File scan report
Verdict Safe
Is setup.
None of the 60 antivirus engines that checked it flag this long-circulating unsigned Inno Setup installer, and its sandbox activity shows ordinary installer unpacking with no…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Use this installer only if it came from the software's official source, and keep your security software enabled during installation.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 16
- Code signing Unsigned
- Test run Completed
- First seen 6y ago
Chapter 02
Why we think so
2 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This unsigned installer has circulated since 2020 among 140 submitters, and none of the 60 antivirus engines that checked it flag it. The sandbox runs show a typical Inno Setup unpacking sequence with helper DLLs and no injection targets or persistence. It carries no publisher signature, so download it only from the software's official source.
None of the 60 antivirus engines that checked it flagged the file, including 13 major antivirus engines that returned clean results. It has been seen for more than six years by 140 distinct submitters, which is a strong sign of established software rather than a fresh threat. Activity in the test run matches an Inno Setup installer: temporary launcher processes and standard skin and extraction helper libraries, with no named injection target and no persistence recorded. The direct IP connections largely fall in cloud and content-delivery ranges, many of them background traffic of the analysis machine, though no complete host-reputation result is available. The lack of a code signature is the main weakness, keeping confidence moderate.
What We Detected
None of the 60 antivirus engines that checked it flagged this installer; 13 major antivirus engines such as ESET-NOD32, Avira, DrWeb and Fortinet reported it clean. The file is unsigned and has been circulating since March 2020 among 140 submitters.
Threat Behavior
The sandbox runs show an Inno Setup installer extracting itself to a temporary folder and loading common installer helper libraries for skins and archive extraction. No process injection target, persistence entry or high-risk technique was recorded. Some direct IP connections were observed, most matching the analysis machine's background traffic; no complete reputation check of those hosts is available.
What To Do Now
If you obtained this installer from the software's official website or a trusted distributor, it can be used normally. Because it is unsigned, avoid copies from unofficial download sites and keep your antivirus protection enabled while installing.
Where this verdict could be wrong3 caveats
- The installer is unsigned, so there is no publisher identity confirming who built it.
- The sandbox recorded direct connections to several IP addresses without a domain, and no complete host-reputation result is available for them.
- Other installers built with the same framework have previously drawn mixed results, including one bundled game-hack tool.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 60 antivirus engines that checked it flag the file.
- Seen by 140 distinct submitters over more than six years without detections.
- Sandbox activity matches a standard Inno Setup installer with no high-risk techniques or injection targets.
- The installer carries no digital signature identifying its publisher.
- Direct connections to IP addresses without a domain were recorded, with no complete reputation check of those hosts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 13spawned processes
- 7network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
17MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1129· Loads modules
- T1134
- T1140· Deobfuscation
- T1529
- T1614
- T1614.001
Observed activity
Processes started
13Programs the file ran, with their command lines.
program.exe"C:\Users\<USER>\AppData\Local\Temp\program.exe"program.tmp"C:\Users\<USER>\AppData\Local\Temp\is-B6J6P.tmp\program.tmp" /SL5="$2019C,3138322,168448,C:\Users\<USER>\AppData\Local\Temp\program.exe"a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.exe%SAMPLEPATH%\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.exea76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-VF7K1.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-P8P9N.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-ENRBC.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp
Show all 13 entries for processes started
a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-BK9QQ.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-C7652.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-049M7.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-SQTBF.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-I1MEN.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-UG2HC.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmpa76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp%USERPROFILE%\AppData\Local\Temp\is-KGNTG.tmp\a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644.tmp
Network contacts
77 hosts, listed as 7 addresses. Links show the host and path only.
- IP address
168.62.240.75 - IP address
168.62.242.76 - IP address
104.99.238.82 - IP address
104.86.182.8 - IP address
23.34.172.72 - IP address
20.22.113.133
Show all 7 entries for network contacts
- IP address
23.62.209.152
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-TC91V.tmp\_isetup\_shfoldr.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-TC91V.tmp\b2p.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-TC91V.tmp\isskin.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-TC91V.tmp\ISDone.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-TC91V.tmp\CallbackCtrl.dll - Written
C:\Users\<USER>\AppData\Local\Temp\is-TC91V.tmp\botva2.dll
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\is-D76SS.tmp\setup.tmp - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-5KBC5.tmp\996E.tmp - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-DIBAI.tmp\_isetup\_shfoldr.dll - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-DIBAI.tmp\ISDone.dll - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-DIBAI.tmp\isskin.dll - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-DIBAI.tmp\b2p.dll - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-DIBAI.tmp\botva2.dll - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-DIBAI.tmp\CallbackCtrl.dll - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-4CG4I.tmp\996E.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCC3.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDDCD.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE5A.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER29AB.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER29BC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER29CD.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1392.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER13A3.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14CB.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14CC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER151C.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER151B.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER896.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A8.tmp.csv
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500MSCTF.Shared.MUTEX.EBHMSCTF.Shared.MUTEX.EBK
Sandbox background — not the file
15The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
updater.exeC:\Program Files (x86)\Google2772_1584908513\bin\updater.exe - VM host
a83f:8110:3845:33c9:4883:4424:6802:488d - VM host
a83f:8110:2800:1800:4000:1800:1800:100 - VM host
23.216.147.76 - VM host
20.62.24.77
Show all 15 entries for sandbox background — not the file
- VM host
192.229.211.108 - VM host
20.99.133.109 - VM host
20.99.186.246 - VM host
20.99.184.37 - VM host
20.69.140.28 - VM host
192.168.0.129 - VM host
23.216.81.152 - VM host
23.198.171.50 - VM host
a83f:8110:8dd6:ffff:3073:9b62:8dd6:ffff
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 450b9b0ba25bf068afbc…fd0105Not checkedno saved verdict
- 9884e9d1b4f8a873ccbd…360d87Not checkedno saved verdict
- 89ff2808ec92b072f347…e8398eNot checkedno saved verdict
- 68f42a7823ed7ee88a5c…aa172dNot checkedno saved verdict
- bb8a0245dcc5c10a1c71…38ac71Not checkedno saved verdict
- a9f575ef25f9d66a1b2c…5b6d99Not checkedno saved verdict
- 25fdb94e386f8a41f10a…2b0a68Not checkedno saved verdict
- a4c86fc4836ac728d7bd…95fd81Not checkedno saved verdict
- 220ad5116fb05c9db453…4b4d2bNot checkedno saved verdict
- 693d652499e721e8f381…fd1004Not checkedno saved verdict
Chapter 04
Technical details
None of the 60 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 5, 2026, 12:09 AM UTC
- SHA-256
a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644- SHA-1
163bb594ea08fae109dfe8e9f5c3bef709835d0b- MD5
546b74f37ec92a6275e9489bb9caefbd
About this file
setup.exe is a Win32 EXE file of 3.8 MB.
- Type and size
- Win32 EXE · 3.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 8, 2020On VirusTotal.
- Submitted by
- 140 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 60 engines flagged this file
16 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-113 engines0flagged
- Tier-231 engines0flagged
- Low-trust16 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BaiduClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealNo result
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureNo result
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristNo result
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe?
What is setup.exe?
How many antivirus engines detected setup.exe?
What is the SHA-256 hash of setup.exe?
Is it safe to install setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.