EchoTrail

setup.exe

by Various
Installer

Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.

Summary

Generic setup executable - common name for software installation programs across many vendors.

setup.exe is the 285th most commonly executed Windows program in EchoTrail's dataset, observed 38,490 times across enterprise environments. It typically runs from C:\Windows\Temp\... and it is most often launched by setup.exe.

Get this in your tools

The same record for setup.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/setup.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

285th
most commonly executed Windows program
38,490
observed endpoint executions

Behavior

Top Paths

  • C:\Windows\Temp\...17.85%
  • C:\Users\...2.18%
  • C:\...1.19%
  • C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.139\Installer1.11%
  • C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer1.02%
  • C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.181\Installer1%
  • C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\Installer0.94%
  • C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.167\Installer0.52%
  • C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.87\Installer0.47%
  • C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.140\Installer0.41%
  • C:\Program Files (x86)\Microsoft\Edge\Application\154.0.4258.37\Installer
  • C:\Program Files (x86)\Microsoft\Copilot\Application\154.0.4258.37\Installer
  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\154.0.4258.37\Installer
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{12990D19-719B-4D82-8585-9DD9141223DA}\EDGEMITMP_0DBA6.tmp
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{13F2253B-89F5-4E07-BC61-79C24EF3729B}\EDGEMITMP_20F36.tmp
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{82D4DFE6-F84B-4563-91B5-190E2F160658}\EDGEMITMP_8D8E8.tmp
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7E040E5-C605-4325-8BA9-E41FFA9E7339}\EDGEMITMP_555D3.tmp
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2523F584-DC02-46A8-88AA-4C88A8BD17FE}\EDGEMITMP_D4949.tmp
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1B405149-5C99-4EF4-8F10-21D5C98BD097}\EDGEMITMP_E409B.tmp
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF2D5A0E-5B4E-492E-880A-B5292B68C8C2}\EDGEMITMP_ACF2B.tmp

Top Hashes (SHA256)

  • 324c211392c9508d9d8e5ffd1665ef6cb572c014c537b078c3bef2f5894ac2661.75%
  • cd868b9ef21df50a5b9547c77ae64faec819f6d7184dc802ee097245c92bd88e1.69%
  • 159ef7c593f56adcd04436c95f068b2f8fbbf0f5b7133f6b61768ec2fbe319ab1.67%
  • 102a9ddda37de78bd4732c49d796e30959b468cfbfa469e753bd394f40c5547b1.53%
  • 9622313cf4884cd11143ce82e26521910833972d438ecc94e9fbafe6e3077cb10.84%
  • a3edf6596c749072f10741dcf2a642e7fd099dd3e196e10bfa519b73501447770.83%
  • 4b3fdc67790a96248c86d95f066db5f82884abb8ac952c34cafebe882caca7d70.65%
  • ed62c2ae7dd83a389ee7fead07f344f0ac693fdc40ff4a05fa28571509b433d90.47%
  • b1f00d88fe968a0001116083f9b3a5c5094443f8a742d716ea37f23d70928ab10.47%
  • 0252c32a930c7c19bf0c5f81881d504b986035573ce8af461cb5e76f28f757f60.47%
  • f3ab7c66413d072a3471acf3098ccc5eac29ed4c23337b6ba5c88e9a0e565900
  • 28534cdb3a148ca4006103be9930b0b8c3e64b2dc9d8619208e659343cd82780

Code Signing

Signers by share of executions

  • Microsoft CorporationValid
    Embedded signature · 4 hashes
    93.19%
    Chain
    1. Microsoft Corporation
    2. Microsoft Code Signing PCA 2024
    3. Microsoft Root Certificate Authority 2011
    Valid
    • Apr 16, 2026 to Apr 15, 2027
    Hashes
    • ce0a78fa55546b90d1994432472d471d7a60f5d32afa83bff361bf35af2b3a4139.43% of executions, first seen Sep 19, 2026
    • f3ab7c66413d072a3471acf3098ccc5eac29ed4c23337b6ba5c88e9a0e56590039.07% of executions, first seen Sep 25, 2026
    • eace106bc15b93bff2a0cf6ec348f4402d509c4b420a3daec2d0bd134707acda12.9% of executions, first seen Sep 15, 2026
    • 7566b0f5ff6242e8f6381b0b2bd9173ccd1cd774ee1a9007b9ae2d325336aa261.79% of executions, first seen Sep 16, 2026
  • Google LLCValid
    Embedded signature · 1 hash
    6.45%
    Chain
    1. Google LLC
    2. DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    3. DigiCert Trusted Root G4
    Valid
    • Apr 8, 2024 to Apr 10, 2027
    Hashes
    • c23ec8d10b964a7c5c449dbced1cc6feab7d3ff9d33ae5b56e6eec97c41115e26.45% of executions, first seen Sep 10, 2026
  • Adobe Inc.Valid
    Embedded signature · 1 hash
    0.36%
    Chain
    1. Adobe Inc.
    2. DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    3. DigiCert Trusted Root G4
    Valid
    • Oct 6, 2025 to Oct 5, 2027
    Hashes
    • 8cd5ae216bb155acf56f092cfc576fb6bcae96dc7332195c391595940dc82dbf0.36% of executions, first seen Sep 25, 2026

Full certificate detail on Team.

Process Ancestry

Top Grandparents

Top Parents

Top Children

Lab record

Installed from
winget Microsoft.WindowsSDK.10.0.22621 10.0.22621.2428
Publisher
Microsoft Corporation
Persistence
none
Network
none
Command lines
37 patterns (65 launches)
DLL loads
129 patterns (3,220 loads)
Registry writes
560 patterns (17,898 writes)
File writes
1,732 patterns (10,040 writes)
HTTP requests
0 patterns (0 requests)
TLS connections
0 patterns (0 handshakes)
Named pipes
2 patterns (20 events)
Process access
5 patterns (32 events)
Driver loads
12 patterns (12 loads)
PowerShell blocks
0 patterns (0 blocks)
Remote threads
0 patterns (0 events)
Audit events
0 patterns (0 events)

Full record on Team.

Ask Rocky about setup.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for setup.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.