Is Grim Dawn.exe safe?Suspicious
Unsigned executable with one tier-1 detection and process-injection heuristic but no sandbox confirmation.
- 1 high-confidence signature or behavior rule matched this file.
- 3 of 74 antivirus engines flagged the file, including Bkav and Microsoft.
- The hash has been submitted 12 times from 6 sources.
19f65c0a916ae70f01…53d77d83e6Before opening
Do not run it until the source and publisher can be verified independently.
If you already ran it
Close it, scan the device, and watch for unexpected processes or security alerts.
Coverage & freshness
A completed check means the source returned a result. It does not, by itself, guarantee that the file is safe.
Antivirus
Complete3 of 74 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Attack story
A bounded view of the runtime evidence saved with this scan. Connectors mean “also observed,” not a proven causal chain.
- File
Grim Dawn.exe
19f65c0a916a…7d83e6
Observed - Process
Observed process
"C:\Users\user\Desktop\Grim Dawn.exe"
Observed
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Signature and behavior rulesView chapterVerdict inputDerived - 02
3 of 74 antivirus engines flagged the file, including Bkav and Microsoft.
Antivirus analysisView chapterVerdict inputObserved - 03
The hash has been submitted 12 times from 6 sources.
Saved report factsView chapterDerived
Intelligence
The complete saved assessment, kept intact and grounded in the scan evidence.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
One tier-1 engine flags the file as Trojan:Win32/Wacatac.B!ml while 65 engines remain silent. A high-severity T1055 process-injection heuristic fired, yet the sandbox produced no malicious verdict and no malicious hosts were contacted. The combination of unsigned status, single high-trust detection, and absent corroboration places the sample in mixed-signal territory.
The engines show only one tier-1 malicious result against a backdrop of 65 undetected engines, indicating limited consensus. The unsigned nature of the executable removes any trusted-publisher protection that might otherwise explain the detection. The T1055 heuristic is a strong indicator of injection behaviour, but the sandbox did not corroborate malicious activity and no external-intel sources returned hits. Medium prevalence suggests the file is being distributed rather than a one-off sample, yet the complete absence of similar-hash history leaves no historical pattern to rely on. These conflicting signals support a suspicious classification rather than a definitive malicious or safe verdict.
What We Detected
Three engines out of 74 flagged the sample: Microsoft (tier-1) labelled it Trojan:Win32/Wacatac.B!ml, Bkav (low-trust) returned W32.Malware.596E6188, and Zoner (tier-2) reported Probably Heur.ExeHeaderL. No tier-1 family consensus exists. The file is unsigned despite being a 4.6 MB Win32 executable.
Threat Behavior
A high-severity heuristic triggered on MITRE T1055 (Process Injection) after observing CreateRemoteThread or APC patterns. The sandbox recorded three ambient techniques and one offensive technique but returned no malicious verdict. No domains, IPs, or URLs were contacted, and no child processes or dropped files were observed.
What To Do Now
Do not execute the file on production systems. Submit the sample to additional sandboxes or obtain a digital signature check from the purported publisher. Monitor prevalence; if the file gains wider distribution with clean signatures, reassess the risk.
Where this verdict could be wrong3 caveats
- Single tier-1 detection without family consensus may represent heuristic over-reach on a new game executable.
- No sandbox malicious verdict, no contacted malicious hosts, and no dropped malicious children reduce confidence in the T1055 signal.
- Medium prevalence and 12 submissions suggest the file is circulating rather than a targeted attack payload.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 65 of 74 engines undetected
- No sandbox malicious verdict
- No contacted malicious hosts
- Unsigned executable
- Single tier-1 malicious detection
- High-severity T1055 process-injection heuristic
Treat the file as untrusted pending further sandbox results or publisher verification; avoid execution until additional evidence clarifies its intent.
Behavior
Plain-English impact first, then the observed runtime evidence.
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Detection sources at a glance
The available sources did not agree on a named threat category.
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Users\user\Desktop\Grim Dawn.exe"
3 of 74 engines flagged this file
View all 74 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- Grim Dawn.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 4.5 MB
- Last analyzed
- Jul 23, 2026, 11:21 PM UTC
19f65c0a916ae70f011ce75d22ad6067fd91333659f7d5043ec68353d77d83e6Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
Don't run it unless you're certain it came from a source you trust.
Check where you got it — an email attachment or a random download link is a red flag.
If you're unsure, delete it. You can always re-download a clean copy from the official source.
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
- Grim Dawn.exe is suspicious — treat it as unsafe until you're sure. 3 of 74 antivirus engines flag it, which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
- Grim Dawn.exe is a Windows executable program, about 4.5 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
- 3 of 74 antivirus engines flagged Grim Dawn.exe, 3 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
- Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
- To remove Grim Dawn.exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original Grim Dawn.exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
- The SHA-256 hash of Grim Dawn.exe is 19f65c0a916ae70f011ce75d22ad6067fd91333659f7d5043ec68353d77d83e6, and its MD5 is bdb3b7182e8c4bce6c6db9f436397d46. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on July 23, 2026. Because a file's hash never changes, the identity of Grim Dawn.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.