File scan report
Verdict Safe
Is Setup.
An old, widely circulated unsigned installer compressed with UPX: two of the 71 antivirus engines that checked it flag it generically, while eight sandbox runs and a complete…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Treat this as ordinary installer software, but since it is unsigned, re-download it from the publisher's official site instead of using a copy of uncertain origin. Keep your antivirus protection switched on while you install.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 71 flagged
- Flagged 2
- No detection 69
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 20y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Two of the 71 antivirus engines that checked it flag this installer, but only one is a high-weight detector and its label is a generic trojan bucket rather than a named family. The combined sandbox verdict was clean with no injection, dropped files or persistence, and every host it contacted checked out as non-malicious. With 1,561 distinct sources since 2006, this looks like a long-circulating installer.
The detection spread is thin: two of the 71 antivirus engines that checked it, one of them a major detector using a generic trojan label, with no agreement on any concrete family. The file is unsigned and compressed with UPX, which is normal for installers of its era and explains the high code entropy, but packing on its own is not evidence of hostile intent. Eight sandbox runs, recorded as an exact count, ended with a clean combined verdict and showed no process injection, no dropped files, no persistence and no high-risk techniques — only window-message and system-information activity typical of setup programs. Every distinct host the sample reached was looked up and none carried a malicious or suspicious report; most of the addresses are the analysis machine's own Microsoft traffic. Large-scale prevalence since Jul 8, 2006 reinforces that this is commodity software rather than a fresh attack. The single high-severity behaviour rule that fired on "unsigned packed binary with network activity" rests on contacts our host lookup cleared, so it does not outweigh the runtime and reputation evidence.
What We Detected
This is a 413 KB Windows installer, unsigned and compressed with UPX. Two of the 71 antivirus engines that checked it raise a flag: Microsoft applies a generic trojan name ("Trojan:Win32/Malgent"), and a smaller engine reports a generic suspicious-file signature. Seventeen major antivirus engines, including BitDefender, Kaspersky, ESET, Avira, Fortinet and G-Data, returned nothing. No engine agrees on a family name.
The file has been circulating since Jul 8, 2006 and has been submitted by 1,561 distinct sources, which is the profile of a widely mirrored installer rather than a targeted package.
Threat Behavior
The combined sandbox verdict was clean. The recorded activity is ordinary setup work: window and input-related calls, system information queries, and contact with Microsoft addresses that are part of the analysis machine's own background traffic. No process was injected into, no file was dropped, no persistence was registered and no high-risk technique was observed.
All 17 distinct hosts the sample touched were cross-checked and none had a malicious or suspicious report on record. One high-severity behaviour rule fired for an unsigned compressed program that talks to the network, but its supporting address is among those cleared by that check, so its premise is not borne out.
What To Do Now
If you obtained this installer from the vendor's official download page and it matches the file the publisher distributes, there is no strong reason to treat it as malware — but because it is unsigned and compressed, downloading it again from the official source is the safer route than running a copy of unknown provenance.
Keep your antivirus and Windows protection enabled. If a security product does let your antivirus remove this file, submit it to the vendor for review rather than excluding it.
Where this verdict could be wrong3 caveats
- The file is unsigned and compressed with UPX, and one high-severity behaviour rule fired for an unsigned packed program with network activity — packing can in principle conceal a second-stage payload from a short sandbox run.
- Microsoft is our highest-weighted class of detector, and it does apply a generic trojan label here; if that signature reflects a poisoned redistribution of an old installer rather than a rule-based misfire, the clean runtime results would not show it.
- Nobody opened the file's contents in our static pipeline, so the code inside the compressed section was not reviewed; the clean sandbox results describe behaviour, not what the payload contains.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Seven to eight engines — 69 of the 75 — found nothing, including most of the highest-weight vendors.
- The combined sandbox verdict was clean and showed no injection, no dropped files and no persistence.
- All 17 hosts the sample reached were checked and none has a malicious or suspicious report.
- The file has been submitted by 1,561 distinct sources since Jul 8, 2006 and carries a positive reputation score.
- No malware-sharing database listing and no malware-specific community detection rules matched this file.
- The installer carries no digital signature, so nothing proves who built or repackaged it.
- Its code is compressed with UPX, which hides the program's contents from quick inspection and is a common way to disguise a second-stage payload.
- One major antivirus engine applies a generic trojan name to the file, and a second, less reliable engine reports a generic suspicious-file signature.
- One of our behaviour rules flagged the combination of an unsigned compressed program and outbound network activity.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 8 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 8isolated sandbox runs
- 7sandbox rule tags
- 4spawned processes
- 8network contacts
- 23filesystem & mutex artifacts
What this file did when executed
This file was detonated in 8 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1124
- T1497· Sandbox evasion
Observed activity
Processes started
4Programs the file ran, with their command lines.
software.exe"C:\Users\<USER>\AppData\Local\Temp\software.exe"decb145cd0f75ee8510cb3d0f76ef190a02a468b42f1e70855295ddca96adf0b.exe%SAMPLEPATH%\decb145cd0f75ee8510cb3d0f76ef190a02a468b42f1e70855295ddca96adf0b.exefile.exe%SAMPLEPATH%\file.exe3_70_decb145cd0f75ee8510cb3d0f76ef190a02a468b42f1e70855295ddca96adf0b.exe%SAMPLEPATH%\3_70_decb145cd0f75ee8510cb3d0f76ef190a02a468b42f1e70855295ddca96adf0b.exe
Network contacts
88 hosts, listed as 8 addresses. Links show the host and path only.
- IP address
23.209.116.9 - IP address
104.86.182.8 - IP address
23.101.168.44 - IP address
23.220.75.246 - IP address
20.96.153.111 - IP address
23.215.176.152
Show all 8 entries for network contacts
- IP address
23.40.41.27 - IP address
23.67.33.141
Files
15Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E70.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E72.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E82.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A1A.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AE5.tmp.csv
Show all 15 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B15.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER292F.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER293F.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2940.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FC7.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FC8.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2094.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2093.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20C3.tmp.txt
Registry and auto-start
2Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\Start - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\ImagePath
Mutexes
8Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 8 entries for mutexes
MSCTF.Shared.MUTEX.EBHMSCTF.Shared.MUTEX.AOJ
Sandbox background — not the file
27The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google2168_619820021\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3596_585868688\bin\updater.exe - VM process
updater.exeC:\Program Files\Google4024_732398547\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2768_210155641\bin\updater.exe
Show all 27 entries for sandbox background — not the file
- VM process
updater.exeC:\Program Files\Google620_1835522655\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3776_302563822\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google2168_619820021\bin\updater.exe - VM injection target
C:\Program Files\Google3596_585868688\bin\updater.exe - VM injection target
C:\Program Files\Google4024_732398547\bin\updater.exe - VM injection target
C:\Program Files\Google2768_210155641\bin\updater.exe - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
13.107.4.50 - VM host
23.216.147.64 - VM host
20.99.132.105 - VM host
a83f:8110:400:0:607f:5051:100:0 - VM host
131.253.33.203 - VM host
a83f:8110:0:0:beac:bf78:cce1:d301 - VM host
192.168.0.8 - VM host
23.216.147.76 - VM host
a83f:8110:0:0:1b00:100:2800:0 - VM host
20.62.24.77 - VM host
a83f:8110:e00:0:1b00:0:0:0 - VM host
20.99.184.37
Chapter 04
Technical details
2 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- Microsoft (major engine)Trojan:Win32/Malgent
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Nov 4, 2026, 10:43 AM UTC
- SHA-256
decb145cd0f75ee8510cb3d0f76ef190a02a468b42f1e70855295ddca96adf0b- SHA-1
a50539bdca8b36c953d134b7eebf1f8fa45d0d32- MD5
a89eb48d99361fe9cca6714cab23a5f0
About this file
Setup.exe is a Win32 EXE file of 413.2 kB.
- Type and size
- Win32 EXE · 413.2 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 8, 2006On VirusTotal.
- Submitted by
- 1,561 distinct sources
- Packer
- UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub, UPX, UPX 1.21 (DetectItEasy packer)Packing hides code; legitimate installers use it too.
- Entropy
- 7.83 of 8A code section is highly compressed or encrypted.
First scanned
Antivirus consensus
2 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines1flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- MicrosoftMalicious: Trojan:Win32/Malgent
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Setup.exe safe?
What is Setup.exe?
How many antivirus engines detected Setup.exe?
What is the SHA-256 hash of Setup.exe?
Is it safe to install Setup.exe?
How up to date is this analysis of Setup.exe?
Community
Member reviews and reports for this exact file hash.