File scan report
Verdict Safe
Is Macro
A 2020 installer for the MacroGamer key-macro utility that no engine flags and that ran clean in every recorded sandbox run, matching a widely shared installer rather than malware.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Nothing in the evidence justifies blocking this installer. Download it from the vendor's own site rather than a mirror, keep your antivirus and system protection enabled, and if you want extra caution run it inside a sandbox or virtual machine first.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 13
- Code signing Unsigned
- Test run Completed
- First seen 6y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 62 antivirus engines that checked it flagged this Windows Installer package, and every recorded sandbox run finished with a clean verdict. It has been submitted by thousands of distinct sources since May 2020, several of its dropped files match known-software reference entries, and no contacted host or dropped file is known to be hostile. The only negative note is an unsigned package and a single user comment claiming it is a trojan, which nothing in the evidence supports.
The detection picture is empty: none of the 62 antivirus engines that checked it flagged the package, and the 18 highest-trust engines all returned clean, so there is no family label to weigh. Evidence from the test run points the same way — the combined sandbox verdict over five runs was clean, no process injection target was recorded, and the only high-risk technique names are mappings without the behaviour they describe. Network and dropped-file checks found nothing: all 22 inspected hosts were unknown to our malicious cache, no dropped file carries a malicious verdict, and six of the dropped files match known-software reference entries. The file has been in circulation since May 23, 2020, submitted by 3738 distinct sources across nearly 29,000 submissions, which is the profile of a widely redistributed small utility installer. The negatives are limited to the absence of a signature and a negative community reputation score, plus a bare user annotation claiming malware that no engine, sandbox run or host check corroborates.
What We Detected
This is a Windows Installer package for MacroGamer, a small keyboard-macro utility, first seen on May 23, 2020. None of the 62 antivirus engines that checked it flagged it, including all 18 of the highest-trust engines we track, and no engine returned a suspicious result either. The package is not digitally signed, which is common for small independent Windows utilities but does mean nothing cryptographically ties it to a publisher.
Threat Behavior
Five sandbox runs were recorded and the combined verdict for them is clean. The package behaves like a normal installer: it launches the standard Windows Installer service, writes its program files, and creates its own configuration data under a MacroGamer folder in the user's Documents directory, along with the usual Windows Installer cache entries. No injected process target was recorded, and the two high-risk technique names that appear in the run summary come without the behaviour they describe, so they are not treated as evidence. The observed network contacts are ordinary Microsoft and web-service devices, and all 22 hosts we cross-checked came back with no malicious or suspicious history. Ten files were dropped during installation; six match known-software reference entries, and none has a malicious verdict.
Reputation and Context
The file has been circulating since 2020 and has been submitted by 3,738 distinct sources across nearly 29,000 submissions, which is the profile of a widely redistributed installer rather than something freshly built for an attack. One user annotation on the file asserts that it is a trojan; that text comes from an untrusted comment field and is not backed by any engine detection, sandbox verdict, dropped file or contacted host.
What To Do Now
There is nothing here that would justify blocking the package. Get it from the vendor's own download page rather than a third-party mirror so you know the bytes came from the source, and keep your antivirus and system protection enabled. If you would rather not grant an unsigned installer write access to your Documents folder, run it inside a sandbox or virtual machine first.
Where this verdict could be wrong3 caveats
- The installer carries no digital signature at all, so nothing cryptographically ties these bytes to a named publisher; the clean result rests on detections, runtime runs and the long submission history instead.
- One anonymous user annotation on this file calls it a trojan, but no engine, sandbox run, dropped file or contacted host in this evidence supports that claim.
- The installer writes configuration files into the user's Documents folder and creates standard Windows Installer cache entries, which a cautious reader may prefer to install inside a sandbox or virtual machine.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No engine out of 75 flagged the file, including all 18 of the highest-trust engines, and none reported it as suspicious.
- The combined verdict across five recorded sandbox runs was clean, with no injected process target and no high-risk techniques backed by observed behaviour.
- All 22 contacted hosts checked against our malicious-host cache came back unknown to it, with no malicious or suspicious entries.
- Ten dropped files inspected, none malicious, six matching known-software reference entries.
- Long, wide distribution history: first seen on May 23, 2020, submitted by 3,738 distinct sources across nearly 29,000 submissions.
- The installer is not digitally signed, so the package is not cryptographically tied to a named publisher.
- The package carries a slightly negative community reputation score despite having no antivirus detections.
- Installation writes configuration data into the user's Documents folder and creates Windows Installer cache entries, which some users prefer to confine to a virtual machine.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 24sandbox rule tags
- 3spawned processes
- 7network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
24MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1016· Network recon
- T1018
- T1036
- T1053· Scheduled task
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070.004· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1091· USB spreading
- T1095· Custom network
- T1120
- T1203
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.003· Service install
- T1547.001· Auto-start
- T1547.008· Auto-start
- T1562.001· Disables security
- T1573
- T1574.002· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
msiexec.exe"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\installer.msi" /qb ACCEPTEULA=1 LicenseAccepted=1msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\setup.msi"msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\installer.msi"
Network contacts
77 hosts, listed as 5 domains, 2 addresses. Links show the host and path only.
- Domain
sfd-production.azurefd.net - Domain
prda.aadg.msidentity.com - Domain
pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com - Domain
telemetry-incoming.r53-2.services.mozilla.com - Domain
firefox.settings.services.mozilla.com - IP address
65.8.49.117
Show all 7 entries for network contacts
- IP address
44.231.216.202
Files
30Files the file created, changed or deleted.
- Written
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log - Written
C:\Windows\Temp\~DF56FECB3E9C17053D.TMP - Written
C:\Windows\Temp\~DFC082DE0E46AB19DC.TMP - Written
C:\Windows\Temp\~DF597FB2E809D3C122.TMP - Written
C:\Windows\Temp\~DFE7D3243D8A2D016D.TMP - Written
C:\Config.Msi\d766.rbs
Show all 30 entries for files
- Written
C:\Users\<USER>\Documents\MacroGamer\scancodes.dat - Written
C:\Users\<USER>\Documents\MacroGamer\mgconfig.dat - Written
C:\Users\<USER>\Documents\MacroGamer\MacrosEnabled.wav - Written
C:\Users\<USER>\Documents\MacroGamer\gmerico.ico - Written
C:\Users\<USER>\Documents\MacroGamer\MacrosDisabled.wav - Written
C:\Users\<USER>\Documents\MacroGamer\RecordingStopped.wav - Written
C:\Users\<USER>\Documents\MacroGamer\MacroGamer.exe - Written
C:\Users\<USER>\Documents\MacroGamer\profile.mgp - Written
C:\Users\<USER>\Documents\MacroGamer\kh.dll - Deleted
C:\Config.Msi\CMPDBD9.tmp - Deleted
C:\Config.Msi - Deleted
C:\Windows\Installer\d767.msi - Deleted
C:\Config.Msi\CMPDF15.tmp - Deleted
C:\Config.Msi\d766.rbs - Deleted
C:\Windows\Installer\d764.msi - Deleted
C:\Windows\Installer\inprogressinstallinfo.ipi - Deleted
C:\MSI5c9da.tmp - Deleted
C:\MSIc3e92.tmp - Deleted
C:\MSIcb691.tmp - Deleted
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\336A3FBD-5444-4706-9F9D-ABB4B12E1986 - Deleted
C:\MSIad56b.tmp - Deleted
C:\MSI5dab2.tmp - Deleted
C:\MSI272ae.tmp - Deleted
C:\MSI59ef4.tmp
Registry and auto-start
19Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\GlobalAssocChangedCounter - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKslcda1a539\Parameters - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKslcda1a539\Parameters\Wdf - Set
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\BITS Writer - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKslcda1a539\Parameters\Wdf\WdfMajorVersion - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKslcda1a539\Parameters\Wdf\WdfMinorVersion
Show all 19 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS\PerfMMFileName - Set
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent\CurrentDefault - Set
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent\LastPingSentAt - Set
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent\PingCurrentDefault - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKsle82cdc9b\Parameters - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKsle82cdc9b\Parameters\Wdf - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKsle82cdc9b\Parameters\Wdf\WdfMajorVersion - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKsle82cdc9b\Parameters\Wdf\WdfMinorVersion - Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKsl04fe7d30\Parameters - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts - Deleted
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\63 - Deleted
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\63\52C64B7E - Deleted
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Global\_MSIExecute\Sessions\1\BaseNamedObjects\Local\SM0:5528:304:WilStaging_02\Sessions\1\BaseNamedObjects\Global\_MSIExecute\Sessions\1\BaseNamedObjects\Local\SM0:5528:120:WilError_01\BaseNamedObjects\Local\SM0:6312:304:WilStaging_02\BaseNamedObjects\Global\Instance0: ESENT Performance Data Schema Version 290
Show all 10 entries for mutexes
\BaseNamedObjects\Global\Instance1: ESENT Performance Data Schema Version 290\Sessions\1\BaseNamedObjects\MozillaFirefoxDefaultBrowserAgentRegistryMutex\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
Sandbox background — not the file
23The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
msiexec.exeC:\Windows\system32\msiexec.exe /V - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 23 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
msiexec.exeC:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V - VM host
212.161.61.168.in-addr.arpa - VM host
fp2E7A.wpc.2BE4.phicdn.net - VM host
250.138.195.23.in-addr.arpa - VM host
234.151.42.104.in-addr.arpa - VM host
1.155.190.20.in-addr.arpa - VM host
105.40.221.88.in-addr.arpa - VM host
86.232.212.23.in-addr.arpa - VM host
1.214.248.87.in-addr.arpa - VM host
119.11.238.8.in-addr.arpa - VM host
33.28.101.95.in-addr.arpa - VM host
70.108.16.96.in-addr.arpa - VM host
fp2e7a.wpc.phicdn.net - VM host
117.49.8.65.in-addr.arpa - VM host
22.173.189.20.in-addr.arpa - VM host
82.250.63.168.in-addr.arpa
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 2065313409cb565b620e…6bfb59Not checkedno saved verdict
- fd3357647b68f211dcff…64aa01Not checkedno saved verdict
- dafa4e0ffbcd14a47ffe…29cd01Not checkedno saved verdict
- d4f066db44f8ec61d8ec…3fd26bCleantrust 85known-software reference set · not scanned here
- 027f58ea864ae1bffbb0…430ca0Not checkedno saved verdict
- 0950336e0d633eb645e0…f636e7Cleantrust 85known-software reference set · not scanned here
- 2099f0854585b2115e09…0d7b95Cleantrust 85known-software reference set · not scanned here
- 3096d8e82917a9b73f32…3cdd5bCleantrust 85known-software reference set · not scanned here
- 30e621d2720a1f8b727f…44e8bcCleantrust 85known-software reference set · not scanned here
- f2f69d75c8e2d790026c…f926e9Cleantrust 85known-software reference set · not scanned here
Chapter 04
Technical details
None of the 62 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 2:01 AM UTC
- SHA-256
d82a1cffc6e982b07c0aef61b96b4c36ebd921949c9d4c45a31781539ae443e8- SHA-1
a9f931e9f7c8a7964d19af9b5f938c2dbfcb44e4- MD5
f7a9d1bf05f8f0e2a1cc6cafd0985070
About this file
MacroGamer_v275_Setup.msi is a Windows Installer file of 683.0 kB.
- Type and size
- Windows Installer · 683.0 kB
- Signer
- UnsignedNo code signature.
- First seen
- May 23, 2020On VirusTotal.
- Submitted by
- 3,738 distinct sources
First scanned
Antivirus consensus
0 of 62 engines flagged this file
13 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is MacroGamer_v275_Setup.msi safe?
What is MacroGamer_v275_Setup.msi?
How many antivirus engines detected MacroGamer_v275_Setup.msi?
What is the SHA-256 hash of MacroGamer_v275_Setup.msi?
Is it safe to install MacroGamer_v275_Setup.msi?
How up to date is this analysis of MacroGamer_v275_Setup.msi?
Community
Member reviews and reports for this exact file hash.