Analysis

  • max time kernel
    94s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/01/2023, 16:13

General

  • Target
    setup_undertale_1.08_(18328).exe
  • Size 126.7MB
  • Sample230103-tpjbaafb6x
  • SHA256 21fbcab3c652d5af9efe57454d60d5a5057773e1c234ed16ae14233724502b44
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • SnakeBOT

    SnakeBOT is a heavily obfuscated .NET downloader.

  • Contains SnakeBOT related strings 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 38 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_undertale_1.08_(18328).exe
    "C:\Users\Admin\AppData\Local\Temp\setup_undertale_1.08_(18328).exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Users\Admin\AppData\Local\Temp\is-6N1P5.tmp\setup_undertale_1.08_(18328).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6N1P5.tmp\setup_undertale_1.08_(18328).tmp" /SL5="$7011E,132362071,185856,C:\Users\Admin\AppData\Local\Temp\setup_undertale_1.08_(18328).exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:344
      • C:\GOG Games\Undertale\__support\scriptinterpreter.exe
        "C:\GOG Games\Undertale\__support\scriptinterpreter.exe" /verysilent /supportDir="C:\GOG Games\Undertale\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Undertale" /productId="1456487183" /buildId="50921790503031850" /versionName="1.08" /Language="English" /LANG="english"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Users\Admin\AppData\Local\Temp\is-JV63B.tmp\scriptinterpreter.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-JV63B.tmp\scriptinterpreter.tmp" /SL5="$101B0,569884,191488,C:\GOG Games\Undertale\__support\scriptinterpreter.exe" /verysilent /supportDir="C:\GOG Games\Undertale\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Undertale" /productId="1456487183" /buildId="50921790503031850" /versionName="1.08" /Language="English" /LANG="english"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "c:\gog games\undertale" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:580
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "c:\gog games\undertale" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:1096
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "c:\gog games\undertale\options.ini" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:1864
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\Users\Admin\AppData\Local\UNDERTALE" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:1336
      • C:\gog games\undertale\UNDERTALE.exe
        "C:\gog games\undertale\UNDERTALE.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:304
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 552
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1100
  • C:\GOG Games\Undertale\UNDERTALE.exe
    "C:\GOG Games\Undertale\UNDERTALE.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 508
      2⤵
      • Loads dropped DLL
      • Program crash
      PID:1812
  • C:\GOG Games\Undertale\UNDERTALE.exe
    "C:\GOG Games\Undertale\UNDERTALE.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 508
      2⤵
      • Loads dropped DLL
      • Program crash
      PID:1400

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        D3DX9_43.dll

        • Path C:\GOG Games\Undertale\D3DX9_43.dll
        • Size 1.9MB
        • SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
        • MD5 SHA1 SHA512 SSDEEP

        options.ini

        • Path C:\GOG Games\Undertale\__support\app\options.ini
        • Size 97B
        • SHA256 52a59e5417778aac32756ac0617d5b00fd47a9015e54b3865fdc17a867b58cf9
        • MD5 SHA1 SHA512

        scriptinterpreter.exe

        • Path C:\GOG Games\Undertale\__support\scriptinterpreter.exe
        • Size 1.1MB
        • SHA256 6dd87cb725336bcce9c75eed40fe544cd5cab32a2ea3ed09c6fa901a47db2f53
        • MD5 SHA1 SHA512 SSDEEP

        scriptinterpreter.exe

        • Path C:\GOG Games\Undertale\__support\scriptinterpreter.exe
        • Size 1.1MB
        • SHA256 6dd87cb725336bcce9c75eed40fe544cd5cab32a2ea3ed09c6fa901a47db2f53
        • MD5 SHA1 SHA512 SSDEEP

        abc_123_a.ogg

        • Path C:\GOG Games\Undertale\abc_123_a.ogg
        • Size 40KB
        • SHA256 baf01fcee2fa3cc9769af20407a4de9b30027a5e651be601808ab521485fea55
        • MD5 SHA1 SHA512 SSDEEP

        credits.txt

        • Path C:\GOG Games\Undertale\credits.txt
        • Size 11KB
        • SHA256 5e5ab1852c4734a547e6143ef643b43d211e3cee334e949cb59fffb51bf04098
        • MD5 SHA1 SHA512 SSDEEP

        data.win

        • Path C:\GOG Games\Undertale\data.win
        • Size 60.0MB
        • SHA256 946c738c6d6182f683431320a0e32470bc3deb50f3e8887e61998df0c4e3abc8
        • MD5 SHA1 SHA512 SSDEEP

        goggame-1456487183.hashdb

        • Path C:\GOG Games\Undertale\goggame-1456487183.hashdb
        • Size 7KB
        • SHA256 07f899a497faa6d3befbead9cc86f8ca24fcad719426f106a1eb2c28217743bc
        • MD5 SHA1 SHA512 SSDEEP

        goggame-1456487183.ico

        • Path C:\GOG Games\Undertale\goggame-1456487183.ico
        • Size 79KB
        • SHA256 6cba65c3c927a68407e8941ac8b12e3089130709efbdb2399123d084f1475d54
        • MD5 SHA1 SHA512 SSDEEP

        goggame-1456487183.script

        • Path C:\GOG Games\Undertale\goggame-1456487183.script
        • Size 419B
        • SHA256 f1c0f97ea9a8dbbb37355cef6f2d42832e97acb47b5e9bc327ece2d9b397c5a7
        • MD5 SHA1 SHA512

        mus_a2.ogg

        • Path C:\GOG Games\Undertale\mus_a2.ogg
        • Size 186KB
        • SHA256 244ca709fe88618b2ae34a2767bdea7ea6b79df4f795b5f4fc00eab3c03e2ba7
        • MD5 SHA1 SHA512 SSDEEP

        mus_alphysfix.ogg

        • Path C:\GOG Games\Undertale\mus_alphysfix.ogg
        • Size 36KB
        • SHA256 6f4cd2037b27e6dc0ab6044ce58a2e66db380a13e67b5167d50d9caf02e37ca0
        • MD5 SHA1 SHA512 SSDEEP

        mus_amalgam.ogg

        • Path C:\GOG Games\Undertale\mus_amalgam.ogg
        • Size 903KB
        • SHA256 249e51b1e8a06e4b1b4d9387a6a5362cbd65ec89e06f4d5028308402c6e1371a
        • MD5 SHA1 SHA512 SSDEEP

        mus_ambientwater.ogg

        • Path C:\GOG Games\Undertale\mus_ambientwater.ogg
        • Size 24KB
        • SHA256 195b5bdbc3066c2025b28667b5c7f72a22b01cd0f629d9601ec3c749858b706b
        • MD5 SHA1 SHA512 SSDEEP

        mus_anothermedium.ogg

        • Path C:\GOG Games\Undertale\mus_anothermedium.ogg
        • Size 1.6MB
        • SHA256 6d43d0a4a8a67918e0f4add018580f9ef120b9e0190cbdc0581d12827fb07ab8
        • MD5 SHA1 SHA512 SSDEEP

        mus_bad.ogg

        • Path C:\GOG Games\Undertale\mus_bad.ogg
        • Size 15KB
        • SHA256 79d6af19bc9ac74221af85e1ab5fa67c466b08ede7979090870d93a368f5abf6
        • MD5 SHA1 SHA512 SSDEEP

        mus_barrier.ogg

        • Path C:\GOG Games\Undertale\mus_barrier.ogg
        • Size 287KB
        • SHA256 3424de311fc694a93a8bfa7fbee2cba120f7377fea174f75a2cf6fe86dafd9d0
        • MD5 SHA1 SHA512 SSDEEP

        mus_battle1.ogg

        • Path C:\GOG Games\Undertale\mus_battle1.ogg
        • Size 642KB
        • SHA256 7101b56bf94fba741e8d36ccc51e10616808a1d6d898e970c56b824973c6d529
        • MD5 SHA1 SHA512 SSDEEP

        mus_battle2.ogg

        • Path C:\GOG Games\Undertale\mus_battle2.ogg
        • Size 706KB
        • SHA256 c75329c5308e0e2184eb106dc7a946d54bc51ad0ea2eb790c0bfad8f7f1dfa4d
        • MD5 SHA1 SHA512 SSDEEP

        mus_bergentruckung.ogg

        • Path C:\GOG Games\Undertale\mus_bergentruckung.ogg
        • Size 135KB
        • SHA256 61c0413b9179fbdfebcf8f2cdd122d8dd142887c35aad12f47dcfd7630dd5f78
        • MD5 SHA1 SHA512 SSDEEP

        mus_bgflameA.ogg

        • Path C:\GOG Games\Undertale\mus_bgflameA.ogg
        • Size 53KB
        • SHA256 0c9eee11f57a00368f7fa165ece1f97c345f03c28826d6dd55c49006c545177f
        • MD5 SHA1 SHA512 SSDEEP

        mus_birdnoise.ogg

        • Path C:\GOG Games\Undertale\mus_birdnoise.ogg
        • Size 331KB
        • SHA256 f68530da7bae270a3779be498d04145fcd4012cbccd0720501263f1be59b2f94
        • MD5 SHA1 SHA512 SSDEEP

        mus_birdsong.ogg

        • Path C:\GOG Games\Undertale\mus_birdsong.ogg
        • Size 251KB
        • SHA256 618c46734918c8211b58a636c0a4280ee961842b22c91135a9da0d6970613be6
        • MD5 SHA1 SHA512 SSDEEP

        mus_boss1.ogg

        • Path C:\GOG Games\Undertale\mus_boss1.ogg
        • Size 1.2MB
        • SHA256 ef21b8a3e3834771d073c70c384ea2a6e05cbbf1ff8314b73e84e53b620183bb
        • MD5 SHA1 SHA512 SSDEEP

        mus_cast_1.ogg

        • Path C:\GOG Games\Undertale\mus_cast_1.ogg
        • Size 411KB
        • SHA256 d7c39d948c7e20e72dfb43d25d1c4806390495dd8410ea2c8071ba3f32efeaa1
        • MD5 SHA1 SHA512 SSDEEP

        mus_cast_2.ogg

        • Path C:\GOG Games\Undertale\mus_cast_2.ogg
        • Size 213KB
        • SHA256 6b061c68869002370fcd2725977f01c2a68fa592d7fd0ad934f680600a1b6c1f
        • MD5 SHA1 SHA512 SSDEEP

        mus_cast_3.ogg

        • Path C:\GOG Games\Undertale\mus_cast_3.ogg
        • Size 409KB
        • SHA256 1f263161035bed24f70dd343587c447e545ff8890f3fd63587b0e49dba43debf
        • MD5 SHA1 SHA512 SSDEEP

        mus_cast_4.ogg

        • Path C:\GOG Games\Undertale\mus_cast_4.ogg
        • Size 530KB
        • SHA256 7ecfa22aa880f4232854095dd408d9211a396524a1c96a3fe0354ab040b2e216
        • MD5 SHA1 SHA512 SSDEEP

        mus_cast_5.ogg

        • Path C:\GOG Games\Undertale\mus_cast_5.ogg
        • Size 815KB
        • SHA256 e799798cde27f5887a0c650a07ca29b99cdf84fdc3864f4e3569f72219e35043
        • MD5 SHA1 SHA512 SSDEEP

        mus_cast_6.ogg

        • Path C:\GOG Games\Undertale\mus_cast_6.ogg
        • Size 208KB
        • SHA256 5c35750896f5eec85c502a00b935c7a96a6aa6b8655936ae99059fe2bbc6b9f9
        • MD5 SHA1 SHA512 SSDEEP

        mus_cast_7.ogg

        • Path C:\GOG Games\Undertale\mus_cast_7.ogg
        • Size 183KB
        • SHA256 0c5d9697e3d40f21f32b027026e8c117b242bd522ec0f08abf545b236f6c7bc6
        • MD5 SHA1 SHA512 SSDEEP

        mus_chokedup.ogg

        • Path C:\GOG Games\Undertale\mus_chokedup.ogg
        • Size 1.6MB
        • SHA256 b77e1fc84dc3b20e779f23c376a457eeb9ba78adf06365d20481a8cb97c7cba3
        • MD5 SHA1 SHA512 SSDEEP

        mus_churchbell.ogg

        • Path C:\GOG Games\Undertale\mus_churchbell.ogg
        • Size 77KB
        • SHA256 efeb11babe4a529587614df295b473896e03393fa73c897dde9b02120389d620
        • MD5 SHA1 SHA512 SSDEEP

        mus_computer.ogg

        • Path C:\GOG Games\Undertale\mus_computer.ogg
        • Size 17KB
        • SHA256 4c4062d9f91a6801715aeff168ae4a6568f5e280b729691e6962331c270978c9
        • MD5 SHA1 SHA512 SSDEEP

        mus_confession.ogg

        • Path C:\GOG Games\Undertale\mus_confession.ogg
        • Size 210KB
        • SHA256 a4ca01491ad3ebfdb466a1b129f59fa46dea1d02b8761ac81c016432d9d0f9a3
        • MD5 SHA1 SHA512 SSDEEP

        mus_coolbeat.ogg

        • Path C:\GOG Games\Undertale\mus_coolbeat.ogg
        • Size 23KB
        • SHA256 b2502de775ddd9cd544958795d6f5b4b771249cce9142424b48e732cdaa51699
        • MD5 SHA1 SHA512 SSDEEP

        mus_core.ogg

        • Path C:\GOG Games\Undertale\mus_core.ogg
        • Size 1.9MB
        • SHA256 bad6636afb54e3b2a387fd07127a9a1ad4ab6f78171627dfe318bbfb9bc56a25
        • MD5 SHA1 SHA512 SSDEEP

        mus_core_ambience.ogg

        • Path C:\GOG Games\Undertale\mus_core_ambience.ogg
        • Size 60KB
        • SHA256 94169292a9f99fe70992d4c0749bbc1889bdc7565dccdd83e3c73abd2c9485d5
        • MD5 SHA1 SHA512 SSDEEP

        mus_coretransition.ogg

        • Path C:\GOG Games\Undertale\mus_coretransition.ogg
        • Size 119KB
        • SHA256 0b5d6a8dfbf5ad68b0318808f3c8edd0da2213fbf67b359f3fbbcec854f3374c
        • MD5 SHA1 SHA512 SSDEEP

        mus_creepy_ambience.ogg

        • Path C:\GOG Games\Undertale\mus_creepy_ambience.ogg
        • Size 139KB
        • SHA256 105e5f99a30e1b1836b8d3980ae1be289e06e0122e91d1f7910181a7720e9d6e
        • MD5 SHA1 SHA512 SSDEEP

        mus_crickets.ogg

        • Path C:\GOG Games\Undertale\mus_crickets.ogg
        • Size 509KB
        • SHA256 42ffa30414831e2ba55984edf269cae7eca398773d84b93f554752bb91924af6
        • MD5 SHA1 SHA512 SSDEEP

        mus_cymbal.ogg

        • Path C:\GOG Games\Undertale\mus_cymbal.ogg
        • Size 53KB
        • SHA256 ad536a8aef8f7485ff1f9c76ea9aadc156b7d3702d82078165e38a39977d9d85
        • MD5 SHA1 SHA512 SSDEEP

        mus_dance_of_dog.ogg

        • Path C:\GOG Games\Undertale\mus_dance_of_dog.ogg
        • Size 113KB
        • SHA256 3dd733edfe675fd5ec84a0186d2784ff83ddd0ff69c1b96c975be5c0086893a7
        • MD5 SHA1 SHA512 SSDEEP

        mus_date.ogg

        • Path C:\GOG Games\Undertale\mus_date.ogg
        • Size 1.3MB
        • SHA256 a303ee85751ae94b16a1daa0ad258285b0da885142ee1820948bbe72b1b9969b
        • MD5 SHA1 SHA512 SSDEEP

        mus_date_fight.ogg

        • Path C:\GOG Games\Undertale\mus_date_fight.ogg
        • Size 380KB
        • SHA256 7ccba51e2205f014e550f472ef847575bd12b4fec677462a274a5e2af0468c1d
        • MD5 SHA1 SHA512 SSDEEP

        mus_date_tense.ogg

        • Path C:\GOG Games\Undertale\mus_date_tense.ogg
        • Size 287KB
        • SHA256 fef99e4757e91191d97335da62b7aa49bfe7a116ebf216f79a863e6ac9ee72c5
        • MD5 SHA1 SHA512 SSDEEP

        mus_deeploop2.ogg

        • Path C:\GOG Games\Undertale\mus_deeploop2.ogg
        • Size 70KB
        • SHA256 5c4df79571d6e20216cf57d9c823b54f210fe4efb1b13dd0f9dce7d64d6beaa5
        • MD5 SHA1 SHA512 SSDEEP

        mus_disturbing.ogg

        • Path C:\GOG Games\Undertale\mus_disturbing.ogg
        • Size 82KB
        • SHA256 86a66166b93962edb0455f63959eb53c297c1d52bec13e32877eb8bf6f6a4b34
        • MD5 SHA1 SHA512 SSDEEP

        mus_dogappear.ogg

        • Path C:\GOG Games\Undertale\mus_dogappear.ogg
        • Size 24KB
        • SHA256 9c0dc0331ee3164c43eb7ba25028d3923433f88cf27c72a464fb64ded95dd045
        • MD5 SHA1 SHA512 SSDEEP

        mus_dogmeander.ogg

        • Path C:\GOG Games\Undertale\mus_dogmeander.ogg
        • Size 85KB
        • SHA256 fdfd3d9e926427c5681c683c8523f34754fd5cc88da3308420f016cc9cbafc4a
        • MD5 SHA1 SHA512 SSDEEP

        mus_dogroom.ogg

        • Path C:\GOG Games\Undertale\mus_dogroom.ogg
        • Size 345KB
        • SHA256 56386401e7e2d75ae1ebc148483654bec8d89cd0f2364f2104b2a0b529af6516
        • MD5 SHA1 SHA512 SSDEEP

        mus_dogshrine_1.ogg

        • Path C:\GOG Games\Undertale\mus_dogshrine_1.ogg
        • Size 556KB
        • SHA256 75480e33442c016d961e0c9af33c07a9d7131288de41ee700b8da1e09c84d191
        • MD5 SHA1 SHA512 SSDEEP

        mus_dogshrine_2.ogg

        • Path C:\GOG Games\Undertale\mus_dogshrine_2.ogg
        • Size 175KB
        • SHA256 06afb33e9b3f2a89c8ccee969ce52c0010a9319c4e0310d26eca4ff01f2ab673
        • MD5 SHA1 SHA512 SSDEEP

        setup_undertale_1.08_(18328).tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-6N1P5.tmp\setup_undertale_1.08_(18328).tmp
        • Size 1.2MB
        • SHA256 a153c8db6f20f9c54f4bd1607b2502d3914662caa9615e1c557cf0abd8777bab
        • MD5 SHA1 SHA512 SSDEEP

        setup_undertale_1.08_(18328).tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-6N1P5.tmp\setup_undertale_1.08_(18328).tmp
        • Size 1.2MB
        • SHA256 a153c8db6f20f9c54f4bd1607b2502d3914662caa9615e1c557cf0abd8777bab
        • MD5 SHA1 SHA512 SSDEEP

        scriptinterpreter.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-JV63B.tmp\scriptinterpreter.tmp
        • Size 1.3MB
        • SHA256 5a1fa7eedda77ab1b422ec7bfa6ff22dd10449da5f3ad557c147302913cffd16
        • MD5 SHA1 SHA512 SSDEEP

        goggame-1456487183.info

        • Path \??\c:\gog games\undertale\goggame-1456487183.info
        • Size 840B
        • SHA256 adb26c3daa0b8511e8219b7ee950c8cdc527795f7e3b2a6a42355f27fcdc1b29
        • MD5 SHA1 SHA512

        scriptinterpreter.exe

        • Path \GOG Games\Undertale\__support\scriptinterpreter.exe
        • Size 1.1MB
        • SHA256 6dd87cb725336bcce9c75eed40fe544cd5cab32a2ea3ed09c6fa901a47db2f53
        • MD5 SHA1 SHA512 SSDEEP

        botva2.dll

        • Path \Users\Admin\AppData\Local\Temp\is-25CC8.tmp\botva2.dll
        • Size 35KB
        • SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
        • MD5 SHA1 SHA512 SSDEEP

        crcdll.dll

        • Path \Users\Admin\AppData\Local\Temp\is-25CC8.tmp\crcdll.dll
        • Size 69KB
        • SHA256 23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
        • MD5 SHA1 SHA512 SSDEEP

        innocallback.dll

        • Path \Users\Admin\AppData\Local\Temp\is-25CC8.tmp\innocallback.dll
        • Size 63KB
        • SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
        • MD5 SHA1 SHA512 SSDEEP

        setup_undertale_1.08_(18328).tmp

        • Path \Users\Admin\AppData\Local\Temp\is-6N1P5.tmp\setup_undertale_1.08_(18328).tmp
        • Size 1.2MB
        • SHA256 a153c8db6f20f9c54f4bd1607b2502d3914662caa9615e1c557cf0abd8777bab
        • MD5 SHA1 SHA512 SSDEEP

        scriptinterpreter.tmp

        • Path \Users\Admin\AppData\Local\Temp\is-JV63B.tmp\scriptinterpreter.tmp
        • Size 1.3MB
        • SHA256 5a1fa7eedda77ab1b422ec7bfa6ff22dd10449da5f3ad557c147302913cffd16
        • MD5 SHA1 SHA512 SSDEEP

        uninstall.dll

        • Path \Users\Admin\AppData\Local\Temp\is-NJ34L.tmp\uninstall.dll
        • Size 698KB
        • SHA256 5091cd5eef67f8f4cf9ae53b52160d6bedf7245c580d8a231595ba39e55ffdb1
        • MD5 SHA1 SHA512 SSDEEP

        memory/344-63-0x0000000002090000-0x00000000020A5000-memory.dmp

        memory/344-68-0x00000000747D1000-0x00000000747D3000-memory.dmp

        memory/744-61-0x0000000000400000-0x0000000000437000-memory.dmp

        memory/744-55-0x0000000000400000-0x0000000000437000-memory.dmp

        memory/744-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

        memory/744-144-0x0000000000400000-0x0000000000437000-memory.dmp

        memory/1164-74-0x0000000000E00000-0x0000000000E39000-memory.dmp

        memory/1164-141-0x0000000000E00000-0x0000000000E39000-memory.dmp

        memory/1164-83-0x0000000000E00000-0x0000000000E39000-memory.dmp