I'll also note that some of the items identified as suspicious in this analysis are in the installer, rather than the Alpine Faction patch itself. Removing directories, checking system ini files, etc. those are all normal things that most installers do of course.

It's annoying to have to report false positive detections to AV vendors (as I do), but I do understand why they are detecting it. Automated scanners are bad at understanding context, they just look at behaviours. Alpine Faction IS totally safe and legitimate, but the things it has to do as a patch for an older game would look suspicious to a person that isn't familiar with it and why it needs to legitimately do those things.

If you'd like to chat more in-depth about any of this, drop by our Discord server. I'd be happy to chat. https://discord.gg/factionfiles

Certainly Koboldshark, would be happy to.

The analysis names a few indicators which would normally be considered suspicious. Most critical amongst them in my opinion are:
1. PE file contains executable resources: Entirely expected - it is a piece of software after all.
2. Able to inject code into another process: At a technical level, AF works by injecting code into the normal RF process (to apply new functionality and fixes), so although this would typically be considered suspicious, it's entirely expected for an application like this.
5. Contains ability to communicate with network: Alpine Faction has an update checker mechanism built-in to alert you when updates are available. It also supports in-game map downloading from the FactionFiles community website, as well as FactionFiles account linking for additional optional in-game features (if you choose to set up the link). Network communication is necessary and expected for these functions.

The mod seems totally legit but I ran a virus scanner on it just to be sure and it says it looks malicious. I know as you said, scanners will often provide false positives when the application is new but this is an actual scan. Can you explain these results? Is it just because it modifies the files of the game which to scanners looks suspicious?

https://hybrid-analysis.com/sample/af290da68bcca9f100d7e0c0f3bd508614469eb65d2aecf1798a8a563e368f0a/6882b33f1cd5a0977d0f438e

Shockwave S08: Thanks for dropping by the Discord to chat about this issue, and I'm glad you were able to resolve it via manually creating the necessary registry keys.

Using Alpine Faction on Steam Deck through Proton, and unfortunately have no way to link my FactionFiles account to the game.