File scan report
Verdict Suspicious
Is Game
Eight of the 72 antivirus engines that checked it flagged this unsigned launcher, including three major antivirus engines, while possible WMIADAP injection conflicts with…
Read the whole reasonShow less
Why Suspicious? 8 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
8 of 72 flagged
- Flagged 8
- No detection 64
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Three major antivirus engines and five other independent products flagged the unsigned executable, with Ikarus specifically naming an injector. One sandbox run found no high-risk techniques or hostile hosts, but it recorded WMIADAP.EXE as an injection target, leaving a material unresolved risk rather than firm family attribution.
Eight of the 72 antivirus engines that checked it flagged the executable, including Fortinet, Ikarus, and McAfee, giving the detections more weight than a less reliable-only pattern. The labels are largely generic and do not converge on a named family; only Ikarus specifically calls it an injector. The test run completed once and returned clean, with no high-risk techniques or persistence, while the complete host check found no known hostile contacts. However, the run records WMIADAP.EXE as an injected process, which is a significant behavioral concern even without a mapped offensive technique. The executable is unsigned and has limited prevalence, while no packing, malware-specific research rules, or confirmed malicious child provides further corroboration. These conflicting signals support containment and source verification rather than routine execution.
What We Detected
Eight of the 72 antivirus engines that checked it flagged the executable. Fortinet, Ikarus, and McAfee are major detections; Ikarus reported Trojan.Win64.Injector, while the other labels were generic or rule and did not establish a consistent malware family.
Threat Behavior
One completed sandbox run reported clean and showed no high-risk techniques or persistence indicators. The observed contacts were fully cross-checked and none were known malicious or suspicious. Nevertheless, the behavior record identifies WMIADAP.EXE as an injection target, creating a notable conflict with the otherwise quiet run. One dropped file lacks a saved verdict, so it provides no conclusion either way.
What To Do Now
Do not launch this executable on a production or personal system until its origin and expected publisher are verified. Keep security software enabled, let your antivirus remove the file, and obtain a fresh copy from the game's official distribution channel if its authenticity cannot be established.
Where this verdict could be wrong4 caveats
- One completed sandbox run returned clean and recorded no high-risk techniques or persistence indicators.
- The complete contacted-host cross-check found no known malicious or suspicious hosts among the observed contacts.
- No packing, high-entropy code, malware-specific research rules, or malicious file it created was identified.
- Most engines did not flag the file, including BitDefender, ESET, Kaspersky, Avast, and Avira.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- One completed sandbox run returned clean and found no high-risk techniques or persistence.
- All observed network hosts were checked, with none known as malicious or suspicious.
- No packer or high-entropy code was detected.
- No malware-specific research rules or malicious file it created corroborated the engine detections.
- Most antivirus products, including several major antivirus engines, did not flag the file.
- Eight antivirus products flagged the executable, including three major antivirus engines.
- Ikarus identified behavior consistent with a Windows injector.
- The executable has no digital signature or established publisher history.
- Only five sources submitted the file, providing limited prevalence support.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 3spawned processes
- 4network contacts
- 7filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Used an unusual way to talk to a server.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
GameLauncher.exe
b826f13fd70f21c926ceec68ddfac2ebe4af783b54de69b3ed71e8cf11e6c425
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
GameLauncher.exe
"C:\Users\<USER>\Desktop\GameLauncher.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
GameLauncher.exe
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
History
C:\Users\user\AppData\Local\Microsoft\Windows\History
Test run - Evidence 5 of 7: Written fileSeen in the test run
INetCache
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
update.nekonyansoft.com
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
auto-updater-endpoint.bluebeach-b3055dd8.westeurope.azurecontainerapps.io
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 13 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
8 of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 8
- Fortinet (major engine)PossibleThreat.RF
- Ikarus (major engine)Trojan.Win64.Injector
- McAfee (major engine)Artemis!1DD41B3A0245
- Antiy-AVLTrojan/Win64.Agent
- APEXMalicious
- CrowdStrikewin/malicious_confidence_60% (W)
- GoogleDetected
- RisingTrojan.Kryptik@AI.81 (RDML:+IUISx4JHbALpKuXTsi+5w)
File fingerprint
- Last analyzed
- Oct 10, 2026, 7:14 PM UTC
- SHA-256
b826f13fd70f21c926ceec68ddfac2ebe4af783b54de69b3ed71e8cf11e6c425- SHA-1
c090f9a9d42ac6423d274e5a5c7489c549c04b47- MD5
1dd41b3a02458086f852c35e7b68453a
About this file
GameLauncher.exe is a Win32 EXE file of 2.9 MB.
- Type and size
- Win32 EXE · 2.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jan 26, 2025On VirusTotal.
- Submitted by
- 5 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 4.95 of 8
First scanned
Includes every engine result (76), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is GameLauncher.exe safe, or is it malware?
What is GameLauncher.exe?
How many antivirus engines detected GameLauncher.exe?
I already downloaded and ran GameLauncher.exe — what should I do?
What is the SHA-256 hash of GameLauncher.exe?
How up to date is this analysis of GameLauncher.exe?
Community
Member reviews and reports for this exact file hash.