File scan report
Verdict Suspicious
Is Supervive
Six of the 68 antivirus engines that checked it flagged this new unsigned launcher, while offensive sandbox mappings lack a named target and receive no family or network…
Read the whole reasonShow less
Why Suspicious? 6 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
6 of 68 flagged
- Flagged 6
- No detection 62
- No result 7
- Code signing Unsigned
- Test run Completed
- First seen 11d ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The file is unsigned, and flagged by 6 of the 68 antivirus engines that checked it, including one major antivirus engine using a generic Agent label. One sandbox mapped possible process injection and security-control impairment, but produced no malicious verdict, identified no injection target, and contacted no host with a known bad reputation.
The detection count is meaningful because six independent engines flagged the executable, although only Ikarus is major and no family consensus exists. Its unsigned status and extremely limited distribution make the claimed launcher identity difficult to verify. The test run mapped and T1562.001, but it did not identify an injected process or return a malicious sandbox verdict. All observed network contacts were covered by the host-reputation check, with no known malicious or suspicious host found. The absence of packing, malicious files it created, specific YARA matches, or external malware-feed corroboration leaves the evidence mixed rather than conclusive.
What We Detected
Six of the 68 antivirus engines that checked it flagged the executable. Ikarus supplied the only major detection, naming a generic Win64 Agent trojan, while the remaining results were broad malware, machine-learning, or hash-based labels. The file is unsigned and was submitted only once on its first observed day, so there is no established publisher or distribution history supporting its identity.
Threat Behavior
The completed sandbox mapped T1055, associated with process injection, and T1562.001, associated with impairing defenses. However, no injected target process was recorded, no persistence was observed, and the sandbox did not return a malicious verdict. All 30 distinct observed domains and IP addresses were covered by the reputation cross-check; none matched a known malicious or suspicious host. The one dropped file lacks a saved verdict and therefore provides no evidence either way.
What To Do Now
Do not run this executable on a primary system until its origin can be verified through the game's official distribution channel. Keep security software enabled, let your antivirus remove the file if it arrived unexpectedly, and seek a signed or otherwise authenticated copy before installation.
Where this verdict could be wrong3 caveats
- Six independent engines raised detections, including Ikarus, so the result cannot be dismissed as less reliable noise alone.
- The completed sandbox did not issue a malicious verdict, and every observed network host received complete reputation coverage without a known malicious or suspicious match.
- No packing, high-entropy code, malicious child, MalwareBazaar match, or malware-specific YARA rule corroborated the detections.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Sixteen major antivirus engines did not flag the file, and no malware family achieved consensus.
- The sandbox did not issue a malicious verdict or identify an injected target process.
- Every observed network contact was reputation-checked without a known malicious or suspicious match.
- No packing, high-entropy code, malicious child verdict, malware-feed match, or malware-specific YARA rule was found.
- The executable is unsigned and has no established publisher history.
- It is and has only one recorded submission.
- Six independent engines flagged it, including one major antivirus engine with a generic Agent-trojan label.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 3spawned processes
- 28network contacts
- 3filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Read the user name of the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
SuperviveLauncher-1.4.0.exe
602cc7bca59522c59fafad0c5ba67d691853aaa2cc1dbbbca822200226fdcb6c
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/about/
Test run - Evidence 3 of 7: ProcessSeen in the test run
SuperviveLauncher-1.4.0.exe
"C:\Users\<USER>\Desktop\SuperviveLauncher-1.4.0.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
connect-cache.json.tmp
C:\Users\<USER>\AppData\Roaming\SuperviveLauncher\connect-cache.json.tmp
Test run - Evidence 5 of 7: Written fileSeen in the test run
connect-cache.json
C:\Users\<USER>\AppData\Roaming\SuperviveLauncher\connect-cache.json
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
game.supervive.live
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
api.supervive.live
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes 13 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
6 of the 68 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 6
- Ikarus (major engine)Trojan.Win64.Agent
- BkavW32.Malware.8CA09622
- DeepInstinctMALICIOUS
- GoogleDetected
- McAfeeDti!602CC7BCA595
- Trapminesuspicious.low.ml.score
File fingerprint
- Last analyzed
- Oct 15, 2026, 1:47 PM UTC
- SHA-256
602cc7bca59522c59fafad0c5ba67d691853aaa2cc1dbbbca822200226fdcb6c- SHA-1
7f88d75d7d515cf8e8ffaefb13aa497d969ecfa9- MD5
12721a4e064c0f0d6818b1a87b6db491
About this file
SuperviveLauncher-1.4.0.exe is a Win32 EXE file of 7.7 MB.
- Type and size
- Win32 EXE · 7.7 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 15, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.92 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is SuperviveLauncher-1.4.0.exe safe, or is it malware?
What is SuperviveLauncher-1.4.0.exe?
How many antivirus engines detected SuperviveLauncher-1.4.0.exe?
I already downloaded and ran SuperviveLauncher-1.4.0.exe — what should I do?
What is the SHA-256 hash of SuperviveLauncher-1.4.0.exe?
How up to date is this analysis of SuperviveLauncher-1.4.0.exe?
Community
Member reviews and reports for this exact file hash.