File scan report
Verdict Safe
Is lego1_
None of the 70 antivirus engines that checked it flagged this unsigned game patch executable, first seen on Mar 25, 2011, and its sandbox runs showed no high-risk behaviour.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This file can be used if it came from a trusted source. Keep your antivirus enabled as usual.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of our 74 antivirus engines flag this file, including every major antivirus engine. It has a long public history since Mar 25, 2011, with 84 different sources. The combined sandbox verdict was clean with no high-risk techniques. It is unsigned, so get it from a source you trust.
No engine flags the file, and all 18 major antivirus engines report it clean. The file was first seen on Mar 25, 2011, and 84 sources have submitted it over that time with no detections appearing. The combined sandbox verdict was clean and recorded no injection, no persistence and no high-risk techniques. All six contacted hosts were checked and none has a malicious or suspicious reputation. The file's high entropy sits in its resource section, which fits bundled game data rather than packing. The only weak notes are the missing signature and one direct-IP connection that nothing else corroborates.
What We Detected
0 of the 70 antivirus engines that checked it flagged this Windows executable, and all 18 major antivirus engines reported it clean. It was first seen on Mar 25, 2011, and 84 sources have submitted it. The file is unsigned and built with Microsoft Visual C++. The antivirus analysis found no packer: the high entropy is limited to the large resource section, as expected for embedded game data. Reference databases and community rule sets returned no hits.
Threat Behavior
The combined sandbox verdict was clean. They recorded only techniques common in legitimate software, with no process injection, persistence or dropped files. One of our behaviour rules noted a single direct-IP connection. However, every contacted host was checked and none has a malicious or suspicious reputation.
What To Do Now
No action is needed if you obtained this patch from a trusted source. Because it is unsigned, prefer the official distributor and keep your security software enabled.
Where this verdict could be wrong2 caveats
- The file is unsigned, so its publisher cannot be confirmed.
- One behaviour rule noted a direct connection to a single IP address without a matching domain lookup, though that host has no bad reputation and nothing else corroborates it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged it, including all major antivirus engines.
- It has been publicly known since Mar 25, 2011, and 84 sources have submitted it.
- The combined sandbox verdict was clean with no high-risk techniques.
- All contacted hosts were checked and none has a bad reputation.
- The executable has no digital signature.
- It made one direct-IP connection without a matching domain lookup; nothing else corroborates this.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 12sandbox rule tags
- 3spawned processes
- 2network contacts
- 9filesystem & mutex artifacts
Includes the sandbox verdicts, 12 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 25, 2026, 2:33 PM UTC
- SHA-256
fc3b0c34c0542b47f3ea92480a40afc1f286ae2dfbade8e481e1d1c0873b090e- SHA-1
d2664fb425112a14b1c03d647c1fc95091e3a8b8- MD5
576401a0332852eca273971e978e269f
About this file
lego1_patch2.exe says it is TODO: <File description> (TODO: <Product name>), 9.3 MB.
- Claims to be
- TODO: <File description> (TODO: <Product name>)From the file's own version information, written by whoever built it.
- Original name
- lego1_patch2.exeMatches the shared file name.
- Type and size
- Win32 EXE · 9.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 25, 2011On VirusTotal.
- Submitted by
- 84 distinct sources
- Packer
- None detected
- Entropy
- 7.61 of 8
First scanned
Includes every engine result (74), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is lego1_patch2.exe safe?
What is lego1_patch2.exe?
How many antivirus engines detected lego1_patch2.exe?
What is the SHA-256 hash of lego1_patch2.exe?
Is it safe to run lego1_patch2.exe?
How up to date is this analysis of lego1_patch2.exe?
Community
Member reviews and reports for this exact file hash.