File scan report
Verdict Malicious
Is igi-
12 of the 70 antivirus engines that checked it flagged the file, five of them major, naming OfferCore or Softonic PUA.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
Block or delete the file; treat any installed OfferCore components as unwanted software and remove them.
What to do now4 steps
This is unwanted software (adware or a bundled program), not an infection. Remove it and undo any changes it made.
If you haven't installed it
Don't install this file. Delete it, then empty the Recycle Bin.
If you already installed it
Uninstall it and any program you don't recognise that arrived at the same time (Settings > Apps on Windows).
Remove browser extensions you didn't add, and reset your browser's home page, new-tab page and search engine if they changed.
Run a scan with your antivirus to catch anything bundled with it.
If you opened or installed it
Unwanted software is not a full infection, but it should go. These free MalwareTips guides show how to remove it.
- Remove adware and unwanted programsStop unwanted ads on Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
12 of 70 flagged
- Flagged 12
- No detection 58
- No result 4
- Code signing SOFTONIC INTERNATIONAL SA
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
4 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The signer has a 100 % malicious history and prior identical-signer samples were consistently labelled OfferCore.
The combination of major detections, a uniformly malicious signer record, and matching RAG verdicts on the same signer outweighs the absence of sandbox or file it created hits. Offensive MITRE techniques and the direct-IP a control server rule-based add further weight. The file is a rare and installer, so prevalence cannot offset the other signals.
What We Detected
Five major antivirus engines (DrWeb, ESET-NOD32, Kaspersky, Microsoft, Symantec) plus seven additional engines labelled the sample as OfferCore / Softonic unwanted program or generic adware. The binary is signed by SOFTONIC INTERNATIONAL SA; all four prior samples from this signer were flagged malicious.
Threat Behavior
Observed MITRE techniques T1055 (process injection) and T1548 (elevation abuse). Sandbox execution showed direct-IP connections to 17 addresses with zero DNS queries, a pattern the rule-based engine flagged as suspicious a control server. Ten files it created were inspected; none carried malicious verdicts.
What To Do Now
Do not execute the installer. If already run, review installed programs for OfferCore or Softonic bundles and remove them via Add/Remove Programs. Re-scan the system with current definitions.
Where this verdict could be wrong3 caveats
- No malicious sandbox verdicts and no malicious files it created — behaviour in the test run did not trigger sandbox consensus.
- contactedHosts.maliciousHosts.length=0 — none of the 13 contacted IPs were previously flagged in our cache.
- Major antivirus engines do not agree on one malware family — only one major antivirus engine agreed on the downware family label.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- no malicious files it created
- no sandbox malicious verdict
- major detections present
- signer 100% malicious history
- direct-IP a control server without DNS
- rare and prevalence
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 7spawned processes
- 30network contacts
- 14filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How bundlers and adware work
This is a bundler: a real-looking installer that hides extra software inside. When you run it, it installs things you never asked for, such as ad injectors, browser toolbars or fake 'PC cleaner' apps. The people behind it get paid for every app it installs.
Bottom line:It is not usually built to destroy files, but it slows the PC, floods it with ads and can be hard to remove completely.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
igi-2-covert-strike-single-player-demo-2-installer.exe
865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
executable.exe
"C:\Users\<USER>\Desktop\executable.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
executable.tmp
"C:\Users\<USER>\AppData\Local\Temp\is-RGMHHK3I9Y.tmp\executable.tmp" /SL5="$13003A,848247,840704,C:\Users\<USER>\Desktop\executable.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
executable.tmp
C:\Users\<USER>\AppData\Local\Temp\is-RGMHHK3I9Y.tmp\executable.tmp
Test run - Evidence 5 of 7: Written fileSeen in the test run
$Quota:$Q:$INDEX_ALLOCATION
C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
13.32.155.89
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
151.101.193.55
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1070· Covers its tracks
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1074
- T1082· System recon
- T1129· Loads modules
- T1497· Sandbox evasion
- T1548
- T1564· Hides artifacts
- T1564.004· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
executable.exe"C:\Users\<USER>\Desktop\executable.exe"executable.tmp"C:\Users\<USER>\AppData\Local\Temp\is-RGMHHK3I9Y.tmp\executable.tmp" /SL5="$13003A,848247,840704,C:\Users\<USER>\Desktop\executable.exe"explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embeddingrundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56.exeC:\Users\<USER>\AppData\Local\Temp\is-LNX8RFEVW8.tmp\865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56.tmp /SL5=$60158,848247,840704,C:\Users\<USER>\Downloads\865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56.exeprogram.exe"C:\Users\user\Desktop\program.exe"
Show all 7 entries for processes started
program.tmp"C:\Users\user\AppData\Local\Temp\is-X5UK6PZO1A.tmp\program.tmp" /SL5="$103E8,848247,840704,C:\Users\user\Desktop\program.exe"
Network contacts
3030 hosts, listed as 17 addresses, 19 links. Links show the host and path only.
- IP address
13.32.155.89 - IP address
151.101.193.55 - IP address
3.170.73.3 - IP address
54.213.148.27 - IP address
23.59.235.109 - IP address
13.32.179.122
Show all 36 entries for network contacts
- IP address
18.160.71.111 - IP address
3.171.171.75 - IP address
23.223.131.50 - IP address
23.53.13.38 - IP address
34.216.201.214 - IP address
54.224.94.179 - IP address
3.161.174.36 - IP address
35.82.241.224 - IP address
18.164.78.21 - IP address
13.32.179.42 - IP address
172.66.146.164 - URL
https://d2it9arwsniqaq.cloudfront.net/o - URL
https://d2it9arwsniqaq.cloudfront.net/zbd - URL
https://d2it9arwsniqaq.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.png - URL
https://d2it9arwsniqaq.cloudfront.net/f/WebAdvisor/images/880/update2/EN.png - URL
https://images.sftcdn.net/images/t_app-icon-l/p/20a5686b-74bf-473a-a456-f0fb0e3bcbbd/2188232665/igi-2-covert-strike-single-player-demo-imgingest-4267422073576001953.png - URL
https://gsf-fl.softonic.com/a24/47d/4d75707e81beabf063e700d9554d195397/igi2_sp_demo2.zip - URL
https://shield.reasonsecurity.com/ReasonLabs-Suite-Setup-Wizard.exe - URL
https://d2it9arwsniqaq.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip - URL
https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record - URL
https://pac.rlinfraservices.com - URL
https://update.reasonsecurity.com/v2/update - URL
https://electron-shell.reasonsecurity.com/v1.6.0/ReasonLabs-x64-v1.6.0.7z - URL
https://auth.api.mcafee.com/auth/v1/jwt - URL
https://threat.api.mcafee.com/network/v1/cache/url-evergreen - URL
https://cdn.reasonsecurity.com/rav-dist/packages/ReasonLabs-EPP-x64-v7.7.6.7z - URL
https://analytics.apis.mcafee.com/mosaic/2.0/product-web/webadvisor/v1/record - URL
https://config.reasonsecurity.com - URL
https://cdn.reasonsecurity.com/rav-dist/packages/ReasonVPN/ReasonLabs-VPN-Release-x64-v3.3.12.7z - URL
https://api.reasonsecurity.com/api.ashx
Files
9Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-RGMHHK3I9Y.tmp\executable.tmp - Written
C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Show all 9 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\is-LNX8RFEVW8.tmp\865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56.tmp - Written
C:\Users\user\AppData\Local\Temp\is-X5UK6PZO1A.tmp - Written
C:\Users\user\AppData\Local\Temp\is-X5UK6PZO1A.tmp\program.tmp
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Shell.CMruPidlListLocal\SessionImmersiveColorMutexGlobal\SyncRootManagerLocal\Mutexf01b4d95cf55d32a.automaticDestinations-mscversions.3.m
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 992058c814f6edbb5525…34f89aNot checkedno saved verdict
- 3434e2f9839ec59c4584…27e4d2Not checkedno saved verdict
- e23040951e464b53b84b…09bc25Not checkedno saved verdict
- 461aa2a74e24ac385eb7…a953c5Not checkedno saved verdict
- 7e1f2e7bde4d00bd95b5…2f3340Not checkedno saved verdict
- ecba441499c317cb4181…715ac3Not checkedno saved verdict
- dafaae87a938c5fec343…5dc702Not checkedno saved verdict
- 3a62ae0d102cff66fba0…c75a7dNot checkedno saved verdict
- 81e53986d28289a7e66b…d7d806Not checkedno saved verdict
Chapter 04
Technical details
12 of the 70 antivirus engines that checked it flag it; signed by SOFTONIC INTERNATIONAL SA.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 12
- DrWeb (major engine)Adware.Downware.20879
- ESET-NOD32 (major engine)Win32/OfferCore.E potentially unwanted application
- Kaspersky (major engine)not-a-virus:HEUR:Downloader.Win32.Softonic.gen
- Microsoft (major engine)PUADlManager:Win32/OfferCore
- Symantec (major engine)ML.Attribute.HighConfidence
- AhnLab-V3PUP/Win.Generic.R752265
- CrowdStrikewin/grayware_confidence_60% (D)
- Elasticmalicious (high confidence)
File fingerprint
- Last analyzed
- Jul 23, 2026, 5:01 AM UTC
- SHA-256
865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56- SHA-1
ada1b018d628e3c7d13ca7012f46dd6aadae2b04- MD5
f9723384ded943ef2aece10f1b4ff5f0
About this file
igi-2-covert-strike-single-player-demo-2-installer.exe is a Win32 EXE file of 2.1 MB.
- Type and size
- Win32 EXE · 2.1 MB
- Signer
- SOFTONIC INTERNATIONAL SAValid code signature.
- First seen
- Jul 22, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Antivirus consensus
12 of 70 engines flagged this file
4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 12 detections come from 11 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines5flagged
- Tier-235 engines4flagged5 vendors sharing 4 engines
- Low-trust17 engines2flagged
View all 74 engine results
- AhnLab-V3Malicious: PUP/Win.Generic.R752265
- CrowdStrikeMalicious: win/grayware_confidence_60% (D)
- DrWebMalicious: Adware.Downware.20879
- ElasticMalicious: malicious (high confidence)
- ESET-NOD32Malicious: Win32/OfferCore.E potentially unwanted application
- K7AntiVirusMalicious: Adware ( 005693e61 )
- K7GWMalicious: Adware ( 005693e61 )
- KasperskyMalicious: not-a-virus:HEUR:Downloader.Win32.Softonic.gen
- MalwarebytesMalicious: PUP.Optional.Softonic
- MicrosoftMalicious: PUADlManager:Win32/OfferCore
- SymantecMalicious: ML.Attribute.HighConfidence
- WebrootMalicious: Win.Adware.Com
- AcronisClean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CTXClean
- CylanceClean
- CynetClean
- EmsisoftClean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- KingsoftClean
- LionicClean
- MaxSecureClean
- McAfeeDClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 9 questions people ask most about this file.
Is igi-2-covert-strike-single-player-demo-2-installer.exe malware?
What is igi-2-covert-strike-single-player-demo-2-installer.exe?
How many antivirus engines detected igi-2-covert-strike-single-player-demo-2-installer.exe?
I already downloaded and installed igi-2-covert-strike-single-player-demo-2-installer.exe — what should I do?
How do I remove igi-2-covert-strike-single-player-demo-2-installer.exe?
What kind of program is igi-2-covert-strike-single-player-demo-2-installer.exe?
Is igi-2-covert-strike-single-player-demo-2-installer.exe digitally signed?
What is the SHA-256 hash of igi-2-covert-strike-single-player-demo-2-installer.exe?
How up to date is this analysis of igi-2-covert-strike-single-player-demo-2-installer.exe?
Community
Member reviews and reports for this exact file hash.