File scan report
Verdict Malicious
Is Gen
A ZIP archive holding a 64-bit downloader that 27 of the 65 antivirus engines that checked it flag, several of them naming the Paph or Yomal downloader families.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
Delete this archive without extracting or running it. If it was already executed, run a full antivirus scan, review what was placed in your temporary folders, and change passwords for accounts used on that machine.
What to do now3 steps
This ZIP archive is harmful. Don't open or extract it, and delete it.
If you haven't opened or extracted it
Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.
If you already opened or extracted it
If you already extracted it, delete the extracted files too and run a full antivirus scan.
If a page it opened asked for a password or card details and you entered them, change that password and call your bank.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
27 of 65 flagged
- Flagged 27
- No detection 38
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 24d ago
Chapter 02
Why we think so
6 points against it and 0 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This archive contains an executable that 27 of the 65 antivirus engines that checked it call malicious, including nine well-regarded engines such as Kaspersky (Trojan-Downloader.Win32.Paph), Avast, Avira, Symantec and Trend Micro. When opened, the archive unpacks itself and starts a hidden PowerShell routine that extracts further files into a temporary folder. It should not be run.
Twenty-seven of the 65 antivirus engines that checked it flagged this archive, and nine of those come from established vendors; the detections cluster on downloader naming, with Kaspersky, Tencent, Sangfor and alibabacloud all pointing at the Paph or Yomal downloader line. Coverage was good — 65 engines returned a result — so the consensus is not an artefact of thin reporting, and no test-file or security-tool signature explains the flags away. In the sandbox runs the archive extracted itself and launched a hidden PowerShell process that unpacked an additional archive into a temporary directory before a program was started from that folder, which is the classic staged-loader pattern and is why one of our behaviour rules matched. The runtime picture is incomplete: one technique in the summary has no named target process, no sandbox run returned a malicious verdict, and the outbound-host reputation check did not complete, so the case rests on the signature consensus plus the observed hidden-PowerShell staging. Neither the file being widely shared nor an absence of a code signature mitigates anything here. There is no benign reading of a hidden, obfuscated extraction chain inside a game-patcher archive that nine established engines call a downloader.
What We Detected
This is a ZIP archive, first seen on Oct 14, 2026, submitted by 118 distinct sources. Inside it is a 64-bit Windows executable. In the antivirus engines 27 of the 65 antivirus engines that checked it flagged the file, nine of them from established vendors: Kaspersky names Trojan-Downloader.Win32.Paph, Tencent names Win32.Trojan-Downloader.Paph, Sangfor names Downloader.Win32.Paph, alibabacloud and Trend Micro name the related Yomal line, and Avast, Avira, G Data, Ikarus, Sophos, Symantec and Trellix also raise alarms. Of the engines that returned a verdict, 23 are independent of one another, so this is not one scanning engine being copied across brand names.
Threat Behavior
The sandbox runs show the archive being unpacked and a second stage launched from a user temporary folder. A PowerShell process was started with its window hidden and with an inline command that expanded a further archive into a temporary directory and queried the Windows version; the main program was then executed from that temporary location. Hidden PowerShell used purely to unpack and stage files is a common way to keep a downloader's real payload out of sight, and one of our behaviour rules matched this pattern. The runs also created keyboard and mouse hook objects of the kind AutoHotkey scripts use, wrote a log and a temporary text file, and checked the machine it was running on.
What To Do Now
Do not open or run the archive, and do not extract its contents manually to "check" them — the executable inside is the component the engines flag. Delete the download if you still have it, and if you have already run it, run a full scan with your security software and change passwords for accounts used on that machine. Keep security software enabled; tools of this kind commonly ask for exclusions or for antivirus to be switched off, and that request should never be granted.
Where this verdict could be wrong2 caveats
- BitDefender and Dr.Web were among the engines that reported nothing, and no sandbox run returned a malicious verdict, so the case rests mainly on static signature detections rather than observed hostile runtime action.
- The contacted-host reputation cross-check did not complete, so any outbound connections the sample may have made were never mapped to known-bad infrastructure.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 27 of the 65 antivirus engines that checked it flag this archive, including nine established vendors and 23 independent detections.
- Several engines name a known downloader family (Paph / Yomal), which indicates a second-stage payload fetched at run time.
- When executed, the archive starts a PowerShell process with a hidden window that extracts additional archives into a temporary folder before running a program from that location.
- The program is launched from a user temporary directory rather than a normal install location, a common staging pattern for loaders.
- The runs created keyboard and mouse hook objects and wrote auxiliary files consistent with an automated patcher/launcher that runs with the user's full privileges.
- The file is unsigned and not tied to any identifiable publisher, so there is no way to verify who built or distributed it.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 24sandbox rule tags
- 9spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as downloading a file, but no download was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How downloaders work
This file is a delivery vehicle. On its own it can look small and harmless, but its job is to fetch and install the real payload, often a password stealer, ransomware or a bot, from a server the attacker controls.
Bottom line:Because the dangerous part arrives later, early scans can look cleaner than the threat really is.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
GenPatcher 2.15.zip
b31086ff48aa141ac571ef552e3ec1b80a0f211e56cd25c4606f1008d31a989e
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -InputFormat None -NonInteractive -Command "$env:PATH = 'C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\'; $PSVersionTable"
Test run - Evidence 3 of 5: ProcessSeen in the test run
powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -InputFormat None -OutputFormat None -NonInteractive -Command "$env:PATH = 'C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\'; try { Expand-Archive -LiteralPath 'C:\Users\<USER>\AppData\Local\Temp\GP2\validation.zip' -DestinationPath 'C:\Users\<USER>\AppData\Local\Temp\GP2\' -Force -ErrorAction Stop } catch { $_.Exception.Message | Out-File -LiteralPath 'C:\Users\<USER>\AppData\Local\Temp\GP2\ps-error.txt' -Encoding Unicode }"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
Readme.txt
C:\Users\user\AppData\Local\Temp\uphvw1bw.s5u\Readme.txt
Test run - Evidence 5 of 5: Written fileSeen in the test run
validation.zip
C:\Users\<USER>\AppData\Local\Temp\GP2\validation.zip
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
24MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1059.001· Runs commands
- T1064
- T1069
- T1070· Covers its tracks
- T1071· Application protocol
- T1074
- T1082· System recon
- T1105· Network file transfer
- T1129· Loads modules
- T1202
- T1485
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1539
- T1562· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
- T1574· Execution hijack
Observed activity
Processes started
9Programs the file ran, with their command lines.
powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -InputFormat None -NonInteractive -Command "$env:PATH = 'C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\'; $PSVersionTable"powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -InputFormat None -OutputFormat None -NonInteractive -Command "$env:PATH = 'C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\'; try { Expand-Archive -LiteralPath 'C:\Users\<USER>\AppData\Local\Temp\GP2\validation.zip' -DestinationPath 'C:\Users\<USER>\AppData\Local\Temp\GP2\' -Force -ErrorAction Stop } catch { $_.Exception.Message | Out-File -LiteralPath 'C:\Users\<USER>\AppData\Local\Temp\GP2\ps-error.txt' -Encoding Unicode }"powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -InputFormat None -NonInteractive -Command "$env:PATH = 'C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\'; Get-ItemProperty Registry::\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\""GenPatcher.exe"C:\Users\<USER>\AppData\Local\Temp\GenPatcher.exe"GenPatcher.exe"C:\Users\<USER>\AppData\Local\Temp\GenPatcher.exe" /restartcmd.exe"C:\Windows\system32\cmd.exe" /k
Show all 9 entries for processes started
unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\GenPatcher 2.15.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\uphvw1bw.s5u" "C:\Users\user\Desktop\GenPatcher 2.15.zip"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\uphvw1bw.s5u\GenPatcher.exe"
Files
17Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\uphvw1bw.s5u\Readme.txt - Written
C:\Users\<USER>\AppData\Local\Temp\GP2\validation.zip - Written
\Device\ConDrv\Connect - Written
\Device\ConDrv\\Reference - Written
\Device\ConDrv\\Input - Written
\Device\ConDrv\\Output
Show all 17 entries for files
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log - Written
C:\Users\<USER>\AppData\Local\Temp\GP2\ps.txt - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Local\Temp\uphvw1bw.s5u - Written
C:\Users\user\AppData\Local\Temp\uphvw1bw.s5u\GenPatcher.exe - Written
\Device\ConDrv\\Connect - Written
stdout - Deleted
C:\Users\<USER>\AppData\Local\Temp\GP2\ps.txt - Deleted
C:\Users\<USER>\AppData\Local\Temp\GP2\validation.zip - Deleted
C:\Users\<USER>\AppData\Local\Temp\GP2\
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
AHK KeybdAHK Mouse
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- beba3a9b8ac6adc4bbfc…d52229Not checkedno saved verdict
- a7063dedd0749b48e5f6…a579e7Not checkedno saved verdict
- 8eb7083d72a81be71596…fc9361Not checkedno saved verdict
- 610ec76a3c9cb7b4f886…a4c920Not checkedno saved verdict
- bb88a220ed4dcd3d717e…a07301Not checkedno saved verdict
- 66c19e0d8ef58a13a1ac…519a5cNot checkedno saved verdict
- df038edab78c9275122c…77bed8Not checkedno saved verdict
Chapter 04
Technical details
27 of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 27
- Avast (major engine)Win64:Malware-gen
- AVG (major engine)Win64:Malware-gen
- Avira (major engine)TR/W64.Malware
- F-Secure (major engine)Trojan.TR/W64.Malware
- GData (major engine)Win64.Trojan.Agent.77GV88
- Ikarus (major engine)Trojan.SuspectCRC
- Kaspersky (major engine)Trojan-Downloader.Win32.Paph.rnv
- Sophos (major engine)Mal/Generic-S
File fingerprint
- Last analyzed
- Nov 6, 2026, 6:06 PM UTC
- SHA-256
b31086ff48aa141ac571ef552e3ec1b80a0f211e56cd25c4606f1008d31a989e- SHA-1
5679b3205a5fd31af28fb074aeae4457f9de637b- MD5
b992d647875823e421a9fb4d66d0587f
About this file
GenPatcher 2.15.zip is a ZIP file of 11.6 MB.
- Type and size
- ZIP · 11.6 MB
- Signer
- Not applicable
- First seen
- Oct 14, 2026On VirusTotal.
- Submitted by
- 118 distinct sources
First scanned
Antivirus consensus
27 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 27 detections come from 23 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines9flagged11 vendors sharing 9 engines
- Tier-234 engines6flagged7 vendors sharing 6 engines
- Low-trust13 engines9flagged
View all 75 engine results
- AlibabaMalicious: TrojanDownloader:Win32/Generic.dd4db580
- alibabacloudMalicious: Trojan[downloader]:Win/Yomal.Gen
- Antiy-AVLMalicious: Trojan/Win32.Khalesi
- AvastMalicious: Win64:Malware-gen
- AVGMalicious: Win64:Malware-gen
- AviraMalicious: TR/W64.Malware
- BkavMalicious: W32.Malware.BB67CFA1
- CynetMalicious: Malicious (score: 99)
- F-SecureMalicious: Trojan.TR/W64.Malware
- GDataMalicious: Win64.Trojan.Agent.77GV88
- IkarusMalicious: Trojan.SuspectCRC
- K7AntiVirusMalicious: Trojan-Downloader ( 006e96c51 )
- K7GWMalicious: Trojan-Downloader ( 006e96c51 )
- KasperskyMalicious: Trojan-Downloader.Win32.Paph.rnv
- LionicMalicious: Trojan.ZIP.Paph.a!c
- MalwarebytesMalicious: Trojan.Crypt
- MaxSecureMalicious: Trojan.Malware.325937538.susgen
- McAfeeDMalicious: ti!B31086FF48AA
- RisingMalicious: Downloader.Paph!8.58D0 (CLOUD)
- SangforMalicious: Downloader.Win32.Paph.Voch
- SophosMalicious: Mal/Generic-S
- SymantecMalicious: Trojan.Gen.NPE
- TencentMalicious: Win32.Trojan-Downloader.Paph.Bplw
- TrellixENSMalicious: Artemis!4EA5F590CB8A
- TrendMicroMalicious: Trojan.Win32.YOMAL.USBLJG26
- VaristMalicious: W64/ABDownloader.MMAY-6283
- VBA32Malicious: Trojan.Win64.Generic
- AcronisClean
- AhnLab-V3Clean
- ALYacClean
- APEXNo result
- ArcabitClean
- Avast-MobileClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- FortinetClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- JiangminClean
- KingsoftClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- SentinelOneClean
- SkyhighClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TrapmineNo result
- TrendMicro-HouseCallClean
- TrustlookClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
Sample spawned PowerShell with a hidden window AND execution-policy bypass / inline command. Not definitive — legit Intune/SCCM scripts do this too — but combined with other signals it reinforces the loader profile.
Evidencepowershell.exe -NoProfile -WindowStyle Hidden -InputFormat None -NonInteractive -Command "$env:PATH = 'C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\'; $PSVersionTabl…VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is GenPatcher 2.15.zip a virus?
What is GenPatcher 2.15.zip?
How many antivirus engines detected GenPatcher 2.15.zip?
What should I do if I already opened or extracted GenPatcher 2.15.zip?
How do I remove GenPatcher 2.15.zip?
What kind of malware is GenPatcher 2.15.zip?
What is the SHA-256 hash of GenPatcher 2.15.zip?
How up to date is this analysis of GenPatcher 2.15.zip?
Community
Member reviews and reports for this exact file hash.