File scan report
Verdict Suspicious
Is Keygen.
Only 2 of the 66 antivirus engines that checked it detected this unsigned, rarely observed key generator, but absent runtime coverage and weak provenance leave meaningful…
Read the whole reasonShow less
Why Suspicious? 2 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 66 flagged
- Flagged 2
- No detection 64
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
6 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Two of the 66 antivirus engines that checked it raised generic detections, while all reporting major antivirus engines remained silent and no malware family achieved consensus. However, the executable is unsigned, rarely observed, and lacks completed runtime and contacted-host reputation coverage, so it should not be run on a production system.
The scan contains two generic detections among 74 engines, with no major antivirus engines identifying malware and no family consensus. That pattern has a substantial chance of being a false positive, particularly because the executable is neither packed nor associated with offensive MITRE techniques in the available evidence. Confidence in benignity is limited because the file is unsigned and has appeared in only two submissions. No completed sandbox observation is available, and contacted-host reputation was not checked or saved. Similar-file history is mixed and consists entirely of matches on the import table alone without a matching signer, so it provides little dependable reassurance.
What We Detected
Two of the 66 antivirus engines that checked it flagged the executable. APEX supplied a generic malicious label, while BitDefenderTheta supplied the generic machine-learning label “Gen:NN.ZemsilCO”; no major antivirus engines flagged it and no named malware family reached consensus.
Threat Behavior
No completed sandbox run is available, so behavior in the test run cannot be characterized. The antivirus analysis found no likely packing or high-entropy code, and no offensive MITRE techniques were recorded. Contacted-host reputation was not checked or saved, so no complete network-reputation conclusion is available.
What To Do Now
Avoid executing this unsigned key generator on a production or personal system. Keep security software enabled, obtain software through its legitimate publisher, and let your antivirus remove the file unless its origin and purpose can be independently verified.
Where this verdict could be wrong3 caveats
- BitDefenderTheta is a smaller engine and reported a generic neural-network detection, so the two detections cannot be dismissed as entirely less reliable noise.
- The filename 'Keygen.exe' indicates a software-key generator, a class frequently associated with unwanted or malware-bundled distribution, although no hacking-tool label is corroborated.
- The file wrote 'udhisapi.dll' beneath a Windows service-profile path, but the absence of a sandbox run prevents treating this artifact as completed evidence from the test run.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines detections
- No engine family consensus
- No confirmed hacking tool labeling
- No likely packing or high-entropy code
- No offensive MITRE techniques in available evidence
- Unsigned Win32 executable with no authenticated publisher
- Only two submissions from two sources despite being several years old
- Generic detections from APEX and BitDefenderTheta
- No completed observation from the test run
- No complete contacted-host reputation result
- Filename indicates software-key-generation functionality
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 0spawned processes
- 0network contacts
- 8filesystem & mutex artifacts
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 2: FileSeen in the test run
Keygen.exe
e0e2a7b718ab2d176ffafaf4c14fce44d4b131f453c6cdf880b6319473484c09
Uploaded file
- 1
Files
Created or changed
- Evidence 2 of 2: Written fileSeen in the test run
udhisapi.dll
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
Test run
2 facts from the test run. See the full activity list.
Includes every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
2 of the 66 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
- APEXMalicious
- BitDefenderThetaGen:NN.ZemsilCO.34688.bm0@aGnIpJi
File fingerprint
- Last analyzed
- Sep 8, 2026, 3:26 PM UTC
- SHA-256
e0e2a7b718ab2d176ffafaf4c14fce44d4b131f453c6cdf880b6319473484c09- SHA-1
5ccd3225002457adb9f16d7578ce7ce240689629- MD5
75f0e474b355f2ace534c6a92286d351
About this file
Keygen.exe is a Win32 EXE file of 20.5 kB.
- Type and size
- Win32 EXE · 20.5 kB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 7, 2021On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.41 of 8
First scanned
Includes every engine result (74), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Keygen.exe safe, or is it malware?
What is Keygen.exe?
How many antivirus engines detected Keygen.exe?
I already downloaded and ran Keygen.exe — what should I do?
What is the SHA-256 hash of Keygen.exe?
How up to date is this analysis of Keygen.exe?
Community
Member reviews and reports for this exact file hash.