File scan report
Verdict Safe
Is Space Invaders Setup.
None of the 70 antivirus engines that checked it flagged this Space Invaders installer, and the sandbox run shows a normal MSI installation with no high-risk techniques or…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This installer appears safe to use. Get it from a trusted source and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 7y ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
In the sandbox it unpacked and ran an MSI package through the Windows installer, with no process injection and no network contacts. It has been around since 2019 without picking up detections.
The 18 major antivirus engines that analysed it all reported it clean. The sandbox recorded a standard installer chain: the bootstrapper wrote an MSI and cabinet file, then Windows Installer ran them. No high-risk techniques were recorded, no processes were injected, and the file made no network contacts. The file was first seen in 2019 and has stayed undetected since then. It is unsigned, which is common for small game installers and leaves the publisher unverified.
What We Detected
None of the 70 antivirus engines that checked it flagged this installer. The 18 major antivirus engines that analysed it reported it clean. No behaviour rules matched, and the file does not appear to be packed.
Threat Behavior
In the sandbox, the setup program extracted a Space Invaders MSI package and cabinet into the user's AppData folder and installed them through Windows Installer. We saw no process injection, no persistence entries and no network contacts.
What To Do Now
The installer looks like an ordinary game setup. It is unsigned, so download it only from a source you trust, and keep your antivirus enabled.
Where this verdict could be wrong1 caveat
- The installer is unsigned, so the publisher cannot be confirmed from a signature.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged the file.
- The sandbox showed a standard Windows Installer setup with no high-risk techniques.
- The file has been known since 2019 without picking up detections.
- No process injection or network contacts were recorded.
- The installer carries no digital signature, so its publisher cannot be verified.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 35sandbox rule tags
- 6spawned processes
- 0network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
35MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1007
- T1010
- T1012
- T1027· Obfuscated code
- T1027.005· Obfuscated code
- T1033· Reads user info
- T1036
- T1053.005· Scheduled task
- T1056.001· Keylogging
- T1057· Lists programs
- T1059· Runs commands
- T1070· Covers its tracks
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1087
- T1091· USB spreading
- T1112
- T1120
- T1129· Loads modules
- T1134
- T1213
- T1222
- T1485
- T1497.001· Sandbox evasion
- T1518· Checks your AV
- T1529
- T1543.003· Service install
- T1547.001· Auto-start
- T1562· Disables security
- T1562.001· Disables security
- +3 more
Observed activity
Processes started
6Programs the file ran, with their command lines.
software.exe"C:\Users\<USER>\Desktop\software.exe"MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5163EBF932EF8445216D7AD813212154 Cmsiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\Space Invaders.msi" AI_SETUPEXEPATH=C:\Users\<USER>\Desktop\software.exe SETUPEXEDIR=C:\Users\<USER>\Desktop\ EXE_CMD_LINE="/exenoupdates "MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B4CFB3504B8EAD93A269A2E678175FD4msiexec.exeC:\WINDOWS\system32\msiexec.exemsiexec.exeC:\Windows\system32\msiexec.exe /i C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\Space Invaders.msi AI_SETUPEXEPATH=C:\Users\<USER>\Downloads\f7827ebc217bf245a712e230a95971ff0af4b65a4813906803ece0e0ffd29c4f.exe SETUPEXEDIR=C:\Users\<USER>\Downloads\ EXE_CMD_LINE=/exenoupdates
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\holder0.aiph - Written
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\Space Invaders.msi - Written
C:\Users\<USER>\AppData\Local\Temp\shiE86C.tmp - Written
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\Space Invaders1.cab - Written
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log - Written
C:\Windows\Temp\~DF70447218D9DE34B4.TMP
Show all 30 entries for files
- Written
C:\Windows\Temp\~DFF4FC4D9BD6661F15.TMP - Written
C:\Windows\Temp\~DF1F0AC83C464A8C1D.TMP - Written
C:\Windows\Temp\~DF04B4B66F5299930C.TMP - Written
C:\Config.Msi\eef5.rbs - Written
C:\GAMES\INVADERS\!start.bat - Written
C:\GAMES\INVADERS\dosbox.conf - Written
C:\GAMES\INVADERS\dosbox.exe - Written
C:\GAMES\INVADERS\INVADERS.COM - Written
C:\GAMES\INVADERS\INVADERS.DOC - Deleted
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\holder0.aiph - Deleted
C:\Windows\Tasks\C__Users_<USER>_Desktop_software.exe.job - Deleted
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\Space Invaders.msi - Deleted
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install\Space Invaders1.cab - Deleted
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0\install - Deleted
C:\Users\<USER>\AppData\Roaming\Taito\Space Invaders 1.0.0 - Deleted
C:\Users\<USER>\AppData\Roaming\Taito - Deleted
C:\Config.Msi\CMPF7DD.tmp - Deleted
C:\Config.Msi - Deleted
C:\Windows\Installer\eef6.msi - Deleted
C:\Config.Msi\CMPFBA5.tmp - Deleted
C:\Config.Msi\eef5.rbs - Deleted
C:\Windows\Installer\eef3.msi - Deleted
C:\Windows\Installer\inprogressinstallinfo.ipi - Deleted
C:\Windows\SysWOW64\MsiWerCrashmetadata-41
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Global\OneSettingQueryMutex+compat+encapsulationGlobal\_MSIExecuteZonesCounterMutexZonesCacheCounterMutexZonesLockedCacheCounterMutexCTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
msiexec.exeC:\Windows\system32\msiexec.exe /V - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
Show all 9 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- fcfc920b5af8d4384515…e362b7Not checkedno saved verdict
- d94f907cd1acd7cd4250…2dfffbNot checkedno saved verdict
- ba23b62cb0cee5d3d042…fb3854Not checkedno saved verdict
- 92a7e28859fc21992161…6a8107Not checkedno saved verdict
- 5a23037eb75bb1916d7e…cd3e5aNot checkedno saved verdict
- 0768c0a9d417cfe9874c…e192e4Not checkedno saved verdict
- 9c1e1067ffe17ebdfa3b…cbe162Not checkedno saved verdict
- 16a19763520bc5acfa82…a4042fNot checkedno saved verdict
- 15fb0bda4e4644d5769b…aa49fbNot checkedno saved verdict
- 0c077009fce6cc93df07…8f198aNot checkedno saved verdict
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 30, 2026, 10:17 AM UTC
- SHA-256
f7827ebc217bf245a712e230a95971ff0af4b65a4813906803ece0e0ffd29c4f- SHA-1
62156c8347029d4c20363e1ab44d7962a7af69b4- MD5
109f1ec0ebd3d7ad29576beaca714306
About this file
Space Invaders Setup.exe is a Win32 EXE file of 7.9 MB.
- Type and size
- Win32 EXE · 7.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 19, 2019On VirusTotal.
- Submitted by
- 14 distinct sources
- Packer
- None detected
- Entropy
- 6.79 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 70 engines flagged this file
4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Space Invaders Setup.exe safe?
What is Space Invaders Setup.exe?
How many antivirus engines detected Space Invaders Setup.exe?
What is the SHA-256 hash of Space Invaders Setup.exe?
Is it safe to install Space Invaders Setup.exe?
How up to date is this analysis of Space Invaders Setup.exe?
Community
Member reviews and reports for this exact file hash.