File scan report

Verdict Safe

Analyzed Sep 5, 20261 month ago

Is Windows-ISO-Downloader.exe safe? Yes, no threats found.

A widely used Windows ISO download utility seen by thousands of users since 2021, with none of the 71 antivirus engines that checked it flagging it and no high-risk behaviour…

Read the whole reasonShow less

Strong evidence · Widely seen for a long time, and nothing harmful found.

Run it as usual if it came from the official source

This file matches a widely used Windows ISO download utility and shows no malicious indicators. Download the latest version from the developer's official site and keep your security software enabled.

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 71 flagged

Flagged 0
No detection 71
No result 4

FileWindows-ISO-Downloader.exe7.3 MBSHA-256 d9e52b0dbb5d…021aef

Code signing Signer not verified
Test run Completed
First seen 5y ago

It has a long history: seen by 3,671 sources over more than six months.

Chapter 02

Why we think so

1 point against it and 4 in its favour, checked against the scan evidence.

Analyst conclusion

None of the 71 antivirus engines that checked it flagged this file, including every major antivirus engine. It has circulated widely for over five years with thousands of distinct submitters. Its signature claims HeiDoc but failed verification because the certificate expired. That is common for older builds, but it means the signature cannot confirm the publisher.

Where this verdict could be wrong2 caveats

The publisher's certificate has expired, so the signature cannot confirm who built this copy.
Some community researchers have labelled the file suspicious, although no antivirus engine agrees and those notes are untrusted context.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

26sandbox rule tags
4spawned processes
26network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1010
T1012
T1018
T1027· Obfuscated code
T1036
T1053· Scheduled task
T1055· Process injection
T1056· Keylogging
T1057· Lists programs
T1059· Runs commands
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1095· Custom network
T1106
T1114
T1203
T1497· Sandbox evasion
T1518.001· Checks your AV
T1543.003· Service install
T1547.008· Auto-start
T1560.002
T1562.001· Disables security
T1573
T1574.001· Execution hijack
T1574.002· Execution hijack

Observed activity

Processes started

Programs the file ran, with their command lines.

software.exe"C:\Users\<USER>\Desktop\software.exe"
d9e52b0dbb5d3540016497c913e4186433c2ecd14e359eb841d5d93c8b021aef.exe%SAMPLEPATH%\d9e52b0dbb5d3540016497c913e4186433c2ecd14e359eb841d5d93c8b021aef.exe
file.exe%SAMPLEPATH%\file.exe
Windows-ISO-Downloader.exe%SAMPLEPATH%\Windows-ISO-Downloader.exe

Network contacts

26 hosts, listed as 18 addresses, 19 links. Links show the host and path only.

IP address172.217.214.94
IP address104.168.147.90
IP address74.125.26.91
IP address74.125.134.156
IP address173.194.212.148
IP address172.217.14.202

Show all 37 entries

IP address142.250.217.99
IP address142.251.33.99
IP address142.251.33.78
IP address142.251.33.66
IP address142.251.33.70
IP address142.251.33.68
IP address142.251.33.86
IP address142.251.33.97
IP address142.250.69.202
IP address172.217.14.227
IP address142.250.217.66
IP address142.250.69.196
URLhttps://www.heidoc.net/php/whatsnew.html
URLhttps://www.heidoc.net/php/newadditions.php
URLhttps://www.heidoc.net/php/isocachev8.php
URLhttps://fonts.googleapis.com/css2
URLhttps://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-U1Uw.eot
URLhttps://www.youtube.com/embed/6jzQ9QVqexw
URLhttps://www.youtube.com/s/player/24fb4fc5/fetch-polyfill.vflset/fetch-polyfill.js
URLhttps://www.youtube.com/s/player/24fb4fc5/player_ias.vflset/en_US/base.js
URLhttps://www.youtube.com/s/player/24fb4fc5/www-player.css
URLhttps://www.youtube.com/s/player/24fb4fc5/www-embed-player.vflset/www-embed-player.js
URLhttps://googleads.g.doubleclick.net/pagead/id
URLhttps://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxO.eot
URLhttps://static.doubleclick.net/instream/ad_status.js
URLhttps://www.youtube.com/s/player/24fb4fc5/player_ias.vflset/en_US/remote.js
URLhttps://www.youtube.com/s/player/24fb4fc5/player_ias.vflset/en_US/embed.js
URLhttps://i.ytimg.com/vi/6jzQ9QVqexw/sddefault.jpg
URLhttps://yt3.ggpht.com/ytc/AAUvwnjB8BqEEx02Ds-rje_ICUs311vh6QLrOQmfWdCH=s68-c-k-c0x00ffffff-no-rj
URLhttps://www.youtube.com/youtubei/v1/log_event
URLhttps://www.youtube.com/generate_204

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\08c5d47c-be1d-4774-8f53-ef07e260e4dd.css
WrittenC:\Users\<USER>\AppData\Local\Temp\bf46cc0a-3781-4c4f-90fc-836bc611aa03.js
WrittenC:\Users\<USER>\AppData\Local\Temp\b3f3307a-2293-4b39-a552-a4f95d10306e.js
WrittenC:\Users\<USER>\AppData\Local\Temp\4cf5c923-af61-4de1-a31f-b562e466a34d.css
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QYXWK8LT\sslnavcancel[1]
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEMOHSN7\bullet[2]

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEMOHSN7\sslnavcancel[1]
WrittenC:\Users\<USER>\AppData\Local\Temp\4e5323af-7813-45d2-9bc4-6d5c377da377.js
WrittenC:\Users\<USER>\AppData\Local\Temp\955aa005-c4e8-4336-a012-f474af10ec9f.css
WrittenC:\Users\<USER>\AppData\Local\Temp\ad78eb03-6664-4b05-bb81-a80b40179bce.js
WrittenC:\Users\<USER>\AppData\Local\Temp\e9500c16-3aab-4859-bc59-5ac7dd985de2.css
WrittenC:\Users\<USER>\AppData\Local\Temp\8672fb2c-1a03-4997-ad1f-482716f6f5d3.css
WrittenC:\Users\<USER>\AppData\Local\Temp\4f4c2e5c-9c19-49b8-b6b9-4eed20cec8cb.js
WrittenC:\Users\<USER>\AppData\Local\Temp\560120e0-60e8-4efc-a040-c5655995a226.js
WrittenC:\Users\<USER>\AppData\Local\Temp\0caaa583-c802-4229-93fe-1355c1e30aa9.css
Deleted%USERPROFILE%\AppData\Local\Microsoft\Internet Explorer\DOMStore\LKWCDQZ6\www.youtube[1].xml
Deleted%USERPROFILE%\AppData\Local\Microsoft\Windows\INetCookies\NV1Z4P7M.cookie
DeletedC:\Windows\System32\spp\store\2.0\cache\cache.dat
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER338E.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER3572.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER35A2.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER6B48.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER6B59.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER6B5A.tmp.txt
Deleted%USERPROFILE%\AppData\Local\Microsoft\Internet Explorer\DOMStore\O5F4XQTB\www.youtube[1].xml
Deleted%USERPROFILE%\AppData\Local\Microsoft\Windows\INetCookies\WS3L1D3Y.cookie
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER3B6E.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER3B7E.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER3C88.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER3C87.tmp.csv

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List
DeletedHKU/S-1-5-21-470376811-3006406624-3672060426-1000/Software/Microsoft/Windows/CurrentVersion/Internet Settings/ZoneMap//ProxyBypass

Show all 13 entries

DeletedHKLM/Software/Microsoft/Windows/CurrentVersion/Internet Settings/ZoneMap//ProxyBypass
DeletedHKU/S-1-5-21-470376811-3006406624-3672060426-1000/Software/Microsoft/Windows/CurrentVersion/Internet Settings/ZoneMap//IntranetName
DeletedHKLM/Software/Microsoft/Windows/CurrentVersion/Internet Settings/ZoneMap//IntranetName
DeletedHKLM/Software/Microsoft/SystemCertificates/AuthRoot//Certificates/D1EB23A46D17D68FD92564C2F1F1601764D8E349
DeletedHKU/S-1-5-21-470376811-3006406624-3672060426-1000/Software/Microsoft/windows/CurrentVersion/Internet Settings/ProxyServer
DeletedHKU/S-1-5-21-470376811-3006406624-3672060426-1000/Software/Microsoft/windows/CurrentVersion/Internet Settings/ProxyOverride
DeletedHKU/S-1-5-21-470376811-3006406624-3672060426-1000/Software/Microsoft/windows/CurrentVersion/Internet Settings/AutoConfigURL

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
Local\MSIMGSIZECacheMutex
Local\InternetExplorerDOMStoreQuota
Local\http://www.youtube.com/
Local\!PrivacIE!SharedMemory!Mutex

Show all 10 entries

Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
RasPbFile
Local\_!MSFTHISTORY!_

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processservices.exeC:\Windows\system32\services.exe
VM processwuapihost.exeC:\Windows\System32\wuapihost.exe
VM processupdater.exeC:\Program Files (x86)\Google3140_1318643237\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google3764_638629254\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google3156_244643482\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google3976_352455103\bin\updater.exe

Show all 13 entries

VM processupdater.exeC:\Program Files (x86)\Google2168_1278446879\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google1592_1756066640\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google3696_1073909424\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google1028_1164034514\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google4020_805239757\bin\updater.exe
VM host204.79.197.203
VM host192.168.0.45

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

9aa54eebc26ba33d5c46…7c4594Not checked
no saved verdict
ff1bc0cb59a3526aaa3b…c5d909Not checked
no saved verdict
bef5223dc4cfbd7a9c11…32ffe0Not checked
no saved verdict
0b3b6494146b4568b991…afd4b3Not checked
no saved verdict
f7a45fdf39566fd1a28e…a4c9e7Not checked
no saved verdict
830d75bbf0e1f9289d78…55d198Not checked
no saved verdict
c8f7edc9cbd795e949ff…352770Not checked
no saved verdict
ce85352b0d6e3a31181e…ea3bdbNot checked
no saved verdict
c839ac22c73fc1b029b2…45d49bNot checked
no saved verdict
47f5b679692a65119826…c323e7Not checked
no saved verdict

Chapter 04

Technical details

None of the 71 antivirus engines that checked it flag it; a signature that did not verify.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 71 engines flagged it · 4 gave no result DetailsAug 19, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsOct 22, 2026

Contacted hostsMalwareTips URL scannerPartial8 of 27 contacted hosts were cross-checked; coverage is incomplete DetailsOct 22, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsOct 22, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 5, 2026

Known-software referenceCIRCL hashlookupCompleteListed in an open-upload malware feedSep 5, 2026

File fingerprint

Last analyzed: Sep 5, 2026, 4:41 PM UTC

SHA-256: d9e52b0dbb5d3540016497c913e4186433c2ecd14e359eb841d5d93c8b021aef
SHA-1: 1f4ba0eefbf14aa351debe48fed9756c301fa866
MD5: 42be2387ea24923622219a33c504c091

About this file

Windows-ISO-Downloader.exe is a Win32 EXE file of 7.3 MB.

Type and size: Win32 EXE · 7.3 MB
Signer: HeiDoc V.O.F. (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
First seen: Jan 7, 2021On VirusTotal.
Submitted by: 3,671 distinct sources
Packer: None detected
Entropy: 7.39 of 8

First scanned Sep 5, 2026Updated Oct 22, 2026

Verdict history

Sep 5, 2026Suspicious
Oct 22, 2026Safeafter a re-check of the saved evidence

Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.

Antivirus consensus

0 of 71 engines flagged this file

0 malicious0 suspicious71 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-236 engines
0flagged
Low-trust17 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 7.39Unpacked

Section entropy3 sections

.text

7.00

.rsrc

3.43

.reloc

0.10

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

3,671

Hundreds of people have uploaded this — common.

Total submissions

25,725

Includes repeat uploads by the same source.

First seen

6y ago

Jan 7, 2021

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is Windows-ISO-Downloader.exe safe?

We found nothing harmful in Windows-ISO-Downloader.exe. None of the 71 antivirus engines that checked it flag it. Run it only if it came from the developer's own website or an official app store.

What is Windows-ISO-Downloader.exe?

Windows-ISO-Downloader.exe is a Windows program, about 7.3 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jan 7, 2021.

How many antivirus engines detected Windows-ISO-Downloader.exe?

None of the 71 antivirus engines that checked it flag Windows-ISO-Downloader.exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

Is Windows-ISO-Downloader.exe digitally signed?

It carries a signature in the name of HeiDoc V.O.F. that could not be verified. Malware sometimes copies or steals a company's signature, so this does not mean that company made it.

What is the SHA-256 hash of Windows-ISO-Downloader.exe?

The SHA-256 fingerprint of Windows-ISO-Downloader.exe is d9e52b0dbb5d3540016497c913e4186433c2ecd14e359eb841d5d93c8b021aef, and its MD5 is 42be2387ea24923622219a33c504c091. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to run Windows-ISO-Downloader.exe?

We found nothing harmful in Windows-ISO-Downloader.exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of Windows-ISO-Downloader.exe?

This report reflects the scan on Sep 5, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is Windows-ISO-Downloader.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

Verdict history

0 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is Windows-ISO-Downloader.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Verdict history

Related file reports