File scan report
Verdict Safe
Is Reallusion Installer safe? Yes, no threats found.
The verified Reallusion installer drew no detections from 75 engines, while observed execution and fully checked contacted domains produced no corroborating malware indicators.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 6
- Code signing Reallusion Inc.
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 69 antivirus engines that checked it flagged this verified Reallusion Inc. installer, including all 17 major antivirus engines. One sandbox recorded mostly installer-common activity.
The sample has a valid signature from Reallusion Inc., and its branding does not conflict with that signer. No engine among 75 reported a malicious or suspicious result, with all 17 reporting major antivirus engines remaining silent. One completed sandbox run recorded alongside 17 techniques common in legitimate software but did not produce a malicious conclusion. Both observed domains were covered by the host-reputation check, and neither matched malicious or suspicious cache entries. The seven dropped files were not individually resolved beyond unknown, but none was identified as malicious. Similar-file history is mostly favorable, although those matches on the import table alone involve different signers and therefore provide only weak support.
What We Detected
The executable is a signed installer with a verified certificate naming Reallusion Inc. None of the 69 antivirus engines that checked it flagged it, including the 17 reporting major antivirus engines, and no conflicting brand identity was detected.
Threat Behavior
One completed sandbox run recorded mainly installer-common activity. T1134, a token-related technique, was the only offensive technique identified, but the run produced no malicious sandbox conclusion. The host-reputation check covered both observed domains—api.reallusion.com and file.reallusion.com—and found no malicious or suspicious matches. Seven extracted children were inspected without any identified malicious child, although their individual verdicts remain unknown.
What To Do Now
Use the installer only if it came from Reallusion's official website or another authorized release channel, and confirm that Windows still reports the Reallusion Inc. signature as valid. Keep security software enabled during installation.
Where this verdict could be wrong4 caveats
- appeared during execution; although token manipulation can be security-sensitive, it was not accompanied by a malicious sandbox conclusion or antivirus detection.
- This signer has no saved history, so there is no established historical sample record for 'Reallusion Inc.' in the local signer dataset.
- All seven files it created have individual verdicts of unknown; the absence of a known-malicious dropped file reflects no identified malicious child, not seven independently cleared files.
- One of five import-table fingerprint-similar files previously received a suspicious result, though its signer did not match this sample.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/69 antivirus engines reported a malicious or suspicious result.
- All 17 reporting major antivirus engines were undetected.
- The code signature is verified for Reallusion Inc.
- No brand mismatch or packing indicators were detected.
- Both observed domains were covered by the host check with no malicious or suspicious matches.
- token-related activity was recorded in one sandbox run.
- No historical signer statistics are available for Reallusion Inc. in the local dataset.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 18sandbox rule tags
- 1spawned processes
- 4network contacts
- 21filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1497.001· Sandbox evasion
- T1529
- T1547.009· Auto-start
Observed activity
Processes started
1Programs the file ran, with their command lines.
AI Studio.exe"C:\Users\user\Desktop\AI Studio.exe"
Network contacts
44 hosts, listed as 2 domains, 2 addresses, 1 link. Links show the host and path only.
- Domain
api.reallusion.com - Domain
file.reallusion.com - IP address
18.165.98.31 - IP address
18.238.176.102 - URL
http://api.reallusion.com/installer/log
Files
19Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsvADC6.tmp\nsResize.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsvADC6.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\RLInstallerDll\RLInstallerTool.dll - Written
C:\Users\<USER>\AppData\Local\Temp\RLInstallerDll\ProductPassLite.dll - Written
C:\Users\<USER>\AppData\Local\Temp\RLInstallerDll\PhysicPassV2.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsvADC6.tmp\UserInfo.dll
Show all 19 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\nsvADC6.tmp\nsDialogs.dll - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Microsoft\Windows\History - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies - Written
C:\Users\user\AppData\Local\Temp - Written
C:\Users\user\AppData\Local\Temp\ - Written
C:\Users\user\AppData\Local\Temp\RLInstallerDll - Written
C:\Users\user\AppData\Local\Temp\RLInstallerDll\PhysicPassV2.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nslAD39.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsvADC6.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsk4864.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsn4E80.tmp
Registry and auto-start
13Settings the file changed, including ways to start again after a restart.
- Set
SOFTWARE\Reallusion\RLGUID\GUID - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix - Set
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable - Set
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings - Set
{F93796DD-E9C3-480A-A756-ADF962EA54BB}\WpadDecisionReason
Show all 13 entries for registry and auto-start
- Set
{F93796DD-E9C3-480A-A756-ADF962EA54BB}\WpadDecisionTime - Set
{F93796DD-E9C3-480A-A756-ADF962EA54BB}\WpadDecision - Set
{F93796DD-E9C3-480A-A756-ADF962EA54BB}\WpadNetworkName - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Reallusion - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Reallusion\RLGUID - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Reallusion\RLGUID\GUID
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
R\Sessions\1\BaseNamedObjects\R
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
8.8.8.8
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- fe5b0ae0c100a003c4a1…3f3ff0Not checkedno saved verdict
- 23d618a0293c78ce00f7…3033d6Not checkedno saved verdict
- d47d69939081982a404b…ce0166Not checkedno saved verdict
- 85d12e308eac8ea77e8d…c5d5c8Not checkedno saved verdict
- dc38688b47940fa48a5c…81696aNot checkedno saved verdict
- a921cc9cc4af332be961…5ff85eNot checkedno saved verdict
- 89a82c4849c21dfe7650…72a912Not checkedno saved verdict
Chapter 04
Technical details
None of the 69 antivirus engines that checked it flag it; signed by Reallusion Inc..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 8, 2026, 11:42 PM UTC
- SHA-256
f300ab36d5b536c1bcffc09e4740d1d403b3c09c37e9c25aeb35098713905a9f- SHA-1
294ea85a3dea4c25fd87fa19a5322e9f4b8aced0- MD5
e4b89940e3e28ad0b708a26cb1f48af0
About this file
Reallusion Installer is a Win32 EXE file of 1.1 MB.
- Type and size
- Win32 EXE · 1.1 MB
- Signer
- Reallusion Inc.Valid code signature.
- First seen
- Sep 1, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 3.98 of 8
First scanned
Antivirus consensus
0 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftNo result
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Reallusion Installer safe?
What is Reallusion Installer?
How many antivirus engines detected Reallusion Installer?
Is Reallusion Installer digitally signed?
What is the SHA-256 hash of Reallusion Installer?
Is it safe to install Reallusion Installer?
How up to date is this analysis of Reallusion Installer?
Community
Member reviews and reports for this exact file hash.