File scan report
Verdict Safe
Is Hn
Unsigned NSIS installer flagged by a single less reliable engine with no major support.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Treat as a standard NSIS installer; no further security action needed unless obtained from an untrusted source.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 67 flagged
- Flagged 1
- No detection 66
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
75 engines scanned the file; only one less reliable engine flagged it. The sample is a common NSIS installer with medium prevalence and no malicious sandbox or file it created findings.
The single malicious detection comes from a less reliable engine and no major antivirus engines agrees. The file is unsigned, yet the sandbox shows typical NSIS installer behaviour and drops only unknown children. A prior similar-hash verdict was safe, and prevalence is medium. The lone community comment claiming malware lacks corroboration from any major source.
What We Detected
One less reliable engine (APEX) returned a generic 'Malicious' label; 74 engines remained silent. YARAify matched a single rule that identifies NSIS installers, not malware. The sample is unsigned and shows no brand-mismatch.
Threat Behavior
Sandbox execution produced typical NSIS artefacts and wrote seven temporary DLL/INI files, none of which have malicious verdicts. No control-server domains, persistence mechanisms, or malicious files it created were observed.
What To Do Now
The file can be executed if obtained from a trusted source. Keep security software enabled; no additional action is required based on current evidence.
Where this verdict could be wrong1 caveat
- communityComments contain one annotation claiming 'Malware' score 98/100, but no corroborating major detections or sandbox verdict.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 74/67 engines undetected
- medium prevalence across 804 sources
- sandbox shows only benign installer behaviour
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 1spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1497.001· Sandbox evasion
- T1529
- T1547.009· Auto-start
Observed activity
Processes started
1Programs the file ran, with their command lines.
HnG-setup.exe"C:\Users\user\Desktop\HnG-setup.exe"
Files
19Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsi4B81.tmp\InstallOptions.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsi4B81.tmp\StartMenu.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsi4B81.tmp\UserInfo.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsh58D0.tmp\UserInfo.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsh58D0.tmp\ioSpecial.ini - Written
C:\Users\<USER>\AppData\Local\Temp\nsh58D0.tmp\InstallOptions.dll
Show all 19 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\nsh58D0.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsh58D0.tmp\modern-header.bmp - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Temp - Written
C:\Users\user\AppData\Local\Temp\ - Written
C:\Users\user\AppData\Local\Temp\nsfDA3D.tmp - Written
C:\Users\user\AppData\Local\Temp\nsgDC61.tmp - Written
C:\Users\user\AppData\Local\Temp\nsgDC61.tmp\InstallOptions.dll - Written
C:\Users\user\AppData\Local\Temp\nsgDC61.tmp\UserInfo.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nss5872.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsh58D0.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsfDA3D.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsgDC61.tmp
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache. 6 have no saved verdict and were not checked; that is missing coverage, not a finding.
- e0dc3112796dbaa37f25…a3677bNot checkedno saved verdict
- fe330320459637d8dd2b…536caaNot checkedno saved verdict
- 44b1d70219f88564d94d…f98f71Not checkedno saved verdict
- 89524bef92dd8955012b…ad0381Not checkedno saved verdict
- 766a893fe962aefd27c5…71aefcNot checkedno saved verdict
- 67020d8639ed7e648c78…5ab465Not checkedno saved verdict
Chapter 04
Technical details
1 of the 67 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- APEXMalicious
File fingerprint
- Last analyzed
- Aug 26, 2026, 5:50 PM UTC
- SHA-256
fc1abd85c0661a3e7cf0812968bb8f78e069443a6c4b35f852c3bae14dce4494- SHA-1
6bba7e605761f46440440d736d8bab12c4760ce5- MD5
13b969d2b50a67bcaa59f83fd05648de
About this file
HnG-setup.exe is a Win32 EXE file of 2.6 MB.
- Type and size
- Win32 EXE · 2.6 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 12, 2026On VirusTotal.
- Submitted by
- 804 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Antivirus consensus
1 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-234 engines0flagged
- Low-trust16 engines1flagged
View all 75 engine results
- APEXMalicious: Malicious
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminNo result
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- Detect_NSIS_Nullsoft_Installergeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is HnG-setup.exe safe?
What is HnG-setup.exe?
How many antivirus engines detected HnG-setup.exe?
What is the SHA-256 hash of HnG-setup.exe?
Is it safe to install HnG-setup.exe?
How up to date is this analysis of HnG-setup.exe?
Community
Member reviews and reports for this exact file hash.