File scan report
Verdict Malicious
Is Command and Conquer Renegade_
Twenty-one of the 71 antivirus engines that checked it flag this executable, with multiple major antivirus engines naming OfferCore and evidence from the test run mapping…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, uninstall it and anything that came with it.
What to do now4 steps
This is unwanted software (adware or a bundled program), not an infection. Remove it and undo any changes it made.
If you haven't installed it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Uninstall it and any program you don't recognise that arrived at the same time (Settings > Apps on Windows).
Remove browser extensions you didn't add, and reset your browser's home page, new-tab page and search engine if they changed.
Run a scan with your antivirus to catch anything bundled with it.
If you opened or installed it
Unwanted software is not a full infection, but it should go. These free MalwareTips guides show how to remove it.
- Remove adware and unwanted programsStop unwanted ads on Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
21 of 71 flagged
- Flagged 21
- No detection 50
- No result 4
- Code signing Infivora
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
6 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The file shows a well-corroborated OfferCore bundle-installer pattern: 21 of the 71 antivirus engines that checked it detect it, including six independent major votes.
Multiple independent antivirus products identify an OfferCore or related bundle-installer family, with 21 of the 71 antivirus engines that checked it flagging the sample and six major votes. BitDefender, Emsisoft, ESET-NOD32, GData, and Microsoft converge specifically around OfferCore rather than relying solely on generic heuristics. The Infivora signature verifies cryptographically, but the publisher is not trusted and its recorded history is 5/5 malicious samples. One sandbox run mapped activity to process injection, although it did not issue a malicious sandbox verdict and the inspected file it created remained unknown. Files built with the same import table also have OfferCore-related outcomes, but their different signers mean those matches are only supporting evidence.
What We Detected
Twenty-one of the 71 antivirus engines that checked it flagged the executable, including six independent major detections. BitDefender, Emsisoft, ESET-NOD32, GData, and Microsoft identify OfferCore or its bundling behavior, while Kaspersky reports a related downloader pattern.
Threat Behavior
One completed sandbox run mapped activity to MITRE T1055, indicating possible process injection. The sample also retrieved bundle-related content and software installers, consistent with potentially unwanted software distribution. No malicious sandbox verdict was recorded, and the inspected file it created was not confirmed malicious; however, it remained unclassified. Host-reputation coverage was incomplete across all observed network contacts, so no complete network-reputation conclusion is available.
What To Do Now
Do not run the executable. Keep security software enabled, quarantine or delete the file, and obtain the game only from an official or otherwise trusted distribution channel. If it already ran, perform a full system scan and review recently installed applications and browser changes.
Where this verdict could be wrong4 caveats
- The code signature is valid for 'Infivora', but the signer is not on the recognised-publisher list and the signer's 5/5 malicious history substantially weakens that assurance.
- No sandbox returned a malicious verdict and no dropped file is known to be malicious; the inspected child remained unknown rather than being established as benign.
- contactedHosts found no cached malicious or suspicious results among 12 inspected hosts, but the check did not cover every distinct observed IP and URL.
- No community YARA rule matched, the hash is not in the known-software reference database, and the hash is not listed in the MalwareBazaar malware database; these absences may reflect intelligence-coverage gaps.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The code signature is valid for Infivora
- No sandbox returned a malicious verdict
- No dropped file is known to be malicious
- No community YARA rule matched
- The file does not appear packed
- 21/71 antivirus detections
- Six independent malicious detections from major antivirus engines
- Multiple engines identify OfferCore bundling
- Infivora signer history is 5/5 malicious samples
- Rare and file with one submission
- Incomplete host-reputation coverage for observed contacts
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 4spawned processes
- 32network contacts
- 4filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Hid files or windows on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How bundlers and adware work
This is a bundler: a real-looking installer that hides extra software inside. When you run it, it installs things you never asked for, such as ad injectors, browser toolbars or fake 'PC cleaner' apps. The people behind it get paid for every app it installs.
Bottom line:It is not usually built to destroy files, but it slows the PC, floods it with ads and can be hard to remove completely.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
Command and Conquer Renegade_P5HT3-9.exe
153635936f584788f17dcfe2db6fc1e7940d165eb809104eb26c91dd130eee25
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
Command and Conquer Renegade_P5HT3-9.exe
"C:\Users\<USER>\Desktop\Command and Conquer Renegade_P5HT3-9.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
Command and Conquer Renegade_P5HT3-9.tmp
"C:\Users\<USER>\AppData\Local\Temp\is-20YZJADOY7.tmp\Command and Conquer Renegade_P5HT3-9.tmp" /SL5="$2301A8,14880881,843264,C:\Users\<USER>\Desktop\Command and Conquer Renegade_P5HT3-9.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
Command and Conquer Renegade_P5HT3-9.tmp
C:\Users\<USER>\AppData\Local\Temp\is-20YZJADOY7.tmp\Command and Conquer Renegade_P5HT3-9.tmp
Test run - Evidence 5 of 7: Written fileSeen in the test run
$Quota:$Q:$INDEX_ALLOCATION
C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
18.172.167.162
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
3.163.158.78
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes 9 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
21 of the 71 antivirus engines that checked it flag it; signed by Infivora.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 21
- BitDefender (major engine)Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
- DrWeb (major engine)Trojan.InstallCore.4143
- Emsisoft (major engine)Gen:Variant.Application.Bundler.OfferCore.Cerbu.1 (B)
- ESET-NOD32 (major engine)Win32/OfferCore.B potentially unwanted application
- Fortinet (major engine)W32/Mecha.A!tr
- GData (major engine)Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
- Kaspersky (major engine)not-a-virus:HEUR:Downloader.NSIS.LoudOffer.gen
- Microsoft (major engine)PUADlManager:Win32/OfferCore
File fingerprint
- Last analyzed
- Sep 9, 2026, 11:47 PM UTC
- SHA-256
153635936f584788f17dcfe2db6fc1e7940d165eb809104eb26c91dd130eee25- SHA-1
b61acd0efe8c7399345b5c70f664df95c139be21- MD5
6705f2a4050671347aba93600bf3d4a4
About this file
Command and Conquer Renegade_P5HT3-9.exe is a Win32 EXE file of 16.2 MB.
- Type and size
- Win32 EXE · 16.2 MB
- Signer
- InfivoraValid code signature.
- First seen
- Sep 9, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 9 questions people ask most about this file.
Is Command and Conquer Renegade_P5HT3-9.exe malware?
What is Command and Conquer Renegade_P5HT3-9.exe?
How many antivirus engines detected Command and Conquer Renegade_P5HT3-9.exe?
I already downloaded and ran Command and Conquer Renegade_P5HT3-9.exe — what should I do?
How do I remove Command and Conquer Renegade_P5HT3-9.exe?
What kind of program is Command and Conquer Renegade_P5HT3-9.exe?
Is Command and Conquer Renegade_P5HT3-9.exe digitally signed?
What is the SHA-256 hash of Command and Conquer Renegade_P5HT3-9.exe?
How up to date is this analysis of Command and Conquer Renegade_P5HT3-9.exe?
Community
Member reviews and reports for this exact file hash.