File scan report
Verdict Safe
Is Updater
Signed installer with zero engine detections and no malicious files it created or host contacts.
Strong evidence · A verified publisher signature, and no engine flags it.
The file shows strong clean signals; it can be considered safe when obtained from a trusted source.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing BrowseAI LLC
- Test run Completed
- First seen 5mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 71 antivirus engines that checked it returned clean. The file is signed by BrowseAI LLC and shows typical installer behaviour with no malicious sandbox verdict or known-bad network activity.
Zero detections across 75 reporting engines, including 17 major antivirus engines, eliminates the less reliable-only false-positive pattern. Signing is verified, though the publisher lacks prior history in our records. Sandbox execution produced three MITRE techniques commonly associated with installers, yet no malicious verdict was recorded and all files it created and no complete contacted-host reputation result was available. Medium prevalence over 99 days further supports a legitimate distribution channel.
What We Detected
75 antivirus engines scanned the 12 MB Win32 executable; none flagged it malicious. The binary is signed by BrowseAI LLC with a valid certificate dated May 2026.
Threat Behavior
The sample wrote ten temporary files under an Edge WebView cache folder and contacted six IP addresses, none of which appear in our malicious-host cache. No persistence mechanisms or registry modifications were observed. All ten files it created returned unknown verdicts with zero malicious detections.
What To Do Now
Keep Windows Defender and other security software enabled. If the file was obtained from the official BrowseAI distribution channel, it can be executed; otherwise treat any unexpected installer with standard caution.
Where this verdict could be wrong2 caveats
- This signer has no saved history — no historical samples for 'BrowseAI LLC' to establish reputation baseline.
- triggeredHeuristics: one of our behaviour rules (high) and one of our behaviour rules (medium) — static mapping to and direct-IP traffic without domain names.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero detections from 75 engines including 17 major antivirus engines
- Verified digital signature present
- No malicious files it created or known-bad hosts contacted
- Medium prevalence across 99 sources over 99 days
- No prior samples from signer 'BrowseAI LLC' in our database
- Direct-IP network traffic without domain names recorded
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 5spawned processes
- 9network contacts
- 31filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
17MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1202
- T1485
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1562· Disables security
- T1562.001· Disables security
- T1573
- T1574· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\Desktop\file.exe"msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=file.exe --webview-exe-version=143.0.7518.0 --user-data-dir="C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5484.5196.8125993391324254060msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=…msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=file.exe --webview-exe-version=143.0.7518.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-appcompat-clear --mojo-platform-channel-handle=3576 --field-trial-handle=2144,i,8625853374249717288,16920617554480891004,262144 --enable-features=MojoIpcz --varia…file.exe"C:\Users\user\Desktop\file.exe"
Network contacts
99 hosts, listed as 5 addresses, 5 links. Links show the host and path only.
- IP address
104.20.31.107 - IP address
34.8.74.205 - IP address
74.125.201.93 - IP address
172.66.160.227 - IP address
150.171.28.11 - URL
https://browser.ace.ai/analytics
Show all 10 entries for network contacts
- URL
https://update.ace.ai/ace/service/update2/json/1bbcc4da-6f26-11f1-aed5-46fe01f82bec@1bbcc4da-6f26-11f1-9bbb-3c819ea922a0@softonic_cnet@ - URL
https://dl.google.com/update2/installers/icons/%7B908aaf3d-6daa-4f36-a9b0-538d90bec8c1%7D.bmp - URL
https://media.ace.ai/media/versions/ace/mini_installer___ACE-update-148-0-7781-0___x64___20260622073732.crx3 - URL
https://browser.ace.ai/attr_hit
Files
29Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Crashpad\throttle_store.dat - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Crashpad\settings.dat - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\BrowserMetrics\BrowserMetrics-6A3ABD85-1780.pma - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\lockfile - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Variations - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\920360d5-1c75-4272-891d-d60e2395674f.tmp
Show all 29 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Local State - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\ShaderCache\index - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\ShaderCache\data_0 - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\ShaderCache\data_1 - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\ShaderCache\data_2 - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\ShaderCache\data_3 - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Last Version - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\README - Written
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Visited Links - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\BrowserMetrics-spare.pma - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Code Cache\js\index-dir\the-real-index - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Site Characteristics Database\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Code Cache\js\index-dir\temp-index - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Extension Scripts\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\shared_proto_db\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\BrowserMetrics\BrowserMetrics-6A3ABD85-1780.pma - Deleted
C:\Users\<USER>\AppData\Local\Temp\edge_BITS_6016_1725206514\86061e48-63b3-483f-8dac-609df0cbb238 - Deleted
C:\Users\<USER>\AppData\Local\Temp\edge_BITS_6016_1725206514 - Deleted
C:\Users\<USER>\AppData\Local\Temp\chrome_Unpacker_BeginUnzipping6016_1700898788 - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Session Storage\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
Local\ChromeProcessSingletonStartup!__OMADM_NAMED_MUTEX__
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache. 6 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 872727f89f2263f46d57…6e700dNot checkedno saved verdict
- 8f35d048504185d9e1ef…7aff15Not checkedno saved verdict
- 4cdf5eb12966a561f2ee…2e8952Not checkedno saved verdict
- 8e57cffd04fb5f4add47…5be923Not checkedno saved verdict
- bfe3cc4b56da9d434252…f58c5fNot checkedno saved verdict
- 6ab9a0f330c611cefdd6…1fb29aNot checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by BrowseAI LLC.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 4, 2026, 2:57 PM UTC
- SHA-256
950fe10a0eb1e7531e2814500b83bc1767dcb08e5e67d7d8c370391992f55338- SHA-1
bcc0578315fc7b842cd7016d25c35d56af1d814d- MD5
b5efc262e5020c7fc8fe35efb3f3b38c
About this file
UpdaterSetup.exe is a Win32 EXE file of 12.2 MB.
- Type and size
- Win32 EXE · 12.2 MB
- Signer
- BrowseAI LLCValid code signature.
- First seen
- May 28, 2026On VirusTotal.
- Submitted by
- 99 distinct sources
- Packer
- None detected
- Entropy
- 5.13 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is UpdaterSetup.exe safe?
What is UpdaterSetup.exe?
How many antivirus engines detected UpdaterSetup.exe?
Is UpdaterSetup.exe digitally signed?
What is the SHA-256 hash of UpdaterSetup.exe?
Is it safe to run UpdaterSetup.exe?
How up to date is this analysis of UpdaterSetup.exe?
Community
Member reviews and reports for this exact file hash.