File scan report
Verdict Safe
Is Chip
None of the 61 antivirus engines that checked it flagged the archive, including 17 major antivirus engines, and it has circulated broadly since 2021.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One sandbox run returned clean, but the encrypted archive contains executables and one extracted child lacks a saved verdict, so verify the source before running them.
The strongest evidence is the absence of detections across 75 engines, including all 17 major participants. The archive is also well established, with 3,578 submitters and 7,205 submissions since 2021, which weighs against a newly distributed threat. A completed sandbox run extracted the contents and returned clean, with no persistence indicators or sample-attributed network contacts recorded. The technique mapping is a meaningful caution, but it lacks corroboration from engine detections, a hostile sandbox verdict, or external intelligence. Because the archive is encrypted and the recorded extracted child has no saved verdict, the contents should still be handled cautiously.
What We Detected
None of the 61 antivirus engines that checked it flagged the RAR archive, including 17 major antivirus engines. The file has been submitted 7,205 times by 3,578 sources since 2021, indicating broad and longstanding circulation. External researcher feeds supplied no malware-family or malware-specific YARA corroboration.
Threat Behavior
One completed sandbox run extracted the password-protected archive and returned a clean result. It recorded no persistence indicators and no sample-attributed network contacts. One extracted child has no saved verdict, so its status remains unconfirmed rather than benign.
What To Do Now
Obtain the archive from a trusted source and scan each extracted executable separately before launch. Keep security software enabled, and avoid running the contents with administrator privileges unless their origin and purpose are verified.
Where this verdict could be wrong3 caveats
- The sandbox mapped defense-impairment technique T1562.001, which warrants caution even though the run itself returned a clean result.
- The encrypted archive extracted executable content, and the one recorded file it created has no saved verdict, leaving its safety unconfirmed.
- Complete contacted-host reputation coverage is unavailable, although the completed run recorded no sample-attributed network contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 61 antivirus engines that checked it flagged the archive.
- All 17 major antivirus engines that returned results reported no detection.
- The file has circulated broadly since 2021, with 3,578 submitters and 7,205 submissions.
- The completed sandbox run returned clean and recorded no persistence indicators.
- No malware-specific external intelligence matched the file.
- The archive is encrypted and contains executable files, limiting direct inspection of its contents.
- One extracted child has no saved assessment, so its safety is not established.
- No complete contacted-host reputation result is available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 2spawned processes
- 0network contacts
- 8filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1562.001· Disables security
- T1574.002· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
unarchiver.exe"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\$RKNYRRD.rar"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\worhtbip.bzo" "C:\Users\user\Desktop\$RKNYRRD.rar"
Files
8Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Local\Temp\worhtbip.bzo - Written
C:\Users\user\AppData\Local\Temp\worhtbip.bzo\ChipGenius_v4_21_0701 - Written
C:\Users\user\AppData\Local\Temp\worhtbip.bzo\ChipGenius_v4_21_0701\ChipGenius_v4_21_0701.exe - Written
C:\Users\user\AppData\Local\Temp\worhtbip.bzo\ChipGenius_v4_21_0701\Chips.wdb - Written
C:\Users\user\AppData\Local\Temp\worhtbip.bzo\ChipGenius_v4_21_0701\FlashMaster.exe
Show all 8 entries for files
- Written
C:\Users\user\AppData\Local\Temp\worhtbip.bzo\readme.txt - Written
\Device\ConDrv\\Connect
Registry and auto-start
20Settings the file changed, including ways to start again after a restart.
- Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\drivers\ndis.sys[MofResourceName] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\System32\Drivers\portcls.SYS[PortclsMof] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\DRIVERS\HDAudBus.sys[HDAudioMofName] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\System32\Drivers\en-US\portcls.SYS.mui[PortclsMof] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\advapi32.dll[MofResourceName]
Show all 20 entries for registry and auto-start
- Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\en-US\advapi32.dll.mui[MofResourceName] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\drivers\en-US\mssmbios.sys.mui[MofResource] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\DRIVERS\en-US\HDAudBus.sys.mui[HDAudioMofName] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\drivers\en-US\ndis.sys.mui[MofResourceName] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\DRIVERS\en-US\intelppm.sys.mui[PROCESSORWMI] - Set
HKLM\Software\Microsoft\WBEM\WDM\IDE\DiskAMDX_HARDDISK___________________________2.5+____\5&2770a7af&0&0.0.0_0-{05901221-D566-11d1-B2F0-00A0C9062910} - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\DRIVERS\intelppm.sys[PROCESSORWMI] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\drivers\ACPI.sys[ACPIMOFResource] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\DRIVERS\monitor.sys[MonitorWMI] - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- d428d114c81b7231337c…e04420Not checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 10, 2026, 6:22 AM UTC
- SHA-256
3e04cdea83bdf44d66092ad39204ef87fc1a5f389ff8ced9e96dcc91483b697b- SHA-1
befa4afea08aa3148021c529ccd10f6ce149de9b- MD5
f86207a6626cfa1bcfc17e0682077796
About this file
ChipGenius_v4_21_0701.rar is an RAR file of 840.7 kB.
- Type and size
- RAR · 840.7 kB
- Signer
- Not applicable
- First seen
- Oct 3, 2021On VirusTotal.
- Submitted by
- 3,578 distinct sources
First scanned
Antivirus consensus
0 of 61 engines flagged this file
14 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-231 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmNo result
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ChipGenius_v4_21_0701.rar safe?
What is ChipGenius_v4_21_0701.rar?
How many antivirus engines detected ChipGenius_v4_21_0701.rar?
What is the SHA-256 hash of ChipGenius_v4_21_0701.rar?
Is it safe to open or extract ChipGenius_v4_21_0701.rar?
How up to date is this analysis of ChipGenius_v4_21_0701.rar?
Community
Member reviews and reports for this exact file hash.