources…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 57 flagged
- Flagged 2
- No detection 55
- No result 18
- Code signing Unsigned
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two generic alerts appear much more likely to be false positives than evidence of malware. Higher-trust engines did not flag the executable, the combined sandbox verdict was clean, all observed destinations received complete reputation checks, and no malware-specific intelligence corroborated the alerts.
Only 2 of the 57 antivirus engines that checked it flagged the executable, and both were less reliable engines using generic or machine-learning labels rather than a named family. No higher-trust engine reported a detection. Across seven completed sandbox runs, the combined verdict was clean, with no named injection target, persistence, dropped file, or high-risk technique. Reputation checks covered every distinct observed contact and found no malicious or suspicious destination, while malware-specific rule and public sample-database checks returned no match. The executable is unsigned and one behaviour rule noted direct-IP traffic, but those weaker concerns do not outweigh the broader lack of corroboration.
What We Detected
Only 2 of the 57 antivirus engines that checked it raised alerts. APEX used a generic malicious label, while Trapmine produced a generic machine-learning score; no higher-trust engine identified a threat or named malware family.
Threat Behavior
The combined sandbox verdict was clean. They recorded no named process-injection target, persistence change, dropped file, or high-risk technique. One behaviour rule noted direct-IP traffic, but reputation checks covered every distinct observed contact and found no malicious or suspicious destination. The antivirus analysis also found no likely packing or high-entropy code.
What To Do Now
The evidence supports treating the two alerts as false positives. Because the executable is unsigned, obtain it from the expected official source, verify its hash when the publisher provides one, and keep security software enabled while using it.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so its publisher cannot be authenticated.
- APEX and Trapmine independently flagged it with generic malicious or machine-learning labels.
- One low-severity behaviour rule noted direct-IP traffic, although the inspected destinations had no malicious or suspicious reputation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No higher-trust engine flagged the executable.
- The combined sandbox verdict was clean across seven completed runs.
- No process-injection target, persistence change, dropped file, or high-risk technique was recorded.
- Complete reputation checks of the observed contacts found no malicious or suspicious destination.
- No malware-specific community rule or public malware-sample listing matched the hash.
- The executable is unsigned, so there is no authenticated publisher identity.
- Two independent engines raised generic malicious or machine-learning alerts.
- A low-severity behaviour rule noted direct connections to two external IP addresses.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 15sandbox rule tags
- 5spawned processes
- 4network contacts
- 5filesystem & mutex artifacts
What this file did when executed
This file was detonated in 7 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
15MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1056· Keylogging
- T1056.001· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1497.002· Sandbox evasion
- T1518.001· Checks your AV
- T1564.003· Hides artifacts
- T1574.002· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
FingerTool_lexar_Windows_.exe"C:\Users\<USER>\Desktop\FingerTool_lexar_Windows_.exe"FingerTool_lexar(Windows).exe%SAMPLEPATH%\FingerTool_lexar(Windows).exe8256c67b2a3812d1a32e9e158479c2702e444f88b9c5452cac26104fd73a33f9.exe%SAMPLEPATH%\8256c67b2a3812d1a32e9e158479c2702e444f88b9c5452cac26104fd73a33f9.exe8256c67b2a3812d1a32e9e158479c2702e444f88b9c5452cac26104fd73a33f9.exeC:\8256c67b2a3812d1a32e9e158479c2702e444f88b9c5452cac26104fd73a33f9.exeFingerTool_lexar(Windows).exe"C:\Users\user\Desktop\FingerTool_lexar(Windows).exe"
Network contacts
44 hosts, listed as 4 addresses. Links show the host and path only.
- IP address
23.6.103.183 - IP address
23.62.210.8 - IP address
114.114.114.114 - IP address
218.85.157.99
Files
3Files the file created, changed or deleted.
- Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE\KLT1I0ZU\update50[1].xml - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
FingerTool\Sessions\1\BaseNamedObjects\FingerTool
Sandbox background — not the file
11The analysis machine's own processes and connections, recorded in every run.
- VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
a83f:8110:6f00:7300:6900:7400:6900:6f00 - VM host
192.168.0.23 - VM host
20.99.185.48 - VM host
23.216.81.152
Show all 11 entries for sandbox background — not the file
- VM host
20.99.186.246 - VM host
192.168.0.80 - VM host
20.99.133.109 - VM host
104.71.214.69 - VM host
192.168.0.63
Chapter 04
Technical details
2 of the 57 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- APEXMalicious
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Nov 6, 2026, 11:46 PM UTC
- SHA-256
8256c67b2a3812d1a32e9e158479c2702e444f88b9c5452cac26104fd73a33f9- SHA-1
10502ead24b6086243006ff5540c19503373f3e9- MD5
b8a8b5f01e23e559c3a0618457d7b917
About this file
Fingerprint.exe is a Win32 EXE file of 3.8 MB.
- Original name
- Fingerprint.exeMatches the shared file name.
- Type and size
- Win32 EXE · 3.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 17, 2024On VirusTotal.
- Submitted by
- 15 distinct sources
- Packer
- None detected
- Entropy
- 7.58 of 8
First scanned
Antivirus consensus
2 of 57 engines flagged this file
18 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-112 engines0flagged
- Tier-231 engines0flagged
- Low-trust14 engines2flagged
View all 75 engine results
- APEXMalicious: Malicious
- TrapmineMalicious: malicious.moderate.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureNo result
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaNo result
- RisingNo result
- SangforNo result
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSNo result
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookNo result
- VaristClean
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence114.114.114.114 · 218.85.157.99
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Fingerprint.exe safe?
What is Fingerprint.exe?
How many antivirus engines detected Fingerprint.exe?
What is the SHA-256 hash of Fingerprint.exe?
Is it safe to run Fingerprint.exe?
How up to date is this analysis of Fingerprint.exe?
Community
Member reviews and reports for this exact file hash.