File scan report
Verdict Malicious
Is Game
Twenty of the 64 antivirus engines that checked it flagged this archive, five major antivirus engines agreed on ForkBomb, and one extracted child drew 23 detections.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already opened or extracted it, follow the steps below.
What to do now4 steps
This ZIP archive is harmful. Don't open or extract it, and delete it.
If you haven't opened or extracted it
Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.
If you already opened or extracted it
If you already extracted it, delete the extracted files too and run a full antivirus scan.
If a page it opened asked for a password or card details and you entered them, change that password and call your bank.
It created a file that antivirus engines classify as malicious, so run a full scan, not a quick one.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
20 of 64 flagged
- Flagged 20
- No detection 44
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 7d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive has strong, independently corroborated ForkBomb detections: 20 of the 64 antivirus engines that checked it flagged it, including seven major antivirus engines. One extracted child was also identified by 23 of the 64 antivirus engines that checked it, while sandbox activity showed repeated batch-command execution.
Twenty of the 64 antivirus engines that checked it flagged the archive, with 12 independent detection sources after shared scanning technology was consolidated. Five major antivirus engines agreed on the ForkBomb family, while additional major antivirus engines supplied compatible trojan labels. An extracted child was independently identified by 23 of the 64 antivirus engines that checked it, strongly corroborating that the archive carries harmful content. Sandbox activity included repeated batch files launched through the Windows command interpreter and the creation of PowerShell-related files.
What We Detected
Twenty of the 64 antivirus engines that checked it flagged the archive. Seven major antivirus engines detected it, and five major antivirus engines agreed specifically on the ForkBomb family. The detections came from 12 independent scanning sources after products sharing the same underlying technology were consolidated.
Threat Behavior
The sandbox runs recorded repeated batch scripts launched through the Windows command interpreter, along with PowerShell-related files written to the temporary and profile areas. More importantly, an extracted child was detected by 23 of the 64 antivirus engines that checked it, independently corroborating the archive-level findings. Some automated technique mappings lacked supporting artefacts, so they do not establish process injection, PowerShell execution or file encryption by themselves.
What To Do Now
Do not open or extract this archive. Quarantine or remove it with security software kept enabled; if it was already run, perform a full system scan and review the affected account and device for unwanted changes.
Where this verdict could be wrong3 caveats
- Eight major antivirus engines did not detect the archive.
- The two inspected contacted hosts had no malicious or suspicious cached verdict.
- No malicious sandbox verdict was recorded, and the T1055, and mappings lacked the artefacts needed to substantiate those specific actions.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Eight major antivirus engines did not detect the archive.
- The inspected contacted hosts had no malicious or suspicious cached verdict.
- No sandbox run supplied a malicious verdict.
- Twenty of the 64 antivirus engines that checked it detected the archive.
- Seven major antivirus engines flagged it, with five agreeing on ForkBomb.
- One extracted child was detected by 23 of the 64 antivirus engines that checked it.
- The sandbox runs recorded repeated execution of batch scripts through the Windows command interpreter.
- The archive was first seen on Oct 31, 2026 and was submitted by only one source.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 26sandbox rule tags
- 15spawned processes
- 1network contact
- 23filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Created a file that antivirus engines classify as malicious.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Downloaded a file during the test run.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.
Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 6: FileSeen in the test run
GameBooterZero.zip
9ff3831a7d136f14c3d76caf348fd9f9eba1e36a486e0b3bc9f1880e47e9ab54
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 6: ProcessSeen in the test run
cmd.exe
"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/Cpu.bat^"
Test run - Evidence 3 of 6: ProcessSeen in the test run
cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/ffrks.bat
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 6: Dropped fileWorked out from other results
11ea65b2709bb714f059cf53767f7ee5ae6defe5b5d548e32375e65571b66015
A file it created, rated malicious.
Files it created - Evidence 5 of 6: Written fileSeen in the test run
iconcache_idx.db
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Test run - +1 more recorded observation
- 1
Network
Hosts contacted
- Evidence 6 of 6: Contacted hostSeen in the test run
dl.musicdel.ir
Contacted during the test run.
Test run
6 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
26MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1047
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1059.001· Runs commands
- T1064
- T1069
- T1071· Application protocol
- T1074
- T1082· System recon
- T1083· Scans your files
- T1105· Network file transfer
- T1112
- T1129· Loads modules
- T1202
- T1485
- T1486· File encryption
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1547· Auto-start
- T1547.001· Auto-start
- T1562· Disables security
- T1573
- T1574· Execution hijack
Observed activity
Processes started
15Programs the file ran, with their command lines.
cmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/Cpu.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/ffrks.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/System info32.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/Graphic.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/AcDe.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/Gpu.bat
Show all 15 entries for processes started
cmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/MwScOptimizer.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/Cpu.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/msmc.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/System info32.battimeouttimeout /t 3 /nobreakcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/Test.bat^"cmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/Hjjd.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\GameBooterZero/AcDe.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\SetUp.bat^"
Network contacts
11 host, listed as 1 domain. Links show the host and path only.
- Domain
dl.musicdel.ir
Files
21Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db - Written
C:\Users\<USER>\AppData\Local\Temp\desktop-hahaha.ps1 - Written
C:\Users\<USER>\AppData\Local\Temp\desktop-haha.ps1 - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Show all 21 entries for files
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\638fa095-7a8e-4e26-b9be-13e1b710efb7 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\368a867a-371b-41e8-9a11-d1f1b3340867 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\e25321e0-2d74-4243-aa27-2bbbe134465c - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\2870f812-5561-4d9a-8bf2-5b52f22766f3 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\67964e68-31dc-4b5d-b990-22c482c27c4d - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER916D.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A77.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8CD.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER916D.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A77.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8CD.tmp.xml
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000104BE\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000104E2\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000204FC\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001050A\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000303F0\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000080572\VirtualDesktop
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010520\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020490\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020122\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000030200\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000801F0\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000202E0\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020540\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000303C2\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000203FE\VirtualDesktop
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess4772Global\40232f99-e375-45e6-9edb-d36fe519af78
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
atm.teams.mira.tm.svc.cloud.microsoft
Files this sample writes at runtime
The sandbox saw this file drop 10 children. 1 of them is already known-malicious (in our database or listed in MalwareBazaar) — this file is a dropper.
- f946ec4faf158686332b…6c0f9eNot checkedno saved verdict
- 4ac58c74821b69741332…82f89fNot checkedno saved verdict
- 8b0031facea89189bb1f…2f8f4cNot checkedno saved verdict
- 11ea65b2709bb714f059…b66015Malicious23/74 enginestrust 8from our cache
- fb0660c5b5084a07d62d…acb279Not checkedno saved verdict
- 210e099e295346928376…507e72Not checkedno saved verdict
- fd804cda007919881862…40ae29Not checkedno saved verdict
- 848501080196c239fe63…4e57c1Not checkedno saved verdict
- 4d538c464188f66c0aa1…c3ca04Not checkedno saved verdict
- e1575364fbc21bbc5fbb…cbc112Not checkedno saved verdict
Chapter 04
Technical details
20 of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 20
- BitDefender (major engine)Application.ForkBomb.2
- Emsisoft (major engine)Application.ForkBomb.2 (B)
- ESET-NOD32 (major engine)BAT/ForkBomb.A trojan
- Fortinet (major engine)BAT/Forkbomb.B660!tr
- GData (major engine)Application.ForkBomb.2
- Ikarus (major engine)Win32.Outbreak
- Kaspersky (major engine)HEUR:Trojan.BAT.ForkBomb.gen
- Sophos (major engine)Troj/Bat-AEO
File fingerprint
- Last analyzed
- Nov 2, 2026, 6:39 AM UTC
- SHA-256
9ff3831a7d136f14c3d76caf348fd9f9eba1e36a486e0b3bc9f1880e47e9ab54- SHA-1
48f14c9c55c15e1071017ca07a1ab4db69fba925- MD5
6f566db49fde5a9fd75204083dd444a9
About this file
GameBooterZero.zip is a ZIP file of 17.3 kB.
- Type and size
- ZIP · 17.3 kB
- Signer
- Not applicable
- First seen
- Oct 31, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
20 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 20 detections come from 12 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines7flagged10 vendors sharing 7 engines
- Tier-233 engines6flagged9 vendors sharing 6 engines
- Low-trust13 engines1flagged
View all 75 engine results
- ALYacMalicious: Application.ForkBomb.2
- Antiy-AVLMalicious: Trojan/BAT.ForkBomb
- ArcabitMalicious: Application.ForkBomb.2
- BitDefenderMalicious: Application.ForkBomb.2
- CTXMalicious: zip.unknown.forkbomb
- EmsisoftMalicious: Application.ForkBomb.2 (B)
- ESET-NOD32Malicious: BAT/ForkBomb.A trojan
- FortinetMalicious: BAT/Forkbomb.B660!tr
- GDataMalicious: Application.ForkBomb.2
- huorongMalicious: Joke/Agent.a!crit
- IkarusMalicious: Win32.Outbreak
- KasperskyMalicious: HEUR:Trojan.BAT.ForkBomb.gen
- MicroWorld-eScanMalicious: Application.ForkBomb.2
- SangforMalicious: Suspicious.Win32.Save.a
- SophosMalicious: Troj/Bat-AEO
- TrendMicroMalicious: Trojan.BAT.FORKBOMB.A
- TrendMicro-HouseCallMalicious: Trojan.BAT.FORKBOMB.A
- VIPREMalicious: Application.ForkBomb.2
- XcitiumMalicious: Malware@#206x0geu3h4f1
- ZoneAlarmMalicious: Troj/Bat-AEO
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- APEXNo result
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- F-SecureClean
- GoogleNo result
- GridinsoftClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SentinelOneNo result
- SkyhighClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VirITClean
- ViRobotClean
- WebrootClean
- YandexClean
- ZillyaClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 20 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is GameBooterZero.zip a virus?
What is GameBooterZero.zip?
How many antivirus engines detected GameBooterZero.zip?
What should I do if I already opened or extracted GameBooterZero.zip?
How do I remove GameBooterZero.zip?
What kind of malware is GameBooterZero.zip?
What is the SHA-256 hash of GameBooterZero.zip?
How up to date is this analysis of GameBooterZero.zip?
Community
Member reviews and reports for this exact file hash.