Is MacroGamer_v275_Setup.msi safe? Yes, no threats found.

What We Detected

This is a Windows Installer package for MacroGamer, a small keyboard-macro utility, first seen on May 23, 2020. None of the 62 antivirus engines that checked it flagged it, including all 18 of the highest-trust engines we track, and no engine returned a suspicious result either. The package is not digitally signed, which is common for small independent Windows utilities but does mean nothing cryptographically ties it to a publisher.

Threat Behavior

Five sandbox runs were recorded and the combined verdict for them is clean. The package behaves like a normal installer: it launches the standard Windows Installer service, writes its program files, and creates its own configuration data under a MacroGamer folder in the user's Documents directory, along with the usual Windows Installer cache entries. No injected process target was recorded, and the two high-risk technique names that appear in the run summary come without the behaviour they describe, so they are not treated as evidence. The observed network contacts are ordinary Microsoft and web-service devices, and all 22 hosts we cross-checked came back with no malicious or suspicious history. Ten files were dropped during installation; six match known-software reference entries, and none has a malicious verdict.

Reputation and Context

The file has been circulating since 2020 and has been submitted by 3,738 distinct sources across nearly 29,000 submissions, which is the profile of a widely redistributed installer rather than something freshly built for an attack. One user annotation on the file asserts that it is a trojan; that text comes from an untrusted comment field and is not backed by any engine detection, sandbox verdict, dropped file or contacted host.

What To Do Now

There is nothing here that would justify blocking the package. Get it from the vendor's own download page rather than a third-party mirror so you know the bytes came from the source, and keep your antivirus and system protection enabled. If you would rather not grant an unsigned installer write access to your Documents folder, run it inside a sandbox or virtual machine first.