Safe
ZIP archive with zero malicious detections across 17 tier-1 engines and medium prevalence; benign .NET software distribution.
0a2d2100e53133c03d…7b14bac613The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The evidence overwhelmingly supports a benign classification. Zero malicious detections across a comprehensive tier-1 engine set (Avast, AVG, Avira, BitDefender, DrWeb, Emsisoft, ESET-NOD32, F-Secure, Fortinet, GData, Ikarus, Kaspersky, Microsoft) combined with medium prevalence (1,909 submitters, 2,172 submissions) indicates a legitimate, widely-known software archive. The filename pattern 'ProdKeys.NET-v22.0.0' is consistent with a .NET utility distribution. No runtime behaviour data, dropped children, malicious host contacts, or external intelligence hits were recorded. The absence of triggered heuristics and adversarial input flags further supports a clean classification.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1Malicious=0; 17 tier-1 engines (Avast, BitDefender, Kaspersky, Microsoft, ESET-NOD32, Fortinet, Emsisoft, F-Secure, Ikarus, GData, DrWeb, Avira, AVG) all undetected
prevalence.classification='medium' — 1909 unique submitters, 2172 submissions, 88 days in circulation with reputation=0
No sandbox behaviour data, no dropped children, no malicious contacted hosts, no external intel hits (CIRCL, MalwareBazaar, YARAify all negative)
Unsigned ZIP archive; no brand mismatch; triggeredHeuristics empty; no adversarial input flags
Filename 'ProdKeys.NET-v22.0.0.zip' consistent with legitimate .NET software distribution; hasNumericVersion=true, looksLikePortable=true
- 17 tier-1 antivirus engines (Kaspersky, BitDefender, Microsoft, ESET-NOD32, Fortinet, Emsisoft, F-Secure, Ikarus, GData, DrWeb, Avira, AVG, Avast) all undetected
- Medium prevalence: 2,172 submissions from 1,909 unique sources over 88 days
- Zero reputation score with no malicious community reports
- No sandbox execution, dropped children, or malicious host contacts
- Filename and versioning pattern consistent with legitimate .NET software distribution
This file is safe to use. It shows no malicious indicators across our antivirus network and has been widely distributed without incident. If obtained from an official source, proceed with confidence.
0 detections across 74 engines
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- ProdKeys.NET-v22.0.0.zip
- Size
- 7.2 KB
- MIME type
- (unknown)
- Detected type
- ZIP
- SHA-256
- 0a2d2100e53133c03d5ce08eb78c36cd305555c057b885a76510ba7b14bac613
- MD5
- 38db60641aa3015479be6f7c60c6903d
- SHA-1
- 3927c0e86eb5a9c37da98b9e7486da49c3e38392
- First seen (VT)
- 4/7/2026, 7:14:05 AM
- Last analysis (VT)
- 6/24/2026, 7:38:14 AM
- First scan (MalwareTips)
- 7/4/2026, 1:42:43 AM
- Last scan (MalwareTips)
- 7/4/2026, 1:42:43 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.