File scan report
Verdict Safe
Is Office
No engine flagged this installer, its combined sandbox verdict was clean, and the fully checked network contacts had no adverse reputation.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 5d ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged this executable, including the major engines represented in the scan. The combined sandbox verdict was clean, no injected process was identified, and all nine observed hosts checked against our reputation cache had no malicious or suspicious classification; however, the executable is unsigned.
The antivirus results provide strong support: none of the 71 antivirus engines that checked it flagged the file, and 71 engines contributed results. The combined sandbox verdict was clean, with no high-risk technique supported by a concrete artefact and no named injection target. Every distinct observed host was covered by the reputation check, and none had an adverse classification. No malware-specific community rule, public malware-database entry, malicious child, packing indicator, or brand conflict was present. The main limitation is that the executable is unsigned and our static analysis was unavailable, so publisher identity and internal code were not independently verified.
What We Detected
None of the 71 antivirus engines that checked it flagged the executable, while 71 engines returned an analysis result. Major engines including Avast, BitDefender, ESET, Kaspersky, and Fortinet reported no detection. No malware-specific rule, public malware-database entry, packing indicator, or conflicting brand claim was found.
Threat Behavior
The combined sandbox verdict was clean. The run contacted Office-related service infrastructure, and the reputation check covered all nine distinct observed domains and IP addresses without identifying a malicious or suspicious host. A T1055 mapping appeared without a named target or other injection artefact, so it does not show that process injection occurred.
What To Do Now
The evidence supports normal use if the installer was obtained through the intended official release channel. Because the executable is unsigned and its internal code was not examined by our static analysis, keep security software enabled and obtain a fresh copy from the official Microsoft download channel if its origin is uncertain.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so its claimed product identity cannot be authenticated through a publisher certificate.
- It was first seen on Oct 21, 2026 and has only 48 distinct submitters, providing less historical assurance than widely established software.
- Our static analysis was unavailable because the bytes were not uploaded, so the executable's internal code was not examined directly.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the executable, and 71 engines returned results.
- The combined sandbox verdict was clean, with no named process-injection target or other high-risk artefact.
- All nine distinct observed hosts were checked, with no malicious or suspicious reputation result.
- No malicious child, persistence indicator, packer, malware-specific community rule, or public malware-database entry was identified.
- The executable is unsigned, so no publisher certificate authenticates its origin.
- It was first seen on Oct 21, 2026 and has a moderate submission history rather than long-established prevalence.
- Its internal code was not examined by our static analysis because the bytes were not uploaded.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 18sandbox rule tags
- 4spawned processes
- 8network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1112
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1539
- T1553
- T1553.002
- T1573
- T1574· Execution hijack
Observed activity
Processes started
4Programs the file ran, with their command lines.
OfficeSetup.exe"C:\Users\<USER>\Desktop\OfficeSetup.exe"OfficeSetup.exeOfficeSetup.exe RELAUNCHEDOfficeSetup.exe"C:\Users\user\Desktop\OfficeSetup.exe"OfficeSetup.exeC:\Users\user\Desktop\OfficeSetup.exe OfficeSetup.exe RELAUNCHED
Network contacts
88 hosts, listed as 3 domains, 5 addresses, 1 link. Links show the host and path only.
- Domain
f.c2r.ts.cdn.office.net - Domain
atm.office.mira.tm.svc.cloud.microsoft - Domain
mrodevicemgr.officeapps.live.com - IP address
23.1.254.203 - IP address
52.110.7.28 - IP address
52.123.250.165
Show all 9 entries for network contacts
- IP address
52.110.7.45 - IP address
20.184.175.15 - URL
http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20232.cab
Files
17Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7129C951-035E-466A-86D2-4B8D3D612DCA - Written
C:\Users\<USER>\AppData\Local\Temp\DESKTOP-ET51AJO-20261021-1728.log - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db-journal - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db-wal - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db-shm
Show all 17 entries for files
- Written
C:\Users\user\AppData\Local\Microsoft - Written
C:\Users\user\AppData\Local\Microsoft\Office - Written
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E41A790F-EBE9-465F-9657-E22EC0F7BD06 - Written
C:\Users\user\AppData\Local\Microsoft\Office\OTele - Written
C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db-shm - Written
C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db-wal - Written
C:\Users\user\AppData\Local\Microsoft\Windows\History - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db-journal - Deleted
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\69EFED41-A4B1-4C75-AD8F-F351E4965F9E
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188019605CC608 - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20527&telemetryRegion=GLOBAL&crev=3 - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20527&telemetryRegion=GLOBAL&crev=3\0
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officesetup.exe - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officesetup.exe\ULSMonitor - Set
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\IdentityCRL\ClockData - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20527&telemetryRegion=GLOBAL&crev=3\0\FilePath - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20527&telemetryRegion=GLOBAL&crev=3\0\StartDate - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20527&telemetryRegion=GLOBAL&crev=3\0\EndDate - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20527&telemetryRegion=GLOBAL&crev=3\0\Properties - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20527&telemetryRegion=GLOBAL&crev=3\0\Url - Set
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officesetup.exe\ULSMonitor\ULSTagIds0
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Office.16.916BB0BF-2D21-4499-83C7-555DB4C3F8E8Local\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office16\Sessions\1\BaseNamedObjects\Office.16.916BB0BF-2D21-4499-83C7-555DB4C3F8E8\Sessions\1\BaseNamedObjects\Local\OfficeSetupBootstrapper\Sessions\1\BaseNamedObjects\Local\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office16
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 7 entries for sandbox background — not the file
- VM host
atm.teams.mira.tm.svc.cloud.microsoft
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 40d4cf4864d95fcb87fd…fa0bccNot checkedno saved verdict
- 9303d6c925f9ba4b82c4…1c52e6Not checkedno saved verdict
- 6f226dd4b3300ea7edbd…4b07a3Not checkedno saved verdict
- 425989302af1187cce9d…b88e66Not checkedno saved verdict
- 194e4e8770cd5762da46…391caaNot checkedno saved verdict
- 0503015b3fb47813d66c…8f9ff1Not checkedno saved verdict
- f2204c20cb654455e1e3…b1488fNot checkedno saved verdict
- 9880b86dc66213b89e17…b03ee6Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 27, 2026, 3:52 AM UTC
- SHA-256
fc7795c5ed892f52ee54a104c35b2ac0a0b0e4c0701e119c98eb17cbff2753a0- SHA-1
621f6a5bcf5a4ec654a45eafb8bc5d2fc5d69b3c- MD5
a652f25934182befe61e6f294ca54131
About this file
OfficeSetup.exe is a Win32 EXE file of 7.3 MB.
- Type and size
- Win32 EXE · 7.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 21, 2026On VirusTotal.
- Submitted by
- 48 distinct sources
- Packer
- None detected
- Entropy
- 6.12 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is OfficeSetup.exe safe?
What is OfficeSetup.exe?
How many antivirus engines detected OfficeSetup.exe?
What is the SHA-256 hash of OfficeSetup.exe?
Is it safe to run OfficeSetup.exe?
How up to date is this analysis of OfficeSetup.exe?
Community
Member reviews and reports for this exact file hash.