File scan report
Verdict Safe
Is Paralives
Only two less reliable engines raised generic detections, while major antivirus engines remained silent and the completed sandbox run returned a clean result.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 64 flagged
- Flagged 2
- No detection 62
- No result 10
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Two of the 64 antivirus engines that checked it flagged this unsigned executable, but both detections came from less reliable engines and neither identified a credible malware family.
APEX and Bkav were the only two of the 64 antivirus engines that checked it to flag the sample, and both supplied generic less reliable labels. No major antivirus engines detected it, and there is no family consensus or corroboration from malware-specific research rules. One completed sandbox run returned clean; its and mappings lack a named injection target, observed encrypted files, or another adverse runtime finding. The unsigned status and adverse import-table fingerprint history reduce confidence, but those historical matches concern differently named files without a matching signer and may represent a shared build framework. Complete host-reputation coverage is unavailable, and the ten extracted components have no saved assessments, so those areas remain unresolved rather than exculpatory.
What We Detected
Two of the 64 antivirus engines that checked it flagged the executable. APEX used a generic malicious label, while Bkav reported W32.Malware.6720923F; both are less reliable detections, and no major antivirus engines reported malware. No malware-specific research rule or known malware-feed match corroborated these alerts.
Threat Behavior
One sandbox run completed and returned clean. It mapped activity to T1055 (Process Injection) and T1486 (Data Encrypted for Impact), but no injected target process was identified, no file-encryption outcome was recorded, and no malicious sandbox verdict resulted. The only recorded IP contact was identified as analysis-environment background traffic, not sample activity. A complete contacted-host reputation check is unavailable.
What To Do Now
Keep antivirus and security software enabled. Use the executable only if it came from the expected developer or distribution channel, and avoid granting administrator access unless the tool clearly requires it. If its origin cannot be verified, obtain a fresh copy from the official project source.
Where this verdict could be wrong4 caveats
- The executable is unsigned, so there is no verified publisher identity or established signer history.
- Runtime mapping included process injection and data-encryption impact, though no target process, encryption evidence, or adverse sandbox verdict corroborated them.
- Several files sharing the import-table fingerprint previously received adverse assessments, but all are unrelated-name matches without a matching signer and may reflect a common build framework.
- Ten extracted files have no saved assessments, and no complete contacted-host reputation result is available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only two of the 64 antivirus engines that checked it flagged the file, and both were less reliable detectors using generic labels.
- No major antivirus engines reported malware or agreed on a threat family.
- The completed sandbox run returned clean.
- No packer or high-entropy code was identified.
- No malware-specific research rules or known malware-feed records matched the sample.
- The executable is unsigned and has no established publisher history.
- Sandbox data mapped possible process injection and encryption-impact techniques, although neither was behaviorally corroborated.
- Five differently named files sharing the same import hash previously received suspicious or malware-related assessments.
- A complete reputation check for observed hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 3spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1202
- T1486· File encryption
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1574· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
ParalivesModToolByN0R0IK0.exe"C:\Users\<USER>\Desktop\ParalivesModToolByN0R0IK0.exe"cmd.exeC:\Windows\system32\cmd.exe /c "ver"ParalivesModToolByN0R0IK0.exe"C:\Users\user\Desktop\ParalivesModToolByN0R0IK0.exe"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\PIL\_avif.cp314-win_amd64.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\PIL\_imaging.cp314-win_amd64.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\PIL\_imagingcms.cp314-win_amd64.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\PIL\_imagingmath.cp314-win_amd64.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\PIL\_imagingtk.cp314-win_amd64.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\PIL\_webp.cp314-win_amd64.pyd
Show all 15 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\VCRUNTIME140.dll - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\VCRUNTIME140_1.dll - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\_asyncio.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\_bz2.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\_ctypes.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\_decimal.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\_elementtree.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\_hashlib.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI60642\_lzma.pyd
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 7 entries for sandbox background — not the file
- VM host
162.159.36.2
Chapter 04
Technical details
2 of the 64 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- APEXMalicious
- BkavW32.Malware.6720923F
File fingerprint
- Last analyzed
- Oct 11, 2026, 1:36 AM UTC
- SHA-256
dc3c320c64d38ca8f7ee244eacf02dbc865589b8b84c829d1243e7e1c4098ebf- SHA-1
b3b67383d918cc58dc490910b68f66a809b7a3b1- MD5
bb2f260b91f75a156399dbbb9354e21d
About this file
ParalivesModTool-22-2-0-[number].exe is a Win32 EXE file of 31.7 MB.
- Type and size
- Win32 EXE · 31.7 MB
- Signer
- UnsignedNo code signature.
- First seen
- May 31, 2026On VirusTotal.
- Submitted by
- 5 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.40 of 8
First scanned
Antivirus consensus
2 of 64 engines flagged this file
10 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-115 engines0flagged
- Tier-234 engines0flagged
- Low-trust15 engines2flagged
View all 74 engine results
- APEXMalicious: Malicious
- BkavMalicious: W32.Malware.6720923F
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetNo result
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ParalivesModTool-22-2-0-[number].exe safe?
What is ParalivesModTool-22-2-0-[number].exe?
How many antivirus engines detected ParalivesModTool-22-2-0-[number].exe?
What is the SHA-256 hash of ParalivesModTool-22-2-0-[number].exe?
Is it safe to run ParalivesModTool-22-2-0-[number].exe?
How up to date is this analysis of ParalivesModTool-22-2-0-[number].exe?
Community
Member reviews and reports for this exact file hash.