File scan report
Verdict Suspicious
Is sgwc2v139421+
Unsigned game-cheat utility flagged by 2 major antivirus engines on weak consensus; MPRESS packer, no malicious behaviour, medium prevalence.
Read the whole reasonShow less
Why Suspicious? 9 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat this file as a likely game-cheat or game-modification utility rather than active malware, but do not execute it on systems with sensitive data. If you are uncertain of its origin or intent, isolate it and consult your security team before running it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
9 of 72 flagged
- Flagged 9
- No detection 63
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This unsigned executable is flagged by Sophos and Symantec as a game-cheat tool, but the major consensus is weak (1 engine naming the family) and split between unwanted program and generic ML labels. The file shows no offensive MITRE techniques, no malicious sandbox verdicts, and no contact with known-malicious hosts. The MPRESS packer is legitimate compression software, and the community YARA rule confirms packer detection rather than malware-specific signatures.
The sample presents a mixed-signal profile. Two major antivirus engines (Sophos, Symantec) flagged it, but only Sophos names a specific family ('GameHack'), and Symantec uses a generic ML confidence label. The major family consensus is not strong (1 engine). Critically, the behaviour analysis shows zero offensive MITRE techniques, no malicious sandbox verdicts, and no contact with malicious hosts — inconsistent with active malware. The PE analysis reveals MPRESS packer sections, a legitimate compression tool, and the community YARA rule from Nextron THOR confirms detection of the packer itself, not a malware-specific signature. Prevalence is medium (44 submissions over 1737 days), suggesting a known commodity rather than a novel threat. The unsigned status and obfuscated filename are consistent with game-mod distribution, not adversarial impersonation. The balance of evidence suggests a flagged-but-benign game-cheat utility rather than malware.
What We Detected
The antivirus engines flagged this unsigned 64-bit Windows executable with 9 detections out of 72 engines reporting. Two major antivirus engines (Sophos, Symantec) contributed detections, but the consensus is weak: Sophos labels it 'GameHack' and Symantec uses a generic machine-learning confidence label. Four smaller engines and three less reliable engines also flagged it, but no major family consensus emerged (only 1 engine naming 'gamehack').
Threat Behavior
Behaviour analysis revealed zero offensive MITRE techniques and no malicious sandbox verdicts. The file did not contact any known-malicious hosts, drop malicious files it created, or exhibit persistence indicators. The only detected technique is T1027.002 (obfuscated files), consistent with the MPRESS packer found in the PE sections. The MPRESS packer is a legitimate compression tool, not malware-specific. Community researchers flagged the sample via a YARA rule ('SUSP_MPRESS_EXE_Packer') from Nextron THOR APT Scanner, which detects the packer itself, not a malware signature. No external intelligence (CIRCL, MalwareBazaar, YARAify) corroborated malicious intent.
Prevalence & Context
The file has medium prevalence (44 submissions from 39 sources over 1,737 days since first submission in October 2021), suggesting a known commodity rather than a novel threat. The filename 'sgwc2v139421+10tr.exe' contains obfuscated alphanumeric characters and a numeric suffix, typical of game-mod distribution channels, not security-software impersonation.
What To Do Now
This sample exhibits characteristics of a game-cheat or game-modification utility flagged by rule-based engines rather than consensus malware detection. If you downloaded this file intentionally as a game mod, the risk is low but not zero — game-cheat tools can carry secondary payloads or be repurposed by attackers. If you encountered it unexpectedly, exercise caution: do not execute it on a system with sensitive data. Consider isolating the file or submitting it to your security team for further analysis if you are uncertain of its origin.
Where this verdict could be wrong3 caveats
- Sophos and Symantec (both major) did flag the sample; if the 'GameHack' label reflects genuine game-cheat functionality, unwanted program classification may be warranted rather than 'safe'. However, unwanted program is a category distinct from malware, and the weak consensus (1/18 major antivirus engines) + absence of malicious behaviour suggests rule-based over-flagging.
- MPRESS packer is sometimes used by malware authors to evade detection; however, the absence of offensive MITRE techniques, malicious sandbox verdicts, and external-intel corroboration argues against active malware here.
- The filename obfuscation ('sgwc2v139421+10tr.exe') could indicate adversarial intent, but it is consistent with game-mod distribution naming conventions and does not trigger adversarialInputFlags.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero offensive MITRE techniques; only obfuscation detected
- No malicious sandbox verdicts, no contacted malicious hosts, no dropped malicious files it created
- Medium prevalence (44 submissions, 39 sources) — known commodity, not novel threat
- No external-intelligence corroboration (CIRCL, MalwareBazaar, YARAify all negative)
- Community YARA rule confirms MPRESS packer detection, not malware-specific signature
- Unsigned executable — no publisher identity verification
- Weak major consensus (1 engine) on 'gamehack' family; split between unwanted program and generic ML labels
- MPRESS packer present — legitimate compression tool but sometimes used by malware authors
- Obfuscated filename — consistent with game-mod distribution but also used by adversaries
- No malicious behaviour observed in sandbox or the test run
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 1sandbox rule tag
- 0spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
1MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027.002· Obfuscated code
Observed activity
Registry and auto-start
5Settings the file changed, including ways to start again after a restart.
- Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help - Deleted
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List
Chapter 04
Technical details
9 of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 9
- Sophos (major engine)GameHack (PUA)
- Symantec (major engine)ML.Attribute.HighConfidence
- AhnLab-V3Unwanted/Win.GameCheat.C5198950
- BkavW64.AIDetectMalware
- DeepInstinctMALICIOUS
- GoogleDetected
- GridinsoftHack.Win64.GameHack.cl
- Trapminesuspicious.low.ml.score
File fingerprint
- Last analyzed
- Jul 9, 2026, 4:20 AM UTC
- SHA-256
e28a94ef47cc5fa489b0f2203c7a3dac1f01e2b7ede139d0a121566e34891269- SHA-1
51394e2cf7f74f8f7c67469c4fdfd4253fc1a553- MD5
03c05e959fcbfb61fbdcf684af45b74b
About this file
sgwc2v139421+10tr.exe is a Win32 EXE file of 2.3 MB.
- Type and size
- Win32 EXE · 2.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 6, 2021On VirusTotal.
- Submitted by
- 39 distinct sources
- Packer
- MPRESS (section names)Packing hides code; legitimate installers use it too.
- Entropy
- 7.63 of 8
First scanned
Antivirus consensus
9 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines2flagged
- Tier-236 engines4flagged
- Low-trust18 engines3flagged
View all 76 engine results
- AhnLab-V3Malicious: Unwanted/Win.GameCheat.C5198950
- BkavMalicious: W64.AIDetectMalware
- DeepInstinctMalicious: MALICIOUS
- GoogleMalicious: Detected
- GridinsoftMalicious: Hack.Win64.GameHack.cl
- SophosMalicious: GameHack (PUA)
- SymantecMalicious: ML.Attribute.HighConfidence
- TrapmineMalicious: suspicious.low.ml.score
- VaristMalicious: W64/GameHack.AW.gen!Eldorado
- AcronisClean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is sgwc2v139421+10tr.exe safe, or is it malware?
What is sgwc2v139421+10tr.exe?
How many antivirus engines detected sgwc2v139421+10tr.exe?
I already downloaded and ran sgwc2v139421+10tr.exe — what should I do?
What is the SHA-256 hash of sgwc2v139421+10tr.exe?
How up to date is this analysis of sgwc2v139421+10tr.exe?
Community
Member reviews and reports for this exact file hash.