File scan report
Verdict Malicious
Is Capri-
Fourteen of seventy-five engines flag this unsigned large installer, six of them major, several naming password-stealing or spyware behaviour, while no sandbox run showed benign activity to clear it.
Strong evidence · Two or more major antivirus engines agree.
If you already installed it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't installed it
Don't install this file. Delete it, then empty the Recycle Bin.
If you already installed it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
From another device you trust, change the passwords of your important accounts (email and banking first) and turn on two-step verification.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
14 of 68 flagged
- Flagged 14
- No detection 54
- No result 7
- Code signing Unsigned
- Test run Completed
- First seen 9d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This unsigned 101 MB installer, first seen on Nov 1, 2026, is flagged by 14 of the 68 antivirus engines that checked it, including six major ones whose labels point to password and spyware theft. No publisher signature, reference listing or clean sandbox run explains those detections away. Treat it as harmful and keep it off the machine.
Fourteen of the seventy-five antivirus engines flag this installer, and six of those are major antivirus engines: Avast and AVG report a file-reputation password-stealer detection, ESET-NOD32 a Generik trojan, Kaspersky an unknown dangerous object, Sophos a generic trojan, Symantec a generic trojan and Ikarus a trojan label. The labels are not identical, so they do not amount to a single confirmed family, but two of them (Malwarebytes and Gridinsoft) describe spyware or a stealer, and the other engines' wording is consistent with a harmful payload rather than an ordinary application. Nothing offsets that: the file carries no digital signature, the publisher has no history with us, and it is not listed in any known-good reference set. The two sandbox runs recorded no malicious verdict and no injected process or dropped file, but neither did they show anything reassuring — the activity stayed at the level of installers and system probing, and the file's own traits include long sleeps and debugger detection, which commonly stall automated analysis. With no clean signer, no reference listing, no clean execution record and detections spread across a dozen independent engines, the balance of the evidence supports treating this installer as harmful.
What We Detected
The antivirus engines reports 14 of the 68 antivirus engines that checked it flagging this file, and collapsing engines that share the same scan technology still leaves 12 independent products. The major group is Avast/AVG (a file-reputation detection tagged for password stealing), ESET-NOD32, Kaspersky, Sophos, Symantec and Ikarus. A second tier adds Malwarebytes, which names a stealer family, Gridinsoft, which labels it spyware, Google, Skyhigh and Varist.
The file is a large (about 101 MB) 64-bit Windows executable named like a product setup program. It is not digitally signed, the publisher has no history with us, and the executable itself is not packed — the sections show ordinary compression levels rather than an obfuscated packer.
Threat Behavior
Two sandbox runs are recorded. Neither returned a malicious result, and no process injection target, dropped file, registry change or persistence entry was captured.
The runtime therefore neither confirmed nor excluded a payload. What tips the balance is the breadth of engine agreement, the stealer and spyware wording from several vendors, and the complete absence of any trust anchor: no valid publisher signature, no known-good reference listing, and no record of the file being widely distributed over time. The two network destinations observed during analysis were ordinary background traffic of the analysis system, and the host reputation check found nothing malicious among the addresses that could be checked.
What To Do Now
Do not run this installer. Quarantine or delete it, and if it has already been executed, run a full scan with your security software kept fully enabled, review what was installed for unwanted programs, and change passwords for any accounts you typed into a window it opened. If you were expecting this program from a vendor, download it again directly from that vendor's official site rather than from a link or attachment that delivered this file.
Where this verdict could be wrong3 caveats
- Much of the detection set is generic wording (Mal/Generic-S, Trojan.Gen.MBT, Artemis, UDS:DangerousObject.Multi.Generic, Generik.KIQUEXR), which is the wording engines also use for bundled or unwanted installer payloads rather than confirmed malware.
- The two sandbox runs recorded no malicious result, no injected process and no dropped files, so no live stealing or download activity was demonstrated.
- No contacted host was found malicious and no reference database lists the hash, so nothing outside the engines independently identifies this installer as harmful.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No contacted host was found known-malicious in the addresses that could be checked
- The two sandbox runs produced no malicious result, no dropped files and no persistence entries
- The executable is not packed and no obfuscation wrapper was identified
- Flagged by fourteen antivirus engines, six of them major, with twelve independent products agreeing there is a problem
- Several detections name password-stealing or spyware behaviour rather than a generic packer or adware complaint
- The file carries no digital signature and its publisher has no history that would explain the detections
- Long sleeps, debugger detection and network-adapter probing are behaviours often used to delay or detect analysis
- It is a very large installer-like executable submitted by 34 different sources since Nov 1, 2026, with no established distribution history
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 8sandbox rule tags
- 2spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How password stealers work
A password stealer runs quietly in the background and copies your private data, such as saved passwords, browser cookies, autofill details and crypto wallets, then sends it to criminals. You usually won't notice anything.
Bottom line:Stolen logins are used to break into your accounts or sold in bulk, so change passwords from another device.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 3: FileSeen in the test run
Capri-Setup.exe
889a204f4d47f4af54ffd3ed6f8a42509164b18c4c79919c23fb89830ef75116
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 3: ProcessSeen in the test run
Capri-Setup.exe
"C:\Users\<USER>\Desktop\Capri-Setup.exe"
Test run - Evidence 3 of 3: ProcessSeen in the test run
Capri-Setup.exe
"C:\Users\user\Desktop\Capri-Setup.exe"
Test run - +1 more recorded observation
3 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1055· Process injection
- T1057· Lists programs
- T1082· System recon
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1548
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
Capri-Setup.exe"C:\Users\<USER>\Desktop\Capri-Setup.exe"Capri-Setup.exe"C:\Users\user\Desktop\Capri-Setup.exe"
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
atm.teams.mira.tm.svc.cloud.microsoft - VM host
assets.msn.com
Chapter 04
Technical details
14 of the 68 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- Avast (major engine)FileRepMalware [Pws]
- AVG (major engine)FileRepMalware [Pws]
- ESET-NOD32 (major engine)Generik.KIQUEXR trojan
- Ikarus (major engine)Trojan.JS.Agent
- Kaspersky (major engine)UDS:DangerousObject.Multi.Generic
- Sophos (major engine)Mal/Generic-S
- Symantec (major engine)Trojan.Gen.MBT
- GoogleDetected
File fingerprint
- Last analyzed
- Nov 8, 2026, 1:10 AM UTC
- SHA-256
889a204f4d47f4af54ffd3ed6f8a42509164b18c4c79919c23fb89830ef75116- SHA-1
06d1b5f109202a9284bdb4cb597b55da67257f88- MD5
19a9492cf84c605813b08dc6330a0807
About this file
Capri-Setup.exe says it is Capri (Companion), 101.8 MB.
- Claims to be
- Capri (Companion)From the file's own version information, written by whoever built it.
- Original name
- Capri-Setup.exeMatches the shared file name.
- Type and size
- Win32 EXE · 101.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 1, 2026On VirusTotal.
- Submitted by
- 34 distinct sources
- Packer
- None detected
- Entropy
- 6.29 of 8
First scanned
Antivirus consensus
14 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 14 detections come from 12 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines6flagged7 vendors sharing 6 engines
- Tier-234 engines5flagged
- Low-trust16 engines2flagged
View all 75 engine results
- AvastMalicious: FileRepMalware [Pws]
- AVGMalicious: FileRepMalware [Pws]
- ESET-NOD32Malicious: Generik.KIQUEXR trojan
- GoogleMalicious: Detected
- GridinsoftMalicious: Spy.Win64.Gen.bot
- IkarusMalicious: Trojan.JS.Agent
- KasperskyMalicious: UDS:DangerousObject.Multi.Generic
- MalwarebytesMalicious: Spyware.NWHStealer.Bun
- McAfeeDMalicious: ti!889A204F4D47
- RisingMalicious: Trojan.Kryptik@AI.85 (RDML:OtLJ52O50+uDb/jHfJAu7Q)
- SkyhighMalicious: Artemis
- SophosMalicious: Mal/Generic-S
- SymantecMalicious: Trojan.Gen.MBT
- VaristMalicious: W64/ABTrojan.SRIG-5608
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- Avast-MobileNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetNo result
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- F-SecureClean
- FortinetClean
- GDataClean
- huorongClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KingsoftClean
- LionicClean
- MaxSecureClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- SangforClean
- SentinelOneClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VBA32Clean
- VIPRENo result
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is Capri-Setup.exe a virus?
What is Capri-Setup.exe?
How many antivirus engines detected Capri-Setup.exe?
What should I do if I already installed Capri-Setup.exe?
How do I remove Capri-Setup.exe?
What kind of malware is Capri-Setup.exe?
What is the SHA-256 hash of Capri-Setup.exe?
How up to date is this analysis of Capri-Setup.exe?
Community
Member reviews and reports for this exact file hash.