Is NFSPatcher-v1.0.4.zip safe?
Only Bkav flagged this established archive, while all 17 tier-1 engines remained silent; sandbox persistence and incomplete network reputation coverage merit limited caution.
Only 1 of 75 engines flagged the archive, and that detection came from Bkav in the low-trust tier; all 17 tier-1 engines reported no detection. The filename and size also align with the official project release, although sandbox persistence indicators and incomplete reputation checks for observed network contacts justify keeping protection enabled.
bbe425d0d4d83a3684…82fc6dd341a52eRecommended next actions
Before opening or extracting
Open or extract it only when its sender or download source has been independently verified.
If you already opened or extracted it
Keep normal device protection enabled and stop if the file behaves unexpectedly.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
Only 1 of 75 engines flagged the archive, and that detection came from Bkav in the low-trust tier; all 17 tier-1 engines reported no detection. The filename and size also align with the official project release, although sandbox persistence indicators and incomplete reputation checks for observed network contacts justify keeping protection enabled.
The strongest signal is the isolated Bkav detection: only 1 of 75 engines flagged the archive, with no tier-1 detections or family consensus. The archive has circulated for more than two years across 81 sources, reducing concern that it is a newly distributed impersonator. Its filename, version, and approximate size match an official NFSPatcher release, and the sandbox issued no malicious verdict. However, runtime evidence included T1547.001, T1562.001, and direct-IP connections, so these behaviors should not be ignored. Host-reputation coverage was incomplete because only raw.githubusercontent.com was checked against five observed IPs and one URL. Overall, the lone generic detection is most consistent with a false positive, subject to verifying the download source and hash.
What We Detected
Only 1 of 75 antivirus engines flagged the ZIP archive. The sole detection was Bkav's generic label W32.Malware.BE84A67F; engines.tier1Malicious=0, and all 17 tier-1 engines reported no detection. The archive has also been submitted 87 times from 81 sources over more than two years. Its filename, version, and approximate size correspond to the project's official v1.0.4 release.
Threat Behavior
One completed sandbox run did not produce a malicious sandbox verdict. It nevertheless recorded T1547.001 persistence and T1562.001 defense-impairment indicators, along with several direct-IP contacts and a version check hosted on raw.githubusercontent.com. Ten extracted children were inspected without a malicious child result, but their individual verdicts remain unknown. Network reputation coverage was incomplete: only one host was cross-checked, while five IP addresses and one URL were observed.
What To Do Now
Use the archive only if it came from the official KilLo445/NFSPatcher release channel, and compare its SHA-256 with bbe425d0d4d83a3684f09a22d972865cc5f00662b3d54e6eed82fc6dd341a52e. Keep antivirus and endpoint protection enabled while extracting and running it. If the source or hash differs, discard the copy and download it again from the official project page.
Where this verdict could be wrong4 caveats
- The sandbox recorded T1547.001 persistence and T1562.001 defense-impairment behavior, which can be security-relevant even without a malware verdict.
- raw.githubusercontent.com received a suspicious cached-host result, though this shared GitHub content host is not inherently proof of malicious activity.
- The direct-IP heuristic cites 204.79.197.203, 185.199.111.133, and 209.85.200.94; complete reputation coverage for all observed contacts is unavailable.
- The 10 extracted children were inspected but retain unknown verdicts, so their lack of malicious classification is not equivalent to confirmed benign status.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1/75 engines flagged the archive.
- engines.tier1Malicious=0 and all 17 tier-1 engines reported no detection.
- behaviour.hasMaliciousSandboxVerdict=false.
- droppedChildren.hasMaliciousChild=false across 10 inspected children.
- The official v1.0.4 release lists the same filename and an approximately matching size.
- Bkav reported the generic label W32.Malware.BE84A67F.
- Sandbox evidence includes persistence technique T1547.001.
- Sandbox evidence includes defense-impairment technique T1562.001.
- Direct-IP network traffic triggered MalwareTips.Synth.DirectIpC2.
- raw.githubusercontent.com has a suspicious cached-host result.
- Host-reputation coverage did not include every observed IP and URL.
Obtain the archive only from the official project release page and verify SHA-256 bbe425d0d4d83a3684f09a22d972865cc5f00662b3d54e6eed82fc6dd341a52e. Keep endpoint protection enabled during extraction and execution.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete1 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial1 of 6 contacted hosts were cross-checked; coverage is incomplete.
YARA
Complete2 signature or behavior rules matched.
External intel
PartialIndependent reference checks were attempted but are incomplete.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 22MITRE ATT&CK techniques
- 11spawned processes
- 6network contacts
- 24filesystem & mutex artifacts
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
NFSPatcher-v1.0.4.zip
bbe425d0d4d83a3684f09a22d972865cc5f00662b3d54e6eed82fc6dd341a52e
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\NFSPatcher.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\system32\services.exe
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
updater.log
C:\Program Files (x86)\Google\GoogleUpdater\updater.log
04Isolated runtime analysis - Written fileObserved
metadata
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostDerived
raw.githubusercontent.com
Saved reputation verdict: suspicious.
06Contacted-host cross-check - Contacted hostObserved
204.79.197.203
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 204.79.197.203
- 185.199.111.133
- 209.85.200.94
- 8.8.8.8
- 185.199.110.133
- https://raw.githubusercontent.com/KilLo445/NFSPatcher/main/Remote/latest-version.txt
- GoogleUpdaterService128.0.6597.0
- C:\Program Files (x86)\Google\GoogleUpdater\updater.log
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata
- C:\Program Files (x86)\Google\GoogleUpdater\3416bc66-80ab-4d58-8313-8ebcea2a7203.tmp
- C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
- C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF3c6cc.TMP
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
- C:\Program Files (x86)\Google3888_325674658\scoped_dir3888_1211526300\GoogleUpdate.exe
- C:\Program Files (x86)\Google3888_325674658\scoped_dir3888_1211526300
- C:\Program Files (x86)\Google3888_325674658
- Local\__DDrawExclMode__
- Local\__DDrawCheckExclMode__
- __OMADM_NAMED_MUTEX__
- \Sessions\1\BaseNamedObjects\Local\__DDrawExclMode__
- \Sessions\1\BaseNamedObjects\Local\__DDrawCheckExclMode__
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 57b25ce4df32896c366b…660207Never scannednever seen before
- c2a7c0fa80f228c2ce59…05ddb2Never scannednever seen before
- 377603854b6b26a984ff…73415dNever scannednever seen before
- ac19786faa4aa0f6a5d6…f71d97Never scannednever seen before
- ec5004cc918113afba8c…ef8fe3Never scannednever seen before
- 31f1232971f14ca0b667…cd5541Never scannednever seen before
- f82338e8e9c746b5d95c…e50e15Never scannednever seen before
- 8de9266347276d18fe49…0f5f2cNever scannednever seen before
- 821973520d65e5317d0c…35e5b5Never scannednever seen before
- 70a1a12c679dde950855…7a9e07Never scannednever seen before
Servers this file contacts
This file contacts 1 host we've flagged suspicious in our own URL scanner.
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 2rule hits recorded
- 1 / 75engines flagged
- 81sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
One or more independent reference checks were incomplete or unavailable.
ProvenanceDerivedSourceExternal-intelligence coverageObserved at - 02
1 of 75 antivirus engines flagged the file, including Bkav.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has been submitted 87 times from 81 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 04
Scanned file: NFSPatcher-v1.0.4.zip — bbe425d0d4d83a3684f09a22d972865cc5f00662b3d54e6eed82fc6dd341a52e
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\AppData\Local\Temp\NFSPatcher.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — C:\Windows\system32\services.exe
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: updater.log — C:\Program Files (x86)\Google\GoogleUpdater\updater.log
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: metadata — C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: raw.githubusercontent.com — Saved reputation verdict: suspicious.
ProvenanceDerivedSourceContacted-host cross-checkObserved at - 10
Contacted host: 204.79.197.203 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
The available sources did not agree on a named threat category.
Available reference checks returned no match, but at least one source was unavailable. This is not a clean result.
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).
EvidenceGoogleUpdaterService128.0.6597.0The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence204.79.197.203 · 185.199.111.133 · 209.85.200.94
1 of 75 engines flagged this file
View all 75 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- NFSPatcher-v1.0.4.zip
- Format
- ZIP
- Code signing
- Not applicable to this file type
- Size
- 9.5 MB
- Last analyzed
- Sep 16, 2026, 10:51 AM UTC
bbe425d0d4d83a3684f09a22d972865cc5f00662b3d54e6eed82fc6dd341a52eSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file appears low risk based on the evidence available now.
- Recovery step 01
Open or extract it only when its sender or download source has been independently verified.
- Recovery step 02
A clean result reduces known risk, but it cannot guarantee that every new or targeted threat has been detected.
- Recovery step 03
Keep your antivirus and Windows updates switched on so you stay protected.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is NFSPatcher-v1.0.4.zip safe?
What is NFSPatcher-v1.0.4.zip?
How many antivirus engines detected NFSPatcher-v1.0.4.zip?
What is the SHA-256 hash of NFSPatcher-v1.0.4.zip?
Is it safe to open or extract NFSPatcher-v1.0.4.zip?
How up to date is this analysis of NFSPatcher-v1.0.4.zip?
Community
Member reviews and reports for this exact file hash.