File scan report
Verdict Safe
Is setup.
Only 1 of the 70 antivirus engines that checked it raised a generic grayware alert, while runtime results, host checks, and major antivirus engines supplied no corroborating…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 8y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
CrowdStrike alone raised a generic grayware alert; none of the other 75 engines flagged the file, including the major engines represented. The combined runtime result was clean, no high-risk technique was corroborated, and all recorded contacts were analysis-environment background traffic with no harmful host reputation.
Only 1 of the 70 antivirus engines that checked it flagged the executable, and that result was a generic grayware assessment rather than a named malware family. The major engines did not detect it, and the combined sandbox verdict was clean. No named process-injection target or other high-risk runtime technique was recorded; the mapping lacked the artifact needed to establish injection. All recorded contacts were identified as analysis-environment background traffic, and the complete host check found no harmful or questionable destinations. The file is unsigned and our static analysis was unavailable, but those limitations do not outweigh the broad lack of corroboration for the lone detection.
What We Detected
CrowdStrike was the only engine to flag the executable, using a generic grayware label. None of the other 75 engines flagged it, including the major antivirus engines represented, and no engine consensus identified a malware family.
Threat Behavior
The combined sandbox verdict was clean. Every recorded network contact was identified as analysis-environment background traffic, and the complete reputation check found no harmful or questionable host.
What To Do Now
The available evidence indicates that the isolated grayware alert is probably a false positive. Keep security software enabled, obtain installers from their expected source, and rescan if the file changes or additional engines begin detecting it.
Where this verdict could be wrong3 caveats
- CrowdStrike labels the file as grayware with 90% confidence, although no other engine corroborates that generic assessment.
- The executable is unsigned, so there is no verified publisher identity to anchor the benign interpretation.
- Our static analysis was unavailable because the bytes were not uploaded, so the installer contents were not independently examined.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines represented flagged the file.
- The combined sandbox verdict was clean and recorded no corroborated high-risk technique.
- No named process-injection target was recorded.
- The complete reputation check found no harmful or questionable contacted host.
- No malware-specific community rule, public malware-sample listing, or harmful file it created corroborated the alert.
- CrowdStrike issued a generic grayware alert with 90% confidence.
- The executable has no verified publisher signature.
- The installer contents were not independently examined by our static analysis.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 8 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 8isolated sandbox runs
- 16sandbox rule tags
- 14spawned processes
- 2network contacts
- 40filesystem & mutex artifacts
Includes the sandbox verdicts, 16 mapped techniques, every process, file, registry and network entry and 3 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- CrowdStrikewin/grayware_confidence_90% (W)
File fingerprint
- Last analyzed
- Oct 29, 2026, 8:09 AM UTC
- SHA-256
d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697- SHA-1
3d3c431084af36b32ff437f7c447521e6ef7fe6c- MD5
2390502dd1def546efa58698de188a3d
About this file
setup.exe says it is Warcraft 3 The Frozen Throne v1.29 Setup (Warcraft 3 The Frozen Throne v1.29), 352.6 kB.
- Claims to be
- Warcraft 3 The Frozen Throne v1.29 Setup (Warcraft 3 The Frozen Throne v1.29)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 352.6 kB
- Signer
- UnsignedNo code signature.
- First seen
- May 16, 2018On VirusTotal.
- Submitted by
- 71 distinct sources
- Packer
- None detected
- Entropy
- 6.31 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe?
What is setup.exe?
How many antivirus engines detected setup.exe?
What is the SHA-256 hash of setup.exe?
Is it safe to install setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.