File scan report
Verdict Suspicious
Is setup_
Three of the 70 antivirus engines that checked it flagged this unsigned crack-related installer, while conflicting sandbox results and broad prevalence leave its actual intent…
Read the whole reasonShow less
Why Suspicious? 3 antivirus engines flag it, but no major engine agrees and one sandbox test run rated it malicious while another found nothing.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
3 of 70 flagged
- Flagged 3
- No detection 67
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 11mo ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Three of the 70 antivirus engines that checked it flagged the installer, including one crack-riskware label, and one sandbox result called it malware. However, another sandbox result was clean, major antivirus engines remained silent, and no concrete injection target, malicious child, or hostile contact was identified.
The antivirus evidence is limited but meaningful: three of the 70 antivirus engines that checked it flagged the file, with Malwarebytes identifying crack-related riskware and two engines returning generic labels. None of the major antivirus engines flagged it, and there is no agreement on a real malware family. The executable is unsigned and installs crack-related game content, which provides no publisher assurance and increases practical risk. Conversely, 892 submitters, no identified malicious child, and no hostile contact prevent the available evidence from supporting a definitive malware conclusion.
What We Detected
Three of the 70 antivirus engines that checked it flagged the executable. Malwarebytes labeled it crack-related riskware, while Paloalto and VBA32 returned generic detections; none of the major antivirus engines flagged it, and no real malware family was consistently identified.
Threat Behavior
The sandbox evidence was divided: one result reported malware and another reported clean. The observed contacts were analysis-system background traffic, and the completed reputation check found no hostile host among them. No inspected child was identified as harmful.
What To Do Now
Avoid running this unsigned crack-related installer on a production or personal system. Obtain the game or update from its official distribution channel, keep security software enabled, and remove this copy if its origin cannot be verified.
Where this verdict could be wrong2 caveats
- The file has broad, established prevalence across 892 submitters, which makes an undiscovered conventional trojan less likely.
- None of the 18 major antivirus engines flagged it, and the three detections do not agree on a real malware family.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 major antivirus engines that reported results flagged the file.
- The file has been submitted by 892 distinct sources since it was first seen on Nov 29, 2025.
- No inspected child was identified as harmful.
- The completed host-reputation check found no malicious or suspicious host among all observed contacts.
- The antivirus analysis found no packer or unusually high-entropy code.
- The executable is unsigned, so there is no verified publisher identity.
- Three antivirus engines flagged it, including one crack-related riskware detection.
- One sandbox result reported malware, although another reported clean.
- The installer wrote files associated with a game crack or online-fix package.
- Four files with the same import-table fingerprint previously received harmful assessments, though that fingerprint can be shared by unrelated installers.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 23sandbox rule tags
- 10spawned processes
- 0network contacts
- 39filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
setup_win10_11.exe
a3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
executable.exe
"C:\Users\<USER>\Desktop\executable.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
executable.tmp
"C:\Users\<USER>\AppData\Local\Temp\is-AS09U.tmp\executable.tmp" /SL5="$E003C,6255288,140800,C:\Users\<USER>\Desktop\executable.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
readme.txt
C:\Games\Euro Truck Simulator 2\NoDVD\Online Fix\readme.txt
Test run - Evidence 5 of 5: Written fileSeen in the test run
executable.tmp
C:\Users\<USER>\AppData\Local\Temp\is-AS09U.tmp\executable.tmp
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 7 sandboxes and the results were split: 1 returned "malicious" and 1 returned "clean".
Sandbox verdicts
2- VT: MALWAREmalicious
- VT: CLEANclean
Techniques observed in the sandbox
23MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1045
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1063
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1134
- T1485
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1529
- T1548
- T1614
- T1614.001
Observed activity
Processes started
10Programs the file ran, with their command lines.
executable.exe"C:\Users\<USER>\Desktop\executable.exe"executable.tmp"C:\Users\<USER>\AppData\Local\Temp\is-AS09U.tmp\executable.tmp" /SL5="$E003C,6255288,140800,C:\Users\<USER>\Desktop\executable.exe"FlushFileCache.exe"C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\FlushFileCache.exe"a3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180.exeC:\Users\<USER>\AppData\Local\Temp\is-3HGJA.tmp\a3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180.tmp /SL5=$60146,6255288,140800,C:\Users\<USER>\Downloads\a3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180.exea3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180.exeC:\Users\<USER>\AppData\Local\Temp\is-Q1DC0.tmp\a3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180.tmp /SL5=$2016E,6255288,140800,C:\Users\<USER>\Downloads\a3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180.exesetup_win10_11.exe"C:\Users\user\Desktop\setup_win10_11.exe"
Show all 10 entries for processes started
setup_win10_11.tmp"C:\Users\user\AppData\Local\Temp\is-19LBU.tmp\setup_win10_11.tmp" /SL5="$20434,6255288,140800,C:\Users\user\Desktop\setup_win10_11.exe"FlushFileCache.exe"C:\Users\user\AppData\Local\Temp\is-QGBTL.tmp\FlushFileCache.exe"software.exe"C:\Users\user\Desktop\software.exe"software.tmp"C:\Users\user\AppData\Local\Temp\is-JD4O2.tmp\software.tmp" /SL5="$40474,6255288,140800,C:\Users\user\Desktop\software.exe"
Files
29Files the file created, changed or deleted.
- Written
C:\Games\Euro Truck Simulator 2\NoDVD\Online Fix\readme.txt - Written
C:\Users\<USER>\AppData\Local\Temp\is-AS09U.tmp\executable.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\_isetup\_setup64.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\_isetup\_shfoldr.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\idp.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\innocallback.dll
Show all 29 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\ISDone.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\wintb.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\BASS.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\cls-lollypop.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\cls-lollypop_x64.exe - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\cls-lollypop_x86.exe - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\cls-srep_x64.exe - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\cls-srep_x86.exe - Written
C:\Users\<USER>\AppData\Local\Temp\is-QNMFD.tmp\cls-magic2.dll - Deleted
C:\Games\Euro Truck Simulator 2\is-7MU6E.tmp - Deleted
C:\Games\Euro Truck Simulator 2\_Redist\is-GUG7S.tmp - Deleted
C:\Games\Euro Truck Simulator 2\_Redist\is-6JBMA.tmp - Deleted
C:\Games\Euro Truck Simulator 2\_Redist\is-KM32N.tmp - Deleted
C:\Games\Euro Truck Simulator 2\_Redist\is-QK6M2.tmp - Deleted
C:\Games\Euro Truck Simulator 2\NoDVD\Online Fix\is-DQA12.tmp - Deleted
C:\Users\Public\Desktop\Euro Truck Simulator 2.lnk - Deleted
C:\Users\Public\Desktop\Euro Truck Simulator 2.pif - Deleted
C:\Users\Public\Desktop\Euro Truck Simulator 2.url - Deleted
C:\Users\Public\Desktop\ETS2 OpenGL.lnk - Deleted
C:\Users\Public\Desktop\ETS2 OpenGL.pif - Deleted
C:\Users\Public\Desktop\ETS2 OpenGL.url - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Owner - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\RestartManager\Session0000\SessionHash - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Games\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Games\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\Inno Setup: Setup Version - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\Inno Setup: App Path - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\InstallLocation - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\Inno Setup: Icon Group - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\Inno Setup: No Icons - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\Inno Setup: User - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\Inno Setup: Setup Type - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Euro Truck Simulator 2_is1\Inno Setup: Selected Components
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\DirectSound DllMain mutex (0x000016D4)cversions.3.m\BaseNamedObjects\Local\SM0:984:304:WilStaging_02\BaseNamedObjects\Local\SM0:984:120:WilError_03\BaseNamedObjects\Local\ZonesCacheCounterMutex\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x0000183C)\Sessions\1\BaseNamedObjects\DirectSound Administrator shared thread array (lock
Sandbox background — not the file
8The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM host
windows.msn.com-ion.edgesuite.net
Show all 8 entries for sandbox background — not the file
- VM host
a1672.dscr.akamai.net - VM host
nexusrules.officeapps.live.com
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 9884e9d1b4f8a873ccbd…360d87Cleantrust 85known-software reference set · not scanned here
- f4fc0187491a9cb89e23…bc44bbNot checkedno saved verdict
- df9f56c4da160101567b…8acf15Not checkedno saved verdict
- 39c965edc8f577695dad…e470c7Not checkedno saved verdict
- 68f42a7823ed7ee88a5c…aa172dCleantrust 85known-software reference set · not scanned here
- a4cc6683393795f7b84d…ffe0b8Not checkedno saved verdict
- bb8a0245dcc5c10a1c71…38ac71Not checkedno saved verdict
- 450b9b0ba25bf068afbc…fd0105Not checkedno saved verdict
- f84677643d9977aa1e8a…61f824Not checkedno saved verdict
- 2d32c4f4522bc62f63c7…8b1aa8Not checkedno saved verdict
Chapter 04
Technical details
3 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 3
- MalwarebytesRiskWare.Crack
- Paloaltogeneric.ml
- VBA32Trojan.Win32.Generic
File fingerprint
- Last analyzed
- Nov 6, 2026, 3:38 PM UTC
- SHA-256
a3c8915985d2a2d42ee6e2a736bed77d9d8aff115b3e9c9af80b7aa4c5dcf180- SHA-1
cfd4a198c92bc21c03896907327f33029ed6e9b4- MD5
ff5eeed16cd5a2a876927bd229e084a4
About this file
setup_win10_11.exe says it is Euro Truck Simulator 2 Setup (Euro Truck Simulator 2), 6.9 MB.
- Claims to be
- Euro Truck Simulator 2 Setup (Euro Truck Simulator 2)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 6.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 29, 2025On VirusTotal.
- Submitted by
- 892 distinct sources
- Packer
- None detected
- Entropy
- 5.55 of 8
First scanned
Antivirus consensus
3 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines1flagged
- Low-trust17 engines2flagged
View all 75 engine results
- MalwarebytesMalicious: RiskWare.Crack
- PaloaltoMalicious: generic.ml
- VBA32Malicious: Trojan.Win32.Generic
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup_win10_11.exe safe, or is it malware?
What is setup_win10_11.exe?
How many antivirus engines detected setup_win10_11.exe?
What should I do if I already installed setup_win10_11.exe?
What is the SHA-256 hash of setup_win10_11.exe?
How up to date is this analysis of setup_win10_11.exe?
Community
Member reviews and reports for this exact file hash.