setup.exe
Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.
Summary
Generic setup executable - common name for software installation programs across many vendors.
setup.exe is the 285th most commonly executed Windows program in EchoTrail's dataset, observed 38,490 times across enterprise environments. It typically runs from C:\Windows\Temp\... and it is most often launched by setup.exe.
Get this in your tools
The same record for setup.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/setup.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\Temp\...17.85%
- C:\Users\...2.18%
- C:\...1.19%
- C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.139\Installer1.11%
- C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer1.02%
- C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.181\Installer1%
- C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\Installer0.94%
- C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.167\Installer0.52%
- C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.87\Installer0.47%
- C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.140\Installer0.41%
- C:\Windows\SystemTemp\Google6736_516621414\bin\Offline\{61a50c54-23c9-4144-bef1-a674ff0b9fa0}\{8A69D345-D564-463c-AFF1-A69D9E530F96}\CR_CB68E.tmp
- C:\lab\in
- C:\Program Files\Google\Chrome\Application\153.0.8010.37\Installer
- C:\Users\lab\AppData\Local\Temp\is-R7DMA.tmp\Installer
- C:\Users\lab\AppData\Local\Temp\is-GVN0F.tmp\Installer
- C:\Users\lab\AppData\Local\Temp\is-VRDM9.tmp\Installer
Top Hashes (SHA256)
- 324c211392c9508d9d8e5ffd1665ef6cb572c014c537b078c3bef2f5894ac2661.75%
- cd868b9ef21df50a5b9547c77ae64faec819f6d7184dc802ee097245c92bd88e1.69%
- 159ef7c593f56adcd04436c95f068b2f8fbbf0f5b7133f6b61768ec2fbe319ab1.68%
- 102a9ddda37de78bd4732c49d796e30959b468cfbfa469e753bd394f40c5547b1.53%
- 9622313cf4884cd11143ce82e26521910833972d438ecc94e9fbafe6e3077cb10.84%
- a3edf6596c749072f10741dcf2a642e7fd099dd3e196e10bfa519b73501447770.83%
- 4b3fdc67790a96248c86d95f066db5f82884abb8ac952c34cafebe882caca7d70.65%
- ed62c2ae7dd83a389ee7fead07f344f0ac693fdc40ff4a05fa28571509b433d90.48%
- b1f00d88fe968a0001116083f9b3a5c5094443f8a742d716ea37f23d70928ab10.47%
- 0252c32a930c7c19bf0c5f81881d504b986035573ce8af461cb5e76f28f757f60.47%
- c23ec8d10b964a7c5c449dbced1cc6feab7d3ff9d33ae5b56e6eec97c41115e2
- 80ae30c0fadab9f8377383d0f48321e611ca51f7e7d22f0d0b0ccb53748f1521
- 50facf295f357d8230b4d50678536148e32f34b4ac33387269d5a72c93ff810a
Process Ancestry
Top Grandparents
- GoogleUpdate.exe44.58%
- setup.exe8.44%
- services.exe6.38%
- userinit.exe1.33%
- Windows10Upgrade.exe1.06%
- svchost.exe0.68%
- explorer.exe0.64%
Top Parents
- setup.exe59.03%
- GoogleUpdate.exe4.58%
- explorer.exe0.91%
- Adobe Installer.exe0.38%
- runonce.exe0.29%
- chrome_installer.exe0.25%
- msedge.exe0.16%
- powershell.exe0.15%
Top Children
- setup.exe90.33%
- wevtutil.exe5.26%
- msedge.exe0.77%
- wermgr.exe0.31%
- rundll32.exe0.24%
- regsvr32.exe0.21%
- TokenResolverx64.exe0.19%
Lab record
- Installed from
- winget Microsoft.Office 16.0.20228.20124
- Publisher
- Microsoft Corporation
- Persistence
- none
- Network
- 3 destinations
- Command lines
- 8 patterns (11 launches)
- DLL loads
- 171 patterns (576 loads)
- Registry writes
- 385 patterns (1,447 writes)
- File writes
- 40 patterns (337 writes)
- HTTP requests
- 0 patterns (0 requests)
- TLS connections
- 3 patterns (3 handshakes)
- Named pipes
- 10 patterns (20 events)
- Process access
- 0 patterns (0 events)
- Driver loads
- 0 patterns (0 loads)
- PowerShell blocks
- 0 patterns (0 blocks)
- Remote threads
- 0 patterns (0 events)
- Audit events
- 6 patterns (9 events)
Full record on Team.
Ask Rocky about setup.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for setup.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.