File scan report
Verdict Safe
Is lego1_
None of the 70 antivirus engines that checked it flagged this unsigned game patch executable, first seen on Mar 25, 2011, and its sandbox runs showed no high-risk behaviour.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This file can be used if it came from a trusted source. Keep your antivirus enabled as usual.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of our 74 antivirus engines flag this file, including every major antivirus engine. It has a long public history since Mar 25, 2011, with 84 different sources. The combined sandbox verdict was clean with no high-risk techniques. It is unsigned, so get it from a source you trust.
No engine flags the file, and all 18 major antivirus engines report it clean. The file was first seen on Mar 25, 2011, and 84 sources have submitted it over that time with no detections appearing. The combined sandbox verdict was clean and recorded no injection, no persistence and no high-risk techniques. All six contacted hosts were checked and none has a malicious or suspicious reputation. The file's high entropy sits in its resource section, which fits bundled game data rather than packing. The only weak notes are the missing signature and one direct-IP connection that nothing else corroborates.
What We Detected
0 of the 70 antivirus engines that checked it flagged this Windows executable, and all 18 major antivirus engines reported it clean. It was first seen on Mar 25, 2011, and 84 sources have submitted it. The file is unsigned and built with Microsoft Visual C++. The antivirus analysis found no packer: the high entropy is limited to the large resource section, as expected for embedded game data. Reference databases and community rule sets returned no hits.
Threat Behavior
The combined sandbox verdict was clean. They recorded only techniques common in legitimate software, with no process injection, persistence or dropped files. One of our behaviour rules noted a single direct-IP connection. However, every contacted host was checked and none has a malicious or suspicious reputation.
What To Do Now
No action is needed if you obtained this patch from a trusted source. Because it is unsigned, prefer the official distributor and keep your security software enabled.
Where this verdict could be wrong2 caveats
- The file is unsigned, so its publisher cannot be confirmed.
- One behaviour rule noted a direct connection to a single IP address without a matching domain lookup, though that host has no bad reputation and nothing else corroborates it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged it, including all major antivirus engines.
- It has been publicly known since Mar 25, 2011, and 84 sources have submitted it.
- The combined sandbox verdict was clean with no high-risk techniques.
- All contacted hosts were checked and none has a bad reputation.
- The executable has no digital signature.
- It made one direct-IP connection without a matching domain lookup; nothing else corroborates this.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 12sandbox rule tags
- 3spawned processes
- 2network contacts
- 9filesystem & mutex artifacts
What this file did when executed
This file was detonated in 7 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1056· Keylogging
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1497.001· Sandbox evasion
- T1574.002· Execution hijack
- T1614
Observed activity
Processes started
3Programs the file ran, with their command lines.
software.exe"C:\Users\<USER>\Desktop\software.exe"fc3b0c34c0542b47f3ea92480a40afc1f286ae2dfbade8e481e1d1c0873b090e.exe%SAMPLEPATH%\fc3b0c34c0542b47f3ea92480a40afc1f286ae2dfbade8e481e1d1c0873b090e.exesoftware.exe"C:\Users\user\Desktop\software.exe"
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
64.233.181.94 - IP address
64.4.10.33
Files
2Files the file created, changed or deleted.
- Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 7 entries for mutexes
MSCTF.Shared.MUTEX.EBH
Sandbox background — not the file
5The analysis machine's own processes and connections, recorded in every run.
- VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM host
res.public.onecdn.static.microsoft - VM host
23.192.210.9 - VM host
20.99.186.246 - VM host
184.27.218.92
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 25, 2026, 2:33 PM UTC
- SHA-256
fc3b0c34c0542b47f3ea92480a40afc1f286ae2dfbade8e481e1d1c0873b090e- SHA-1
d2664fb425112a14b1c03d647c1fc95091e3a8b8- MD5
576401a0332852eca273971e978e269f
About this file
lego1_patch2.exe says it is TODO: <File description> (TODO: <Product name>), 9.3 MB.
- Claims to be
- TODO: <File description> (TODO: <Product name>)From the file's own version information, written by whoever built it.
- Original name
- lego1_patch2.exeMatches the shared file name.
- Type and size
- Win32 EXE · 9.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 25, 2011On VirusTotal.
- Submitted by
- 84 distinct sources
- Packer
- None detected
- Entropy
- 7.61 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust16 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence64.4.10.33
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is lego1_patch2.exe safe?
What is lego1_patch2.exe?
How many antivirus engines detected lego1_patch2.exe?
What is the SHA-256 hash of lego1_patch2.exe?
Is it safe to run lego1_patch2.exe?
How up to date is this analysis of lego1_patch2.exe?
Community
Member reviews and reports for this exact file hash.