File scan report
Verdict Safe
Is Horror Night 1.
Zero detections across 75 engines and benign sandbox behaviour on a ZIP archive.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 63 flagged
- Flagged 0
- No detection 63
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No engine flagged the file. Sandbox activity was limited to system-info discovery and Windows error reporting. Four of five similar ZIP files previously received safe verdicts.
The file triggered no malicious detections from any of the 75 engines, including 17 major antivirus engines. Sandbox execution produced only routine system queries and no offensive MITRE techniques. While the file is rare and prior ZIP archives with the same matchKind have consistently been classified safe. The single rule that fired notes that direct-IP traffic can occur in legitimate installers, so it does not override the clean engine consensus.
What We Detected
75 engines scanned the ZIP; none returned a malicious or suspicious result. Sandbox execution recorded two direct-no complete contacted-host reputation result was available system queries (T1082) but no malicious indicators.
Threat Behavior
No dropped malicious files it created, no persistence mechanisms, and no control-server domains were observed. The rule-based warning about direct-IP traffic is noted but does not constitute a confirmed malicious signal without host-reputation data.
What To Do Now
The archive can be treated as clean for normal use. Continue to keep security software enabled when handling any or rare files.
Where this verdict could be wrong1 caveat
- contactedHosts is null — no complete host-reputation result available for the two direct-IP addresses observed in the sandbox's contacted-IP list.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero malicious detections across 75 engines
- Sandbox verdict clean
- Four prior similar ZIP files classified safe
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 1sandbox rule tag
- 1spawned processes
- 2network contacts
- 5filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
1MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1082· System recon
Observed activity
Processes started
1Programs the file ran, with their command lines.
msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "C:\Users\<USER>\AppData\Local\Temp\modlist.html"
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
150.171.109.114 - IP address
150.171.74.13
Files
5Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\78c76c95-e452-4d20-9cd9-8f74be765ded - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\0afc9114-2c4d-4eea-a5f7-cb91468f1324 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5064 -s 3768
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- c68afb7490db83943664…51f5deNot checkedno saved verdict
- a64be6681fb442371091…ba9e2cNot checkedno saved verdict
- b288d01cb72a4242be98…697c84Not checkedno saved verdict
- 609e34908b1bd8dcb070…306b27Not checkedno saved verdict
Chapter 04
Technical details
None of the 63 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 26, 2026, 10:45 PM UTC
- SHA-256
8d9efde0fd7ae5e7952d160347643af206702251d6c692faf0592bb7385f999e- SHA-1
a1228ea338f92f345f845dd90e5c0a5b547a25bb- MD5
1f09273cb7c40ef17e071bec2d903d46
About this file
Horror Night 1.20.1.zip is a ZIP file of 7.3 MB.
- Type and size
- ZIP · 7.3 MB
- Signer
- Not applicable
- First seen
- Aug 26, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Verdict history
- Not fully confirmed
- Safeafter a new scan
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 63 engines flagged this file
12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Horror Night 1.20.1.zip safe?
What is Horror Night 1.20.1.zip?
How many antivirus engines detected Horror Night 1.20.1.zip?
What is the SHA-256 hash of Horror Night 1.20.1.zip?
Is it safe to open or extract Horror Night 1.20.1.zip?
How up to date is this analysis of Horror Night 1.20.1.zip?
Community
Member reviews and reports for this exact file hash.