File scan report
Verdict Safe
Is open anima.
This ZIP archive with an OpenAnima installer drew no detections from 75 antivirus engines, and our sandbox analysis recorded no hostile behaviour or risky network contacts.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The archive appears safe to use. Obtain it from the official OpenAnima source and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 67 flagged
- Flagged 0
- No detection 67
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 67 antivirus engines that checked it flagged this archive, including all major antivirus engines. The installer inside ran in our sandbox with a clean result, and the hosts it contacted, Microsoft Store content devices, have no bad reputation in our records.
None of the 67 antivirus engines that checked it flagged the archive, and every major antivirus engine that analysed it returned clean. Legitimate installers commonly receive these labels. The three domains the sample contacted are Microsoft-hosted devices, and none has a malicious or suspicious record in our host checks. The installer is not code-signed, and the file has moderate circulation. This limits certainty about who published it, but it is not evidence of harm.
What We Detected
A ZIP archive containing an OpenAnima installer built on .NET. None of the 67 antivirus engines that checked it flagged it, and every major antivirus engine reported it as clean.
Threat Behavior
The sandbox extracted the archive and launched the installer, and the recorded verdict was clean. The sandbox assigned several broad technique labels, but none came with matching activity: no other process was injected into, and no credential store was accessed. Network traffic went to Microsoft Store and Azure content devices, none of which our host checks list as malicious or suspicious.
What To Do Now
The file shows no signs of malware. Download it only from the project's official source, and keep your antivirus enabled while installing.
Where this verdict could be wrong1 caveat
- The archive's installer has no publisher signature we could check, and it is seen by only a modest number of submitters, so authorship cannot be confirmed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from any of the 75 antivirus engines, including all major antivirus engines
- The sandbox run returned a clean verdict with no high-risk techniques observed
- All contacted hosts were checked and none has a malicious or suspicious record
- The file has been seen from 15 different sources over 53 days
- The installer inside the archive is not digitally signed, so its publisher cannot be verified.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 29sandbox rule tags
- 5spawned processes
- 3network contacts
- 27filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
29MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1005
- T1027· Obfuscated code
- T1033· Reads user info
- T1047
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1074
- T1082· System recon
- T1090
- T1105· Network file transfer
- T1112
- T1129· Loads modules
- T1497· Sandbox evasion
- T1543· Service install
- T1547· Auto-start
- T1552· Credential search
- T1552.001· Credential search
- T1555· Password stealing
- T1555.003· Password stealing
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1568
- T1573
- T1574· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
OpenAnima Installer.exe"C:\Users\<USER>\AppData\Local\Temp\OpenAnima Installer.exe"OpenWith.exeC:\Windows\system32\OpenWith.exe -Embeddingunarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\open anima.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm" "C:\Users\user\Desktop\open anima.zip"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm\OpenAnima Installer.exe"
Network contacts
33 hosts, listed as 3 domains. Links show the host and path only.
- Domain
consumer-bigcatalog-prod-afd-endpoint-abhkbye3b0fgftc8.b02.azurefd.net - Domain
mr-b02.tm-azurefd.net - Domain
store-images.s-microsoft.com
Files
17Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\Tmp5E6.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp6A3.tmp - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OpenAnima Installer.exe.log - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
Show all 17 entries for files
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db - Written
C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm - Written
C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm\OpenAnima Installer.exe - Written
C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm\demogif - Written
C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm\demogif\Dance Bocchi Sticker.gif - Written
C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm\demogif\Genshin Impact GIF.gif - Written
C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm\demogif\Girl What Sticker by OnePlus.gif - Written
C:\Users\user\AppData\Local\Temp\uhwht0lo.zvm\demogif\Girl Wow Sticker by OnePlus.gif - Deleted
C:\Users\<USER>\AppData\Local\Temp\Tmp9F6D.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\Tmp9F8E.tmp
Registry and auto-start
12Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASAPI32\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASAPI32\EnableAutoFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASAPI32\EnableConsoleTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASAPI32\FileTracingMask - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASAPI32\ConsoleTracingMask - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASAPI32\MaxFileSize
Show all 12 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASAPI32\FileDirectory - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASMANCS\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASMANCS\EnableAutoFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASMANCS\MaxFileSize - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OpenAnima Installer_RASMANCS\FileDirectory - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Global\{f6bec8ba-58ff-4dfc-9981-2ec5ebd23734}-9N3HP2WXKXLGLocal\SessionImmersiveColorMutexGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutexGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_16.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_48.db!dfMaintainer
Show all 10 entries for mutexes
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1920.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_2560.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_sr.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_wide.db!dfMaintainer
Sandbox background — not the file
11The analysis machine's own processes and connections, recorded in every run.
- VM process
DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
Show all 11 entries for sandbox background — not the file
- VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 972cdaf9b9792f29bc06…a5dea0Not checkedno saved verdict
- d0955265982000350bbb…9d34cbNot checkedno saved verdict
- 4cfce2f3be05d12e20e1…0cbf16Not checkedno saved verdict
- 88c7da40b30df8b02d34…a608f0Not checkedno saved verdict
- 0c6e533e29f9487cc5e9…c68009Not checkedno saved verdict
- 3010243ba89db9f804f4…0fd2baNot checkedno saved verdict
- e1aabe69a448931022ad…8e5c20Not checkedno saved verdict
- b9f31ecd5ee517e02c5a…ab123cNot checkedno saved verdict
- 423df4e62b34088fa7e8…8c9f65Not checkedno saved verdict
- 05e836981e29d155a1d9…4f6e15Not checkedno saved verdict
Chapter 04
Technical details
None of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 15, 2026, 1:12 AM UTC
- SHA-256
b9d3933908c69c6083d3d9ec912cdabe98c9b1cf505a9de9e968d0d1c4dc39bf- SHA-1
adff8bc333cbe41ee8b50230fb3b1d279d13bf19- MD5
07750c2507015bd38ce4c2477d5189f5
About this file
open anima.zip is a ZIP file of 10.3 MB.
- Type and size
- ZIP · 10.3 MB
- Signer
- Not applicable
- First seen
- Aug 27, 2026On VirusTotal.
- Submitted by
- 15 distinct sources
First scanned Updated
Verdict history
- Not fully confirmed
- Safeafter the analysis was completed
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is open anima.zip safe?
What is open anima.zip?
How many antivirus engines detected open anima.zip?
What is the SHA-256 hash of open anima.zip?
Is it safe to open or extract open anima.zip?
How up to date is this analysis of open anima.zip?
Community
Member reviews and reports for this exact file hash.