File scan report
Verdict Safe
Is Battlegrounds_
A lone generic detection lacks corroboration from major antivirus engines, the test run, host reputation checks, or malware-specific external intelligence.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Unsigned
- Test run Completed
- First seen 7y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 66 antivirus engines that checked it flagged this older executable, using a generic label, while no major antivirus engines detected it. One sandbox run found no offensive behavior, and the complete host-reputation check found no known harmful contacts, although the unsigned status and updater-process interaction warrant ordinary caution.
The detection is isolated: only tehtris reported Generic.Malware, while the major antivirus engines produced no malicious findings. A completed sandbox run returned clean and recorded no offensive techniques, persistence, or dropped files. The host-reputation check covered all 17 distinct observed contacts and found none known to be malicious or suspicious; four contacts were analysis-environment background traffic. MalwareBazaar and YARAify supplied no corroboration, and the antivirus analysis found neither packing nor high-entropy code. The unsigned status and recorded interaction with two updater processes reduce certainty, but they do not outweigh the broad lack of independent corroboration.
What We Detected
Only 1 of the 66 antivirus engines that checked it flagged the executable. That finding came from tehtris as the generic label Generic.Malware; no major antivirus engines reported malware and no named family consensus exists.
Threat Behavior
One completed sandbox run returned clean, with no offensive techniques, persistence indicators, dropped files, or malicious files it created recorded. The run listed interaction with two updater processes, but there was no offensive injection mapping or malicious sandbox finding to establish harmful intent. The host-reputation check covered all 17 distinct observed contacts and found none known to be malicious or suspicious; four listed contacts were identified as analysis-environment background traffic.
What To Do Now
The isolated generic detection most likely represents a false positive. Because the executable is unsigned, obtain it from the original game installation media or another trusted source, verify its hash when possible, and keep security software enabled while running it.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so its publisher and integrity cannot be verified through code signing.
- tehtris reported the generic label Generic.Malware, though no other engine corroborated it.
- The sandbox recorded interaction with two updater processes; without a mapped offensive technique or supporting detections, its intent remains unclear.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines flagged the file.
- The completed sandbox run found no offensive behavior, persistence, or dropped files.
- All 17 observed hosts received reputation coverage, with none known as malicious or suspicious.
- No malware-specific external-intelligence rules or known-sample matches were found.
- The antivirus analysis found no packing or high-entropy code.
- The Windows executable is unsigned, so there is no authenticated publisher identity.
- One antivirus engine reported a generic malware detection.
- The sandbox recorded interaction with two updater processes, but did not establish malicious intent.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 2spawned processes
- 3network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1056· Keylogging
- T1056.001· Keylogging
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1564.003· Hides artifacts
- T1574.002· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
Battlegrounds_x2.exe%SAMPLEPATH%\Battlegrounds_x2.exed64e7f0ecc546c3bd833c5c6a7bc97b75ee74940d89b1cb22349b0ace0f3fc58.exe%SAMPLEPATH%\d64e7f0ecc546c3bd833c5c6a7bc97b75ee74940d89b1cb22349b0ace0f3fc58.exe
Network contacts
33 hosts, listed as 3 addresses. Links show the host and path only.
- IP address
209.85.145.94 - IP address
23.59.198.43 - IP address
23.44.253.134
Files
15Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2A.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC7.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF7.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC6.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF8.tmp.txt
Show all 15 entries for files
- Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER343A.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER34F5.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3525.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER39E8.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER39F9.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A09.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER32B3.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER335F.tmp.csv
Sandbox background — not the file
25The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3736_155469247\bin\updater.exe - VM process
updater.exeC:\Program Files\Google1380_1769453809\bin\updater.exe - VM injection target
C:\Program Files\Google3736_155469247\bin\updater.exe - VM injection target
C:\Program Files\Google1380_1769453809\bin\updater.exe
Show all 25 entries for sandbox background — not the file
- VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
204.79.197.203 - VM host
23.216.147.76 - VM host
20.99.184.37 - VM host
20.99.133.109 - VM host
192.229.211.108 - VM host
20.99.186.246 - VM host
104.86.182.43 - VM host
20.99.185.48 - VM host
192.168.0.26 - VM host
52.154.209.174 - VM host
23.216.81.152 - VM host
192.168.0.75 - VM host
52.185.73.156 - VM host
192.168.0.35 - VM host
192.168.0.47 - VM host
192.168.0.69 - VM host
20.69.140.28
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- tehtrisGeneric.Malware
File fingerprint
- Last analyzed
- Oct 17, 2026, 9:53 AM UTC
- SHA-256
d64e7f0ecc546c3bd833c5c6a7bc97b75ee74940d89b1cb22349b0ace0f3fc58- SHA-1
13ad66e8365a2aca974b1a5ccbfcaad07fc78eea- MD5
3ea18c203edd0b01502841e3a0c51ceb
About this file
Battlegrounds_x2.exe is a Win32 EXE file of 2.8 MB.
- Type and size
- Win32 EXE · 2.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 12, 2019On VirusTotal.
- Submitted by
- 99 distinct sources
- Packer
- None detected
- Entropy
- 6.21 of 8
First scanned
Antivirus consensus
1 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-116 engines0flagged
- Tier-233 engines1flagged
- Low-trust17 engines0flagged
View all 75 engine results
- tehtrisMalicious: Generic.Malware
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Battlegrounds_x2.exe safe?
What is Battlegrounds_x2.exe?
How many antivirus engines detected Battlegrounds_x2.exe?
What is the SHA-256 hash of Battlegrounds_x2.exe?
Is it safe to run Battlegrounds_x2.exe?
How up to date is this analysis of Battlegrounds_x2.exe?
Community
Member reviews and reports for this exact file hash.