File scan report
Verdict Safe
Is setup.
Only 1 of the 70 antivirus engines that checked it raised a generic grayware alert, while runtime results, host checks, and major antivirus engines supplied no corroborating…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 8y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
CrowdStrike alone raised a generic grayware alert; none of the other 75 engines flagged the file, including the major engines represented. The combined runtime result was clean, no high-risk technique was corroborated, and all recorded contacts were analysis-environment background traffic with no harmful host reputation.
Only 1 of the 70 antivirus engines that checked it flagged the executable, and that result was a generic grayware assessment rather than a named malware family. The major engines did not detect it, and the combined sandbox verdict was clean. No named process-injection target or other high-risk runtime technique was recorded; the mapping lacked the artifact needed to establish injection. All recorded contacts were identified as analysis-environment background traffic, and the complete host check found no harmful or questionable destinations. The file is unsigned and our static analysis was unavailable, but those limitations do not outweigh the broad lack of corroboration for the lone detection.
What We Detected
CrowdStrike was the only engine to flag the executable, using a generic grayware label. None of the other 75 engines flagged it, including the major antivirus engines represented, and no engine consensus identified a malware family.
Threat Behavior
The combined sandbox verdict was clean. Every recorded network contact was identified as analysis-environment background traffic, and the complete reputation check found no harmful or questionable host.
What To Do Now
The available evidence indicates that the isolated grayware alert is probably a false positive. Keep security software enabled, obtain installers from their expected source, and rescan if the file changes or additional engines begin detecting it.
Where this verdict could be wrong3 caveats
- CrowdStrike labels the file as grayware with 90% confidence, although no other engine corroborates that generic assessment.
- The executable is unsigned, so there is no verified publisher identity to anchor the benign interpretation.
- Our static analysis was unavailable because the bytes were not uploaded, so the installer contents were not independently examined.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines represented flagged the file.
- The combined sandbox verdict was clean and recorded no corroborated high-risk technique.
- No named process-injection target was recorded.
- The complete reputation check found no harmful or questionable contacted host.
- No malware-specific community rule, public malware-sample listing, or harmful file it created corroborated the alert.
- CrowdStrike issued a generic grayware alert with 90% confidence.
- The executable has no verified publisher signature.
- The installer contents were not independently examined by our static analysis.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 8 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 8isolated sandbox runs
- 16sandbox rule tags
- 14spawned processes
- 2network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was detonated in 8 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1134
- T1140· Deobfuscation
- T1529
- T1614
- T1614.001
Observed activity
Processes started
14Programs the file ran, with their command lines.
executable.exe"C:\Users\<USER>\AppData\Local\Temp\executable.exe"executable.tmp"C:\Users\<USER>\AppData\Local\Temp\is-CCJ3K.tmp\executable.tmp" /SL5="$20194,75264,0,C:\Users\<USER>\AppData\Local\Temp\executable.exe"d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.exe%SAMPLEPATH%\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.exed4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-VG2EE.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-L6UHD.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-FJ6B8.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp
Show all 14 entries for processes started
d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-V7HQV.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-4R0SO.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-VVPHS.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-PCGSV.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-61CQE.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp%USERPROFILE%\AppData\Local\Temp\is-CTS6M.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpd4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmpC:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is-U3UAP.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp" /SL5="$0d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.exeC:\Users\<USER>\AppData\Local\Temp\is-B309D.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp /SL5=$1F0120,75264,0,C:\Users\<USER>\Downloads\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.exe
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
23.40.197.184 - IP address
23.219.78.68
Files
30Files the file created, changed or deleted.
- Written
C:\Program Files (x86)\Warcraft 3\unins000.exe - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\is-0M7AP.tmp\996E.tmp - Written
C:\Program Files\Warcraft 3\is-J61BA.tmp - Written
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is-U3UAP.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-B309D.tmp\d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-21D77.tmp\_isetup\_setup64.tmp
Show all 30 entries for files
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Program Files (x86)\Warcraft 3 - Written
C:\Program Files (x86)\Warcraft 3\is-0V1NA.tmp - Written
C:\Program Files (x86)\Warcraft 3\is-ULL7G.tmp - Written
C:\Program Files (x86)\Warcraft 3\unins000.dat - Written
C:\Users\user\AppData\Local\Programs - Written
C:\Users\user\AppData\Local\Programs\Common - Written
C:\Users\user\AppData\Local\Temp\is-725GN.tmp - Written
C:\Users\user\AppData\Local\Temp\is-725GN.tmp\file.tmp - Deleted
C:\Program Files (x86)\Warcraft 3\is-N1CU2.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER16CF.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER178A.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER17BA.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EEA.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EFC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EFD.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB79.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC92.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERECC2.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE27.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE38.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE48.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER838.tmp.WERInternalMetadata.xml
Registry and auto-start
11Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash - Set
Software\Microsoft\RestartManager\Session0000\Owner
Show all 11 entries for registry and auto-start
- Set
Software\Microsoft\RestartManager\Session0000\SessionHash - Set
Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\A70D59A1-8EAD-4F40-AAAB-FBFC460800A4\FriendlyName - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000oleacc-msaa-loadedCTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500MSCTF.Shared.MUTEX.EBH
Sandbox background — not the file
23The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google2224_246583689\bin\updater.exe - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
a83f:8110:0:0:9902:0:0:0
Show all 23 entries for sandbox background — not the file
- VM host
23.216.147.76 - VM host
a83f:8110:eecc:91ff:eccb:93ff:eccb:93ff - VM host
20.99.132.105 - VM host
20.99.185.48 - VM host
20.99.184.37 - VM host
192.229.211.108 - VM host
23.216.147.64 - VM host
20.99.186.246 - VM host
a83f:8110:1818:18ff:1818:18ff:1818:18ff - VM host
192.168.0.71 - VM host
151.101.22.172 - VM host
20.99.133.109 - VM host
23.216.81.152 - VM host
23.198.171.50 - VM host
192.168.0.10 - VM host
a83f:8110:126:127:128:e2:e3:17b - VM host
192.168.0.43
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 12567d9611caa4ca7453…606277Not checkedno saved verdict
- 5a1f203715e057354d2e…0036daNot checkedno saved verdict
- e83f9badcd1357fa5918…5afccfNot checkedno saved verdict
Chapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- CrowdStrikewin/grayware_confidence_90% (W)
File fingerprint
- Last analyzed
- Oct 29, 2026, 8:09 AM UTC
- SHA-256
d4ad30377f9e11a5fa17843a35e5447682bd4c900968aeac0561481646c25697- SHA-1
3d3c431084af36b32ff437f7c447521e6ef7fe6c- MD5
2390502dd1def546efa58698de188a3d
About this file
setup.exe says it is Warcraft 3 The Frozen Throne v1.29 Setup (Warcraft 3 The Frozen Throne v1.29), 352.6 kB.
- Claims to be
- Warcraft 3 The Frozen Throne v1.29 Setup (Warcraft 3 The Frozen Throne v1.29)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 352.6 kB
- Signer
- UnsignedNo code signature.
- First seen
- May 16, 2018On VirusTotal.
- Submitted by
- 71 distinct sources
- Packer
- None detected
- Entropy
- 6.31 of 8
First scanned
Antivirus consensus
1 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines1flagged
- Low-trust17 engines0flagged
View all 75 engine results
- CrowdStrikeMalicious: win/grayware_confidence_90% (W)
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe?
What is setup.exe?
How many antivirus engines detected setup.exe?
What is the SHA-256 hash of setup.exe?
Is it safe to install setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.