File scan report
Verdict Suspicious
Is Supervive Launcher- 1. 4. 0. exe safe? Treat it as suspicious.
Six of the 68 antivirus engines that checked it flagged this new unsigned launcher, while offensive sandbox mappings lack a named target and receive no family or network…
Read the whole reasonShow less
Why Suspicious? 6 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
6 of 68 flagged
- Flagged 6
- No detection 62
- No result 7
- Code signing Unsigned
- Test run Completed
- First seen 11d ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The file is unsigned, and flagged by 6 of the 68 antivirus engines that checked it, including one major antivirus engine using a generic Agent label. One sandbox mapped possible process injection and security-control impairment, but produced no malicious verdict, identified no injection target, and contacted no host with a known bad reputation.
The detection count is meaningful because six independent engines flagged the executable, although only Ikarus is major and no family consensus exists. Its unsigned status and extremely limited distribution make the claimed launcher identity difficult to verify. The test run mapped and T1562.001, but it did not identify an injected process or return a malicious sandbox verdict. All observed network contacts were covered by the host-reputation check, with no known malicious or suspicious host found. The absence of packing, malicious files it created, specific YARA matches, or external malware-feed corroboration leaves the evidence mixed rather than conclusive.
What We Detected
Six of the 68 antivirus engines that checked it flagged the executable. Ikarus supplied the only major detection, naming a generic Win64 Agent trojan, while the remaining results were broad malware, machine-learning, or hash-based labels. The file is unsigned and was submitted only once on its first observed day, so there is no established publisher or distribution history supporting its identity.
Threat Behavior
The completed sandbox mapped T1055, associated with process injection, and T1562.001, associated with impairing defenses. However, no injected target process was recorded, no persistence was observed, and the sandbox did not return a malicious verdict. All 30 distinct observed domains and IP addresses were covered by the reputation cross-check; none matched a known malicious or suspicious host. The one dropped file lacks a saved verdict and therefore provides no evidence either way.
What To Do Now
Do not run this executable on a primary system until its origin can be verified through the game's official distribution channel. Keep security software enabled, let your antivirus remove the file if it arrived unexpectedly, and seek a signed or otherwise authenticated copy before installation.
Where this verdict could be wrong3 caveats
- Six independent engines raised detections, including Ikarus, so the result cannot be dismissed as less reliable noise alone.
- The completed sandbox did not issue a malicious verdict, and every observed network host received complete reputation coverage without a known malicious or suspicious match.
- No packing, high-entropy code, malicious child, MalwareBazaar match, or malware-specific YARA rule corroborated the detections.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Sixteen major antivirus engines did not flag the file, and no malware family achieved consensus.
- The sandbox did not issue a malicious verdict or identify an injected target process.
- Every observed network contact was reputation-checked without a known malicious or suspicious match.
- No packing, high-entropy code, malicious child verdict, malware-feed match, or malware-specific YARA rule was found.
- The executable is unsigned and has no established publisher history.
- It is and has only one recorded submission.
- Six independent engines flagged it, including one major antivirus engine with a generic Agent-trojan label.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 3spawned processes
- 28network contacts
- 3filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Read the user name of the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
SuperviveLauncher-1.4.0.exe
602cc7bca59522c59fafad0c5ba67d691853aaa2cc1dbbbca822200226fdcb6c
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/about/
Test run - Evidence 3 of 7: ProcessSeen in the test run
SuperviveLauncher-1.4.0.exe
"C:\Users\<USER>\Desktop\SuperviveLauncher-1.4.0.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
connect-cache.json.tmp
C:\Users\<USER>\AppData\Roaming\SuperviveLauncher\connect-cache.json.tmp
Test run - Evidence 5 of 7: Written fileSeen in the test run
connect-cache.json
C:\Users\<USER>\AppData\Roaming\SuperviveLauncher\connect-cache.json
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
game.supervive.live
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
api.supervive.live
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1539
- T1553
- T1553.002
- T1562· Disables security
- T1562.001· Disables security
- T1574· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/about/SuperviveLauncher-1.4.0.exe"C:\Users\<USER>\Desktop\SuperviveLauncher-1.4.0.exe"identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6688 --field-trial-handle=2032,i,7917595963316975846,1419103623743645200,262144 --variations-seed-version /prefetch:8
Network contacts
2828 hosts, listed as 13 domains, 15 addresses. Links show the host and path only.
- Domain
game.supervive.live - Domain
api.supervive.live - Domain
store.steampowered.com - Domain
store.fastly.steamstatic.com - Domain
cdn.fastly.steamstatic.com - Domain
shared.fastly.steamstatic.com
Show all 28 entries for network contacts
- Domain
xpaywalletcdn.azureedge.net - Domain
api.steampowered.com - Domain
help.steampowered.com - Domain
js.hcaptcha.com - Domain
a3acc6bfa027.w.hcaptcha.com - Domain
video.akamai.steamstatic.com - Domain
shared.akamai.steamstatic.com - IP address
104.21.45.218 - IP address
172.67.219.127 - IP address
184.29.36.172 - IP address
150.171.110.9 - IP address
150.171.76.13 - IP address
199.232.211.52 - IP address
199.232.215.52 - IP address
150.171.110.179 - IP address
23.223.240.82 - IP address
23.204.167.126 - IP address
104.19.230.21 - IP address
104.18.12.205 - IP address
23.205.109.8 - IP address
23.205.109.27 - IP address
150.171.75.13
Files
3Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Roaming\SuperviveLauncher\connect-cache.json.tmp - Written
C:\Users\<USER>\AppData\Roaming\SuperviveLauncher\connect-cache.json - Deleted
C:\Users\<USER>\AppData\Roaming\SuperviveLauncher\connect-cache.json.tmp
Registry and auto-start
3Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix
Sandbox background — not the file
5The analysis machine's own processes and connections, recorded in every run.
- VM process
RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding - VM host
edge-mobile-static.azureedge.net - VM host
business.bing.com - VM host
edge-consumer-static.azureedge.net - VM host
www.bing.com
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 766312fb138f083fc622…1c5e2fNot checkedno saved verdict
Chapter 04
Technical details
6 of the 68 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 6
- Ikarus (major engine)Trojan.Win64.Agent
- BkavW32.Malware.8CA09622
- DeepInstinctMALICIOUS
- GoogleDetected
- McAfeeDti!602CC7BCA595
- Trapminesuspicious.low.ml.score
File fingerprint
- Last analyzed
- Oct 15, 2026, 1:47 PM UTC
- SHA-256
602cc7bca59522c59fafad0c5ba67d691853aaa2cc1dbbbca822200226fdcb6c- SHA-1
7f88d75d7d515cf8e8ffaefb13aa497d969ecfa9- MD5
12721a4e064c0f0d6818b1a87b6db491
About this file
SuperviveLauncher-1.4.0.exe is a Win32 EXE file of 7.7 MB.
- Type and size
- Win32 EXE · 7.7 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 15, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.92 of 8
First scanned
Antivirus consensus
6 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines1flagged
- Tier-234 engines2flagged
- Low-trust17 engines3flagged
View all 75 engine results
- BkavMalicious: W32.Malware.8CA09622
- DeepInstinctMalicious: MALICIOUS
- GoogleMalicious: Detected
- IkarusMalicious: Trojan.Win64.Agent
- McAfeeDMalicious: ti!602CC7BCA595
- TrapmineMalicious: suspicious.low.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GridinsoftClean
- huorongClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 6 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is SuperviveLauncher-1.4.0.exe safe, or is it malware?
What is SuperviveLauncher-1.4.0.exe?
How many antivirus engines detected SuperviveLauncher-1.4.0.exe?
I already downloaded and ran SuperviveLauncher-1.4.0.exe — what should I do?
What is the SHA-256 hash of SuperviveLauncher-1.4.0.exe?
How up to date is this analysis of SuperviveLauncher-1.4.0.exe?
Community
Member reviews and reports for this exact file hash.