File scan report
Verdict Safe
Is Quake_
A lone generic Trapmine alert lacks corroboration from 78 other engines, observation from the test run, host reputation checks, or malware-specific external intelligence.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 75 flagged
- Flagged 1
- No detection 74
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 75 antivirus engines that checked it flagged this executable, and that alert came from less reliable Trapmine with a generic machine-learning label. One completed sandbox found no offensive behavior, all observed hosts received complete reputation coverage without malicious findings, and neither MalwareBazaar nor malware-specific YARA rules corroborated the alert.
Trapmine was the only one of the 75 antivirus engines that checked it to flag the executable, using a generic machine-learning label rather than identifying a malware family. No major antivirus engines detected it, which strongly favors a false positive. One completed sandbox returned clean and recorded no offensive techniques, injection, persistence, or dropped files. All ten distinct observed contacts were covered by the host-reputation check, with no malicious or suspicious host findings; the Microsoft domain was identified as analysis-environment background traffic. The executable is unsigned, but this concern is outweighed by the lack of corroborating scan, runtime, network, or external-intelligence evidence.
What We Detected
Only Trapmine flagged the executable, accounting for 1 of the 75 antivirus engines that checked it. Its label was a generic machine-learning score and did not identify a malware family. None of the 18 reporting major antivirus engines detected the file.
Threat Behavior
One completed sandbox returned clean and recorded no offensive MITRE techniques, process injection, persistence indicators, written files, or files it created. The host-reputation check covered all ten distinct observed contacts and found no known-malicious or suspicious hosts. The Microsoft domain listed in the run was identified as background activity from the analysis environment rather than sample-generated traffic.
What To Do Now
The evidence strongly indicates that Trapmine's isolated alert is a false positive. Because the executable is unsigned, obtain it through Steam or another authenticated game installation channel and keep security software enabled.
Where this verdict could be wrong2 caveats
- Trapmine produced one generic machine-learning detection, although no other engine corroborated it.
- The executable is unsigned, so its claimed game identity cannot be authenticated through a publisher certificate.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines flagged the file.
- The completed sandbox found no offensive behavior, persistence, injection, or files it created.
- Complete reputation coverage of all observed hosts found no malicious or suspicious destinations.
- No malware-specific external-intelligence source corroborated the isolated alert.
- The file has been known since August 2022 rather than appearing as a sample.
- The executable is unsigned, so there is no publisher certificate to authenticate its origin.
- Trapmine issued one generic machine-learning detection.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 1spawned processes
- 0network contacts
- 7filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
3MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1082· System recon
- T1574.002· Execution hijack
Observed activity
Processes started
1Programs the file ran, with their command lines.
97fb771a4bfbc152c029168c67733780c44a74db123b43b798686aaf3be9a873.exe%SAMPLEPATH%\97fb771a4bfbc152c029168c67733780c44a74db123b43b798686aaf3be9a873.exe
Files
7Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER51B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER70F.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER75E.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER19BE.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER19BF.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER19CF.tmp.txt
Show all 7 entries for files
- Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat
Sandbox background — not the file
11The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM host
www.microsoft.com - VM host
204.79.197.203 - VM host
a83f:8110:25e0:0:33:c189:648:8b5c - VM host
20.62.24.77 - VM host
23.216.147.62
Show all 11 entries for sandbox background — not the file
- VM host
20.80.129.13 - VM host
20.99.185.48 - VM host
20.99.133.109 - VM host
23.216.81.152 - VM host
184.25.191.235
Chapter 04
Technical details
1 of the 75 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 9, 2026, 10:21 PM UTC
- SHA-256
97fb771a4bfbc152c029168c67733780c44a74db123b43b798686aaf3be9a873- SHA-1
19658e5a21ac78bcdfccd2336b5e839a7bf19f7c- MD5
5f346e9b3711f5227c7a40542b1283e7
About this file
Quake_x64_steam.exe is a Win32 EXE file of 15.8 MB.
- Type and size
- Win32 EXE · 15.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 19, 2022On VirusTotal.
- Submitted by
- 6 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 4.34 of 8
First scanned
Antivirus consensus
1 of 75 engines flagged this file
4 of the 79 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-239 engines0flagged
- Low-trust18 engines1flagged
View all 79 engine results
- TrapmineMalicious: malicious.moderate.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CybereasonClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- MaxSecureClean
- McAfeeClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Quake_x64_steam.exe safe?
What is Quake_x64_steam.exe?
How many antivirus engines detected Quake_x64_steam.exe?
What is the SHA-256 hash of Quake_x64_steam.exe?
Is it safe to run Quake_x64_steam.exe?
How up to date is this analysis of Quake_x64_steam.exe?
Community
Member reviews and reports for this exact file hash.