File scan report
Verdict Suspicious
Is Anadius Updater Tool for Windows.
ZIP containing Sims 4 updater executable flagged as unwanted program by six major antivirus engines with defense-evasion behavior.
Read the whole reasonShow less
Why Suspicious? 14 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat as unwanted software. Avoid running the extracted executable and remove the archive to prevent potential system modifications or unwanted behavior.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
14 of 68 flagged
- Flagged 14
- No detection 54
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
3 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Six major antivirus engines consistently label the contained updater as unwanted program or crack-related software.
The sample shows clear unwanted program characteristics through multiple major antivirus engines detections focused on unwanted or cracked software. Medium prevalence and absence of strong major family consensus or sandbox malice prevent a full malicious classification. Overall mixed signals align with borderline unwanted program tooling.
What We Detected
ZIP archive extracts to sims-4-updater executable. Six major AVs flag PUP/PUA or crack variants; two additional less reliable engines call it malicious.
Threat Behavior
Tool exhibits anti-debug and long-sleep behavior typical of evasive utilities. No malicious files it created or confirmed control-server domains, but direct-IP usage bypasses normal DNS reputation checks.
What To Do Now
Do not execute the updater. Delete the archive and scan the system with a reputable AV. Obtain game updates only from official sources.
Where this verdict could be wrong1 caveat
- If the direct-IP rule-based reflects only Cloudflare infrastructure rather than a control server, the offensive MITRE flags could be overstated for a game-mod tool; however the unwanted program consensus from major antivirus engines still dominates.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No malicious files it created
- Medium prevalence with many submitters
- No sandbox malicious verdict
- Unwanted program detections from major antivirus engines
- Offensive MITRE techniques and T1562.001
- Anti-analysis tags present
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 6spawned processes
- 0network contacts
- 16filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Checked whether it was running on a test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
Anadius Updater Tool for Windows.zip
749ef77d0616070491a1e0a65795021fc9d0d29e657369529324688feb0ed4a6
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
sims-4-updater-v2.4.10.exe
"C:\Users\<USER>\AppData\Local\Temp\sims-4-updater-v2.4.10.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
sims-4-updater-v2.4.10.exe
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
mfc140u.dll
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\Pythonwin\mfc140u.dll
Test run - Evidence 5 of 5: Written fileSeen in the test run
win32ui.pyd
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\Pythonwin\win32ui.pyd
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1047
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1106
- T1486· File encryption
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
6Programs the file ran, with their command lines.
sims-4-updater-v2.4.10.exe"C:\Users\<USER>\AppData\Local\Temp\sims-4-updater-v2.4.10.exe"sims-4-updater-v2.4.10.exeunarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\616070491a1e0a65795021fc9d0d29e657369529324688feb0ed4a6.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\014tw3cc.smi" "C:\Users\user\Desktop\616070491a1e0a65795021fc9d0d29e657369529324688feb0ed4a6.zip"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\014tw3cc.smi\sims-4-updater-v2.4.10.exe"sims-4-updater-v2.4.10.exeC:\Users\user\AppData\Local\Temp\014tw3cc.smi\sims-4-updater-v2.4.10.exe
Files
16Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\Pythonwin\mfc140u.dll - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\Pythonwin\win32ui.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\VCRUNTIME140.dll - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\VCRUNTIME140_1.dll - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_asyncio.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_bz2.pyd
Show all 16 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_cffi_backend.cp310-win_amd64.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_ctypes.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_decimal.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_hashlib.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_lzma.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_multiprocessing.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_overlapped.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_queue.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI46842\_socket.pyd - Deleted
C:\Users\<USER>\AppData\Local\Temp\wpzz139z
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 21baa6669389d8284059…14844dNot checkedno saved verdict
- 360b2c9242365d6c0fda…be3d9aNot checkedno saved verdict
- cd2f60075064dfc2e65c…356b08Not checkedno saved verdict
- 2f4d915840c287c54188…066384Not checkedno saved verdict
- 036c32dc38a30a7f09ce…68d72dNot checkedno saved verdict
- ef59713151ac9ee78e13…470e48Not checkedno saved verdict
- 9362f48e2ade1ba5a991…43c204Not checkedno saved verdict
- 1947f8b188ab4ab6aa72…368fb7Not checkedno saved verdict
- 4a9d4a76514f399a9652…e2336dNot checkedno saved verdict
- d2a7999e234e33828888…723b6fNot checkedno saved verdict
Chapter 04
Technical details
14 of the 68 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- Avast (major engine)Other:PUP-gen [PUP]
- AVG (major engine)Other:PUP-gen [PUP]
- Avira (major engine)PUA/PUP
- F-Secure (major engine)PotentialRisk.PUA/PUP
- Sophos (major engine)Generic Reputation PUA (PUA)
- Symantec (major engine)PUA.Gen.2
- TrellixENS (major engine)Artemis!6DC3624A0D17
- CynetMalicious (score: 99)
File fingerprint
- Last analyzed
- May 20, 2026, 9:21 PM UTC
- SHA-256
749ef77d0616070491a1e0a65795021fc9d0d29e657369529324688feb0ed4a6- SHA-1
f2ec401be0d8bae6fd9ca751b4e0f3f896d3cd05- MD5
b6d0df97c73ea3b7b5ecaa90d1621099
About this file
Anadius Updater Tool for Windows.zip is a ZIP file of 20.9 MB.
- Type and size
- ZIP · 20.9 MB
- Signer
- Not applicable
- First seen
- Jan 3, 2026On VirusTotal.
- Submitted by
- 1,142 distinct sources
First scanned
Antivirus consensus
14 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 14 detections come from 12 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines5flagged7 vendors sharing 5 engines
- Tier-237 engines5flagged
- Low-trust13 engines2flagged
View all 75 engine results
- AvastMalicious: Other:PUP-gen [PUP]
- AVGMalicious: Other:PUP-gen [PUP]
- AviraMalicious: PUA/PUP
- CynetMalicious: Malicious (score: 99)
- DeepInstinctMalicious: MALICIOUS
- F-SecureMalicious: PotentialRisk.PUA/PUP
- GoogleMalicious: Detected
- GridinsoftMalicious: PUP.Win64.Gen.cl
- MaxSecureMalicious: Trojan.Malware.340867217.susgen
- PandaMalicious: PUP/Crack
- SophosMalicious: Generic Reputation PUA (PUA)
- SymantecMalicious: PUA.Gen.2
- TrellixENSMalicious: Artemis!6DC3624A0D17
- VaristMalicious: ABApplication.YD
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- Avast-MobileClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- FortinetClean
- GDataClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Anadius Updater Tool for Windows.zip safe, or is it malware?
What is Anadius Updater Tool for Windows.zip?
How many antivirus engines detected Anadius Updater Tool for Windows.zip?
What should I do if I already opened or extracted Anadius Updater Tool for Windows.zip?
What is the SHA-256 hash of Anadius Updater Tool for Windows.zip?
How up to date is this analysis of Anadius Updater Tool for Windows.zip?
Community
Member reviews and reports for this exact file hash.