File scan report
Verdict Safe
Is Capys-
Only Bkav flagged this archive among 75 engines, while stronger engines, completed observation from the test run, host checks, and external intelligence supplied no corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 1d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone Bkav detection appears likely to be a false positive: none of the stronger engines flagged the archive, and the combined sandbox verdict was clean. No named injection target, malicious contacted host, malicious file it created, MalwareBazaar entry, or malware-specific YARA rule corroborates it, although direct static inspection was unavailable.
Only 1 of the 66 antivirus engines that checked it flagged the archive, and that was Bkav using a generic label; all 18 reporting major antivirus engines were silent. Two completed sandbox runs produced a combined clean verdict and recorded no named injection target or other high-risk technique with supporting evidence. The T1055, T1486, and mappings lacked the artefacts needed to show process injection, file encryption, or defence tampering. Reputation checks covered all three distinct observed hosts and found none marked malicious or suspicious, while the inspected children contained no harmful verdict. The main uncertainty is the absence of our static analysis and the archive's limited history since it was first seen on Nov 2, 2026.
What We Detected
Only Bkav flagged the archive, using the generic label W32.Malware.DF99DCD5. The other 74 engines did not flag it, including all 18 reporting major antivirus engines. No malware-specific YARA rule, MalwareBazaar entry, or named malware family supported the isolated result.
Threat Behavior
Two completed sandbox runs produced a combined clean verdict. All three distinct observed hosts were covered by reputation checks, with none marked malicious or suspicious, and no inspected child had a harmful verdict.
What To Do Now
The available evidence strongly suggests that Bkav's generic detection is a false positive. Because our static analysis was unavailable and the archive contains executable material, obtain it from the expected source, keep security software enabled, and rescan if its contents or source differ from what you expected.
Where this verdict could be wrong3 caveats
- Bkav labels the archive W32.Malware.DF99DCD5, although no other engine corroborates that generic detection.
- The archive was first seen on Nov 2, 2026 and has only 42 distinct submitters, so its history is not yet a strong benign anchor.
- Our static analysis was unavailable, so the archive's internal files and code were not directly inspected.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 66 antivirus engines that checked it flagged the archive, and none of the 18 reporting major antivirus engines did.
- Two completed sandbox runs produced a combined clean verdict with no named injection target.
- Reputation checks covered all three distinct observed hosts and found none marked malicious or suspicious.
- No inspected child had a harmful verdict; one child matched a known-software reference entry.
- No MalwareBazaar entry or malware-specific YARA rule was found.
- Bkav reports a generic malware label, although no other engine corroborates it.
- The archive contains executable material and was first seen on Nov 2, 2026, with 42 distinct submitters.
- Direct static inspection of the archive contents was not available.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 20sandbox rule tags
- 9spawned processes
- 3network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
20MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1069
- T1071· Application protocol
- T1074
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1140· Deobfuscation
- T1485
- T1486· File encryption
- T1497· Sandbox evasion
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
9Programs the file ran, with their command lines.
AnimeAdventuresMacro.exe"C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91/AnimeAdventuresMacro.exe"AutoHotkey.exe"C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedRuntime\2eab99848ebc07f8ab0cc448bf69af8c700b2fc7fcd1ff8794df743dcc58da51\AutoHotkey.exe" /ErrorStdOut /CP65001 *curl.exe"C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91/Other/Assets/Other/Transport/curl.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91/Other/RapidOcr/64bit/RapidOcrOnnx.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91/Other/WebView2/64bit/WebView2Loader.dll",#1msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AutoHotkey.exe --webview-exe-version=2.0.30 --user-data-dir="C:\Users\<USER>\AppData\Local\CapysAnimeAdventuresMacro\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4268.5496.12432403763665856288
Show all 9 entries for processes started
msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\<USER>\AppData\Local\CapysAnimeAdventuresMacro\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\<USER>\AppData\Local\CapysAnimeAdventuresMacro\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --annotation=plat=Win64 "--an…unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\Capys-AA-Macro-v3.91.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\43nrma3s.qad" "C:\Users\user\Desktop\Capys-AA-Macro-v3.91.zip"
Network contacts
33 hosts, listed as 2 domains, 1 address, 1 link. Links show the host and path only.
- Domain
macro.example - Domain
api.github.com - IP address
140.82.113.5 - URL
https://api.github.com/repos/capybarnia4life/AnimeAdventuresMacro/releases/latest
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedRuntime\2eab99848ebc07f8ab0cc448bf69af8c700b2fc7fcd1ff8794df743dcc58da51\3568-648447a71069c517.tmp - Written
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedRuntime\2eab99848ebc07f8ab0cc448bf69af8c700b2fc7fcd1ff8794df743dcc58da51\AutoHotkey.exe - Written
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedRuntime\7b99cd06ab33ff84d5425718ff2d2494842aba5eab49dd39d43157ea53ca5d0e\3568-929eaec1f57bba6f.tmp - Written
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedRuntime\7b99cd06ab33ff84d5425718ff2d2494842aba5eab49dd39d43157ea53ca5d0e\PolicyCore.dll - Written
C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91\Images\Detection\AA\UnitAbility\auto-off.png - Written
C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91\Images\Detection\AA\UnitAbility\auto-on.png
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91\Settings.ini.{8B89E230-3BBB-43F4-A8B4-5E81BFB73B09}.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91\Settings.ini - Written
C:\Users\<USER>\AppData\Local\Temp\Capys-AA-Macro-v3.91\Logs\LogFile.txt - Written
C:\Users\<USER>\AppData\Local\CapysAnimeAdventuresMacro\UI\e2dc3e6bf4b803aeb7823bf967cf083a7cf79cdc703561520485f3555f548cfc\GuideImages\Planet-Greenie-Overview.png - Written
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\18f85e0c3ccfb8d8cabeaa0cd29854c0b9e4edefb59224fce6b8cb1045926ada\aa.css.4268.204152326.tmp - Written
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\18f85e0c3ccfb8d8cabeaa0cd29854c0b9e4edefb59224fce6b8cb1045926ada\aa.css - Written
C:\Users\<USER>\AppData\Local\CapysAnimeAdventuresMacro\UI\e2dc3e6bf4b803aeb7823bf967cf083a7cf79cdc703561520485f3555f548cfc\aa.css - Written
C:\Users\<USER>\AppData\Local\CapysAnimeAdventuresMacro\UI\e2dc3e6bf4b803aeb7823bf967cf083a7cf79cdc703561520485f3555f548cfc\GuideImages\Anime-Adventures-Settings.png - Written
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\555522673dededeeee09cb9dab1bea2ddcf50a7b47d1844f9d4681506ee766c9\index.html.4268.738530053.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedRuntime\2eab99848ebc07f8ab0cc448bf69af8c700b2fc7fcd1ff8794df743dcc58da51\3568-648447a71069c517.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedRuntime\7b99cd06ab33ff84d5425718ff2d2494842aba5eab49dd39d43157ea53ca5d0e\3568-929eaec1f57bba6f.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\18f85e0c3ccfb8d8cabeaa0cd29854c0b9e4edefb59224fce6b8cb1045926ada\aa.css.4268.204152326.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\555522673dededeeee09cb9dab1bea2ddcf50a7b47d1844f9d4681506ee766c9\index.html.4268.738530053.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\420de44046fc2fa334577e1c227b03f62b95294297474f4ced71ba059add2615\style.css.4268.2097390176.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\944eb5c2b039060b63a0048cde0f7caef61e303c10cef17b1c35c92f8dcc0f5a\compact.css.4268.357934187.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\5c57bc872d89143f50d1b3daee1a37dfcfdd2faf66229d6f3a69bc0e4766f69a\runtime.css.4268.2042229888.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\a1a57c2cef72f0bae4ff5e7a27736fb42d6efd13c8593e662dc5c63af0efe9cc\runtime.js.4268.599666041.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\ab379840f4048a32df466d81c06605cb8d48b228d58afd82df4b8bc9eea19724\guides.js.4268.1106530377.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\a41b8883a95d42ebd26b6f245932cdbfd8b53c52386fdf25cec41325a66626f7\guides.css.4268.2124313092.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\719f28a2713e6c9faffc24b8bf1e8173fe24d794fc0e4c77796d93ac9aa072d0\updater.js.4268.1033077742.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\74ef74bc266cac52d8824d570a4019e1a26e54d2c893fb63c7bb575f60f37f5e\updater.css.4268.1059515722.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\f828bf34002c03a37da4acecfd0cf214935c4c6c26d4bc48903457ba6c44e606\lucide.js.4268.1032036858.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAA-EmbeddedAssets\6d0a831fc19b4bae851797ad3393157e861afb7862459c11226359b27e2c4337\sortable.js.4268.133765278.tmp - Deleted
C:\Users\<USER>\AppData\Local\CapysAnimeAdventuresMacro\UI\e2dc3e6bf4b803aeb7823bf967cf083a7cf79cdc703561520485f3555f548cfc\assets.json.{693850BE-FB37-4983-B533-38F2081B37FD}.tmp
Registry and auto-start
16Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\UsageStatsInSample - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\urlstats - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.cdm.origin_data
Show all 16 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.storage_id_salt - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.account_id - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_username - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\default_search_provider_data.template_url_data - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\safebrowsing.incidents_sent - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\pinned_tabs - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\search_provider_overrides - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_account_id - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.startup_urls - Deleted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\CapysAAMacroInteractiveAHK KeybdAHK MouseGlobal\SyncRootManagerLocal\Mutexf01b4d95cf55d32a.automaticDestinations-msLocal\Mutex5f7b5f1e01b83767.automaticDestinations-ms
Show all 10 entries for mutexes
Local\WERReportingForProcess2836Global\a46fe832-5d94-4e0b-b674-dba042f70fc0Local\WERReportingForProcess5280Global\aa691e01-537a-47af-8ee2-d9b489b3a196
Sandbox background — not the file
5The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2836 -s 476 - VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5280 -s 448 - VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 7b99cd06ab33ff84d542…ca5d0eNot checkedno saved verdict
- ab379840f4048a32df46…a19724Not checkedno saved verdict
- 6d0a831fc19b4bae8517…2c4337Cleantrust 85known-software reference set · not scanned here
- f828bf34002c03a37da4…44e606Not checkedno saved verdict
- b3eefdc2420dd4e91c87…131ca0Not checkedno saved verdict
- 719f28a2713e6c9faffc…a072d0Not checkedno saved verdict
- 2eab99848ebc07f8ab0c…58da51Not checkedno saved verdict
- a1a57c2cef72f0bae4ff…efe9ccNot checkedno saved verdict
- e2dc3e6bf4b803aeb782…548cfcNot checkedno saved verdict
- fe47f5ff6e1452e4e025…77fa3dNot checkedno saved verdict
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- BkavW32.Malware.DF99DCD5
File fingerprint
- Last analyzed
- Nov 3, 2026, 5:10 AM UTC
- SHA-256
52cb82871633a06c44efb7e0106a2d7bef8f35221d610c377668c99f6204a607- SHA-1
fafa4e76a61d4bd62692514a1c9772fe38a4ab67- MD5
f5175745e7c713e3bc8657fa60fa5673
About this file
Capys-AA-Macro-v3.91-1.zip is a ZIP file of 82.8 MB.
- Type and size
- ZIP · 82.8 MB
- Signer
- Not applicable
- First seen
- Nov 2, 2026On VirusTotal.
- Submitted by
- 42 distinct sources
First scanned
Antivirus consensus
1 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust13 engines1flagged
View all 75 engine results
- BkavMalicious: W32.Malware.DF99DCD5
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Capys-AA-Macro-v3.91-1.zip safe?
What is Capys-AA-Macro-v3.91-1.zip?
How many antivirus engines detected Capys-AA-Macro-v3.91-1.zip?
What is the SHA-256 hash of Capys-AA-Macro-v3.91-1.zip?
Is it safe to open or extract Capys-AA-Macro-v3.91-1.zip?
How up to date is this analysis of Capys-AA-Macro-v3.91-1.zip?
Community
Member reviews and reports for this exact file hash.
