File scan report
Verdict Safe
Is player2.
This validly signed Player2 desktop app installer drew no detections from 75 antivirus engines and behaved like an ordinary installer in our sandbox analysis.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer appears safe to use if you obtained it from the official Player2 source. Keep your security software enabled as usual.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 45 flagged
- Flagged 0
- No detection 45
- No result 30
- Code signing ELEFANT AI INC.
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 45 antivirus engines that checked it flagged this installer, and it carries a valid signature from ELEFANT AI INC. In the sandbox it installed the Player2 app into the user profile, added a Start Menu shortcut and fetched Microsoft's WebView2 runtime. It showed no high-risk techniques.
No antivirus engine flagged the file, and nine major antivirus engines that returned results reported it clean. The signature from ELEFANT AI INC. verifies, although this publisher has very little history with us. The sandbox showed a typical NSIS-based Tauri installer: it unpacked helper DLLs to a temporary folder, installed program files under AppData, created a Start Menu shortcut and downloaded Microsoft's WebView2 setup. No public malware database or community rule matched the file.
What We Detected
None of the 45 antivirus engines that checked it flagged this file. It carries a valid code signature from ELEFANT AI INC., a publisher with very limited history in our records. Some major engines timed out on this large file.
Threat Behavior
The sandbox runs showed standard installer activity. The file unpacked installer helper libraries, placed the Player2 application and its uninstaller under the user's AppData folder, created a Start Menu shortcut and downloaded Microsoft's WebView2 runtime from Microsoft servers. No persistence changes, injection targets or high-risk techniques were recorded.
What To Do Now
If you intended to install Player2, the evidence supports using this file. Download it only from the official Player2 source, and keep your antivirus enabled.
Where this verdict could be wrong2 caveats
- The publisher has almost no history in our records and the file was seen from a single submitter, so a valid signature alone does not establish its reputation.
- Several major engines timed out or failed on this large file, so fewer major antivirus engines returned a result than usual.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 45 antivirus engines that checked it flagged the file.
- The signature from ELEFANT AI INC. verifies as valid.
- Sandbox behaviour matched a normal application installer, with downloads coming only from Microsoft servers.
- No high-risk techniques, injection targets or persistence changes were observed.
- The publisher's signing identity has very little history in our records.
- Several major antivirus engines did not return a result for this large file.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 27sandbox rule tags
- 2spawned processes
- 2network contacts
- 34filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
27MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1027.009· Obfuscated code
- T1033· Reads user info
- T1045
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1063
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1119
- T1125
- T1129· Loads modules
- T1134
- T1140· Deobfuscation
- T1198
- T1222
- T1497.001· Sandbox evasion
- T1518· Checks your AV
- T1529
- T1547.009· Auto-start
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
player2.exe"C:\Users\<USER>\Desktop\player2.exe"player2.exe"C:\Users\user\Desktop\player2.exe"
Network contacts
22 hosts, listed as 2 links. Links show the host and path only.
- URL
https://go.microsoft.com/fwlink/p/ - URL
https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/bc30c82c-6362-4795-bb08-5351ad5a93bd/MicrosoftEdgeWebview2Setup.exe
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsgDB9B.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nswDBAC.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nswDBAC.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nswDBAC.tmp\nsDialogs.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nswDBAC.tmp\nsis_tauri_utils.dll - Written
C:\Users\<USER>\AppData\Local\Player2\player2.exe
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Player2\generate_openapi.exe - Written
C:\Users\<USER>\AppData\Local\Player2\uninstall.exe - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Player2.lnk - Written
C:\Users\<USER>\AppData\Local\Temp\nscBF2B.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nssBF3C.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nssBF3C.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nssBF3C.tmp\nsDialogs.dll - Written
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\MicrosoftEdgeUpdate.exe - Written
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\CopilotUpdate.exe - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Temp\nscBE8E.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nssBF3C.tmp - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\MicrosoftEdgeUpdate.exe - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\CopilotUpdate.exe - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\msedgeupdate.dll - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\MicrosoftEdgeUpdateBroker.exe - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\MicrosoftEdgeUpdateOnDemand.exe - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\MicrosoftEdgeComRegisterShellARM64.exe - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\psmachine.dll - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\psmachine_64.dll - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\psmachine_arm64.dll - Deleted
C:\Program Files (x86)\Microsoft\Temp\EUA497.tmp\psuser.dll
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
cversions.3.mGlobal\OneSettingQueryMutex+compat+encapsulationLocal\MSCTF.Asm.MutexDefault1DefaultTabtip-MainUI
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Show all 9 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- cfc8a1eda59df97bb429…f8b1a7Not checkedno saved verdict
- 3697d11bdbe1e34daa26…b13620Not checkedno saved verdict
- 56b96add1978b1abba28…753fe2Not checkedno saved verdict
- e9a7c5ff0ba2c6a0d3d3…1a8ba2Not checkedno saved verdict
- 6339364d5f477508da34…e62a21Not checkedno saved verdict
- ae1a28e5c106595bf926…3c3917Not checkedno saved verdict
- 2be2203211a3736d9b0b…6c45bbNot checkedno saved verdict
- fb022a503cf85255b09f…503960Not checkedno saved verdict
- 8dc562cda7217a3a52db…7f65a8Not checkedno saved verdict
Chapter 04
Technical details
None of the 45 antivirus engines that checked it flag it; signed by ELEFANT AI INC..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 8, 2026, 6:48 PM UTC
- SHA-256
72c6214c6cb045738f0ae313573dac2ac7f1c60fdc1d69dacb9cbb16f1e4e5e8- SHA-1
a0f49ad676d2d194ca9fada2fac7283fa097ebce- MD5
5a56fe3a321fd989ff31757e3e349e27
About this file
player2.exe is a Win32 EXE file of 28.5 MB.
- Type and size
- Win32 EXE · 28.5 MB
- Signer
- ELEFANT AI INC.Valid code signature.
- First seen
- Aug 7, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 45 engines flagged this file
30 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-19 engines0flagged
- Tier-224 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisNo result
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacNo result
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealNo result
- ClamAVNo result
- CMCNo result
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetNo result
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32No result
- F-SecureClean
- FortinetNo result
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureNo result
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaNo result
- RisingNo result
- SangforNo result
- SentinelOneNo result
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroNo result
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristNo result
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexNo result
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is player2.exe safe?
What is player2.exe?
How many antivirus engines detected player2.exe?
Is player2.exe digitally signed?
What is the SHA-256 hash of player2.exe?
Is it safe to run player2.exe?
How up to date is this analysis of player2.exe?
Community
Member reviews and reports for this exact file hash.