File scan report
Verdict Safe
Is Readest_
None of the 65 antivirus engines that checked it flagged this installer, and its completed sandbox run produced no malicious verdict or independently attributable network activity.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Unsigned
- Test run Completed
- First seen 21d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 65 antivirus engines that checked it flagged the executable, including the reporting major antivirus engines. One sandbox run produced no malicious verdict, while its recorded contacts were identified as analysis-environment background traffic; however, the file is unsigned and four dropped components remain unclassified.
The strongest evidence is the complete absence of detections: none of the 65 antivirus engines that checked it flagged the file, and there is no named threat family. One completed sandbox run returned no malicious verdict, and the listed network contacts were attributed to the analysis environment rather than the sample. Static PE evidence found neither high-entropy code nor a recognized packer. is a cautionary behavior mapping, but it lacks corroboration from process injection, hostile network activity, malicious files it created, or antivirus detections. The unsigned signature state and recent first observation lower assurance, while the similar-file history is weak because every match is an import-table fingerprint-only installer-framework collision.
What We Detected
None of the 65 antivirus engines that checked it flagged the executable, and no engine supplied a malware-family label. Static PE analysis found no recognized packer, no likely packing, and no high-entropy code.
Threat Behavior
One completed sandbox run produced no malicious verdict. It mapped T1134, which can describe token manipulation, but there was no recorded process injection or other offensive behavior to corroborate abuse. All listed network contacts were identified as background traffic from the analysis environment, not sample-attributable communication. Four dropped installer components remain unclassified because no saved verdict exists for them.
What To Do Now
The evidence supports ordinary installer activity, but the executable has no verified publisher signature and was first observed on Oct 5, 2026. Obtain it from the project's official release channel, verify the SHA-256 value, and keep security software enabled while installing.
Where this verdict could be wrong3 caveats
- The executable is unsigned and recently observed, so its publisher identity cannot be authenticated.
- The token-manipulation mapping can be associated with privilege abuse, although no malicious sandbox verdict or supporting process-injection evidence was recorded.
- Four dropped files have no saved classification, leaving incomplete coverage of installer components.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the file.
- The completed sandbox run produced no malicious verdict.
- The recorded network contacts were analysis-environment background traffic rather than sample activity.
- The antivirus analysis found no packing or high-entropy code.
- No malicious file it created was identified.
- The executable is unsigned, so its publisher identity and integrity are not authenticated by a code-signing certificate.
- It was first observed on Oct 5, 2026, providing limited reputation history.
- The sandbox mapped token manipulation behavior, though it found no corroborating process injection.
- Four dropped installer components do not yet have saved classifications.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 19sandbox rule tags
- 1spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
19MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1036
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1497.001· Sandbox evasion
- T1529
- T1547.009· Auto-start
- T1553
- T1553.002
Observed activity
Processes started
1Programs the file ran, with their command lines.
software.exe"C:\Users\user\Desktop\software.exe"
Files
19Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nskD2B3.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsaD2C4.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsaD2C4.tmp\UserInfo.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsaD2C4.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsaD2C4.tmp\nsDialogs.dll - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches
Show all 19 entries for files
- Written
C:\Users\user\AppData\Local\Temp - Written
C:\Users\user\AppData\Local\Temp\ - Written
C:\Users\user\AppData\Local\Temp\nsm94DC.tmp - Written
C:\Users\user\AppData\Local\Temp\nsuC12D.tmp - Written
C:\Users\user\AppData\Local\Temp\nsuC17C.tmp - Written
C:\Users\user\AppData\Local\Temp\nsuC17C.tmp\System.dll - Written
C:\Users\user\AppData\Local\Temp\nsuC17C.tmp\UserInfo.dll - Written
C:\Users\user\AppData\Local\Temp\nsuC17C.tmp\modern-wizard.bmp - Written
C:\Users\user\AppData\Local\Temp\nsuC17C.tmp\nsDialogs.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nskD0DE.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsaD2C4.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsm94DC.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsuC17C.tmp
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM host
atm.teams.mira.tm.svc.cloud.microsoft - VM host
assets.msn.com - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- e0dc3112796dbaa37f25…a3677bNot checkedno saved verdict
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 10, 2026, 10:42 AM UTC
- SHA-256
ad534a31239b651342a484e1af2c9d1038644143f26ca9eb3891a7d94b15a6c5- SHA-1
18053be60aad983963e814ec99359bb2e9f77a6a- MD5
db09621166fdd6da8c175fd2d4a90bcf
About this file
Readest_0.12.12_x64-setup.exe is a Win32 EXE file of 57.9 MB.
- Type and size
- Win32 EXE · 57.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 5, 2026On VirusTotal.
- Submitted by
- 43 distinct sources
- Packer
- None detected
- Entropy
- 6.05 of 8
First scanned
Antivirus consensus
0 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-115 engines0flagged
- Tier-234 engines0flagged
- Low-trust16 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetNo result
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Readest_0.12.12_x64-setup.exe safe?
What is Readest_0.12.12_x64-setup.exe?
How many antivirus engines detected Readest_0.12.12_x64-setup.exe?
What is the SHA-256 hash of Readest_0.12.12_x64-setup.exe?
Is it safe to install Readest_0.12.12_x64-setup.exe?
How up to date is this analysis of Readest_0.12.12_x64-setup.exe?
Community
Member reviews and reports for this exact file hash.