Is Capri-Setup.exe safe? Treat it as suspicious.

What We Detected

The file is a 22 MB .NET executable presented as an installer for a program called "Capri". It carries no digital signature, so nothing confirms who built or published it. Fifteen of the 71 antivirus engines that checked it flag it, and after accounting for engines that share the same underlying scan technology there are eight genuinely separate detections, four of them from well-regarded engines. The names used are generic — an obfuscated .NET trojan label repeated by several brands, Kaspersky's rule-based trojan name, Microsoft's machine-learning Sabsik family and a file-reputation hit from Avast and AVG.

The file is also new and thinly distributed: it was first seen on Nov 9, 2026 and only seven distinct sources have submitted it, which is exactly the profile that reputation-based detections react to. The engine analysis notes obfuscated .NET code and debugger-detection behaviour, and the code section is almost entirely high-entropy, so a large part of what the program does is obscured.

Threat Behavior

Four sandbox runs were completed and none of them ended in a malicious verdict. The program ran with install-style switches and wrote only to its own folder inside the user profile. No files were dropped, no startup entries, registry changes or program markers were created, and no process injection target was recorded. The behaviour mapping that mentions process injection came without any process actually being targeted, which is common for installers and packed .NET software and is not evidence of injection on its own.

The only domain contact recorded during the runs was the analysis machine's own data traffic, not the sample's. A reputation check on that single host found nothing malicious. No public malware-sample database lists this hash, no malware-specific community rules match it, and there are no entries in the known-good software reference set either.

What To Do Now

Because the detections and the observations from the test run disagree, treat the installer as untrusted until its origin is confirmed. Only run it if you obtained it directly from the vendor you expect and you can verify the download; do not install it from a link that arrived in a message, an advertisement or a third-party download portal.

If you have already run it, run a full scan with your existing security software kept fully enabled, review installed programs and startup items for anything you do not recognise, and check for new browser extensions or changed account settings. If the installer came from an unexpected source, deleting it costs nothing.