Analysis

  • user interaction
    yes
  • max time kernel
    449s
  • max time network
    466s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    23/05/2026, 14:30

General

  • Target
    setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).exe
  • Size 329.8MB
  • Sample260523-rt43fadv4t
  • SHA256 ca9ae3f2217df21aa20900e05583b5f2e08066a79ff4d708113b0baf13cc0379
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).exe
    "C:\Users\Admin\AppData\Local\Temp\setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Users\Admin\AppData\Local\Temp\is-VTNN6.tmp\setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VTNN6.tmp\setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).tmp" /SL5="$4021C,345220414,192512,C:\Users\Admin\AppData\Local\Temp\setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\GOG Games\The Executive - Movie Industry Tycoon\__redist\ISI\scriptInterpreter.exe
        "C:\GOG Games\The Executive - Movie Industry Tycoon\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\The Executive - Movie Industry Tycoon\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\The Executive - Movie Industry Tycoon" /productId="1507926878" /buildId="58723233948921050" /versionName="1.3.1" /Language="English" /LANG="english"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Users\Admin\AppData\Local\Temp\is-13F2B.tmp\scriptInterpreter.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-13F2B.tmp\scriptInterpreter.tmp" /SL5="$902E8,662929,192512,C:\GOG Games\The Executive - Movie Industry Tycoon\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\The Executive - Movie Industry Tycoon\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\The Executive - Movie Industry Tycoon" /productId="1507926878" /buildId="58723233948921050" /versionName="1.3.1" /Language="English" /LANG="english"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          PID:2236
      • C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive.exe
        "C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2224
        • C:\GOG Games\The Executive - Movie Industry Tycoon\UnityCrashHandler64.exe
          "C:\GOG Games\The Executive - Movie Industry Tycoon\UnityCrashHandler64.exe" --attach 2224 2124709761024
          4⤵
          • Executes dropped EXE
          PID:4436
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3f0 0x304
    1⤵
      PID:4664

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          mono-2.0-bdwgc.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll
          • Size 7.5MB
          • SHA256 847aa54f6bfee4ab2f21de41a656bbc8112cc13689844566f1c0ab1bef5f81e8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          config

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\MonoBleedingEdge\etc\mono\config
          • Size 3KB
          • SHA256 5776169973a26a387b8b3e5c0f2301a7ab9a6dd7c7d3efa22a96abc47fbf8662
          • MD5 SHA1 SHA512 TLSH

          The Executive.exe

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive.exe
          • Size 656KB
          • SHA256 98363944ba5ea4b840d3908cac77b93490077103e49c0216857d7a648a0d19ec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.AIModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.AIModule.dll
          • Size 69KB
          • SHA256 46162fd94327216579db0d831be943ac19798d087686456e973120e2085ad5c6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.AMDModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.AMDModule.dll
          • Size 19KB
          • SHA256 374c1c748ede4bbfdf535723a5336d0be16e8deb53b5c02b0fb083fb137d916b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.ARModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.ARModule.dll
          • Size 19KB
          • SHA256 35302b3fa373685da519ddca2e3a0b8a40cc7ba2d38625bcaae8c9c1cf70c7b8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.AccessibilityModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.AccessibilityModule.dll
          • Size 50KB
          • SHA256 4d2bcacba9d671f2b3e00485dbd3e2d833fb6036ee1cebf3788d8f0658261ca5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.AndroidJNIModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.AndroidJNIModule.dll
          • Size 111KB
          • SHA256 f131be98231d9e6b6f0d9ed95441863827bf0947530baf9657dbcca538558734
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.AnimationModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.AnimationModule.dll
          • Size 206KB
          • SHA256 2895cae13be83c758bd6eff66615e3cef90751693f34e2a59fc36e943a2a1d28
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.AssetBundleModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.AssetBundleModule.dll
          • Size 36KB
          • SHA256 ce5bdacd277b14d1805abe35d714bb9afb77b2115a1e2ef1495448ca780f475e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.AudioModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.AudioModule.dll
          • Size 98KB
          • SHA256 7965e684b5255b4520a91e10dac48e6930e538713879a6f72899fe94efb1d810
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.ClothModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.ClothModule.dll
          • Size 30KB
          • SHA256 8561cee6256ad237414564e9b952edb29f7a26e70349e725645c2ca980977f51
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.ClusterInputModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.ClusterInputModule.dll
          • Size 22KB
          • SHA256 8d23ae3b68ae646454395b19480ef040ba1434082e04a00c303cfb0047f67cd8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.ClusterRendererModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.ClusterRendererModule.dll
          • Size 20KB
          • SHA256 f0cdb532f76b45e137deabf87b85681d5fec0b1967c893ba375e1c9b53f5b8c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.ContentLoadModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.ContentLoadModule.dll
          • Size 26KB
          • SHA256 6af46bdedb70e3d2e7b3b1a42fd1fbfccea8f8a7afec3c956aee5a419cc52c5a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.CoreModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.CoreModule.dll
          • Size 1.7MB
          • SHA256 2066c6ec07c873edbd66279555ccb1c81535ec7ae2b93f9d312671f0c9ed029a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.CrashReportingModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.CrashReportingModule.dll
          • Size 20KB
          • SHA256 0b34d809207a8d942bc6cc81aaf34fdcd6342b5444b5ccb6878221101cd72941
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.DSPGraphModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.DSPGraphModule.dll
          • Size 27KB
          • SHA256 4edf3865cf01f55173e7b5fa9d02b52f8c9a96b5643d036a3fb15339fcdcb85b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.DirectorModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.DirectorModule.dll
          • Size 35KB
          • SHA256 f45e97d0497aa9ea1d66ab17743aa2a7504959767e1ac13cfd4db9d386edc923
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.GIModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.GIModule.dll
          • Size 18KB
          • SHA256 33eea2a53f3d73338317c5dae3a6e5e20e9592ebafdbe4736c03d04ca08c0f2a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.GameCenterModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.GameCenterModule.dll
          • Size 39KB
          • SHA256 a2b042bb9e3c294152d2ac789a9b8fca7a4aceb4225b3fb2039908e95b5e414b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.GraphicsStateCollectionSerializerModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.GraphicsStateCollectionSerializerModule.dll
          • Size 12KB
          • SHA256 4fe0c57d57597bf15eb944dd41570faaf0407d2aacd0142389c377ccd12dfa30
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.GridModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.GridModule.dll
          • Size 24KB
          • SHA256 d41dd6fc9049bae8dd05d27b153247379192007db7e5de3a83784126cad07c7e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.HierarchyCoreModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.HierarchyCoreModule.dll
          • Size 87KB
          • SHA256 722dd1cf32b584f69923262a4eb18627fb3a781b674808a7c1ba29bd43689b16
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.HotReloadModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.HotReloadModule.dll
          • Size 18KB
          • SHA256 de42f94df1e595b6710407c40b5020b13af2b141789bcaac2e816729325cfdba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.IMGUIModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.IMGUIModule.dll
          • Size 199KB
          • SHA256 91719fc5902c14771097a05c57440ce2460006e56f5fe64ad8f5b4b33f428240
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.ImageConversionModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.ImageConversionModule.dll
          • Size 25KB
          • SHA256 43a5fe5e931bfe009693986f32cd8ed771e0f1d467753e79afd7db7b587e9ff9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.InputForUIModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.InputForUIModule.dll
          • Size 54KB
          • SHA256 4f41bd66f85f3f149b67331027ee50306b1ab10ee90f0acec23262d618ad9d96
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.InputLegacyModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.InputLegacyModule.dll
          • Size 39KB
          • SHA256 01ad78e7064dfd9726869ba0b632facb88e8f96b5d4f7229c3a7ecd140ff1c2f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.InputModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.InputModule.dll
          • Size 22KB
          • SHA256 5a4392a903f7dede5a031d2f663cc380eed6415af7651bca714090be8c0bbf0b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.JSONSerializeModule.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.JSONSerializeModule.dll
          • Size 21KB
          • SHA256 f93ef173223879c49f9eaeb4844762ffb750e5b08825df1f5deedb0fe19d3273
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityEngine.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\UnityEngine.dll
          • Size 164KB
          • SHA256 c951cbde0d29802c0a60b06b0769cf886ef963ae21330c2e4a292c27fdb303c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mscorlib.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Managed\mscorlib.dll
          • Size 4.4MB
          • SHA256 aa9b71c0e3e17ef30a492374bd457fdec90ea85c55fa267f7dcae6261de52694
          • MD5 SHA1 SHA512 SSDEEP TLSH

          unity default resources

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\Resources\unity default resources
          • Size 6.9MB
          • SHA256 b1bb9e4cbad247eb231c714a8ca5fc79eccaec3c155c711d9b0761463b46136f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          RuntimeInitializeOnLoads.json

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\RuntimeInitializeOnLoads.json
          • Size 7KB
          • SHA256 b17a006f2fe263e96c515f38781117b591720c91d57f321204c6dfd6ee7b1abf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ScriptingAssemblies.json

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\ScriptingAssemblies.json
          • Size 5KB
          • SHA256 9b56cf35b914bc62f3dcd603cb61d5897dd530930aa9e0d747ba7f3cb49a3360
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app.info

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\app.info
          • Size 24B
          • SHA256 fdf0ee0551301d5f807a573f0b58fce02677713e781cc4cb47dad1cac4545226
          • MD5 SHA1 SHA512

          boot.config

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\boot.config
          • Size 136B
          • SHA256 a17722fd09b4cb73cb7412bd581c579419fcf7a2fe75dc0a2ffe910432e92285
          • MD5 SHA1 SHA512 TLSH

          globalgamemanagers

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\The Executive_Data\globalgamemanagers
          • Size 236KB
          • SHA256 fa5bcbc198ece373a9283d24cf25ec801303bc3666206fef29efdfa7ae3e3f8d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityCrashHandler64.exe

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\UnityCrashHandler64.exe
          • Size 1.5MB
          • SHA256 d93ba7531192baf2edd2b9916e45f22973cd5da4a586db032f974ab32da23bb2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UnityPlayer.dll

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\UnityPlayer.dll
          • Size 31.8MB
          • SHA256 19691a1e8057a9b37aadb9976ffb5421e5d8afbe35f42fb2972be38818f70a0c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          scriptinterpreter.exe

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\__redist\ISI\scriptinterpreter.exe
          • Size 1.2MB
          • SHA256 d8667e94d5a9fe2d81e04df7e38f792bcf37aa727c24787014a51bd77fb19c65
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goggame-1507926878.info

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\goggame-1507926878.info
          • Size 569B
          • SHA256 bd6d2579ead42dbfbc03f7763682101400892d7a13dcb42df20ba7a82c72b599
          • MD5 SHA1 SHA512 TLSH

          unins000.dat

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\unins000.dat
          • Size 770KB
          • SHA256 005343c1ee1f9661b41a61d6458040165f9dba86b9de1caf86f3efbcdbce3a3f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          unins000.exe

          • Path C:\GOG Games\The Executive - Movie Industry Tycoon\unins000.exe
          • Size 1.3MB
          • SHA256 29cfb566108bc1ba721289b107b6ab9bd3c995e49b7c3bec5a8744d9ade2344a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          scriptInterpreter.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-13F2B.tmp\scriptInterpreter.tmp
          • Size 1.3MB
          • SHA256 5761e7789d813626cd68ee1e62429cfeb92bdd814cd29ef12fc4ae9ec1dbaff3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          idp.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-44NMG.tmp\idp.dll
          • Size 232KB
          • SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uninstall.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-44NMG.tmp\uninstall.dll
          • Size 712KB
          • SHA256 d88bcf910e7a5ce4d76ca48b263ef226911b455d3a8db80c9fa69aeb2b3898a1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          0d560df83e11fce5f65f19d18cb067f2

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\0d\56\0d560df83e11fce5f65f19d18cb067f2
          • Size 13KB
          • SHA256 6ac44309e61ee8da8f18f2738e493eb589420a15f093f90217b977150a3f2f4d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1207666283_english.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\1207666283_english.jpg
          • Size 140KB
          • SHA256 24b79cf1109c62c2adcd9e2ee71d58114557cb8205ae03990613177f7c5402f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1424868751_english.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\1424868751_english.jpg
          • Size 161KB
          • SHA256 28580291e996811af2f88df466ade9de8ec3aee74dd43397465722270e45edec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1434036647_english.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\1434036647_english.jpg
          • Size 171KB
          • SHA256 9a069d93a890806b49825c49f9e1ff1d2862e2fb56f407dd42c16c895d912d42
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1459856152_english.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\1459856152_english.jpg
          • Size 167KB
          • SHA256 7c2e73e910c28ec0f7fd24751f1353ca86d0bafc880c943e78009303fa3b7910
          • MD5 SHA1 SHA512 SSDEEP TLSH

          1797331296_english.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\1797331296_english.jpg
          • Size 226KB
          • SHA256 1e505f0f564952d3f14ef8ed9e59018457c5839ff30d3e16e2ec882f0dbb89bb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          is-BAALB.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\51\13\is-BAALB.tmp
          • Size 9KB
          • SHA256 13e384c6b312a144aa9aa36f0f6df0b75fdf61d9777293ac8362434c2e906159
          • MD5 SHA1 SHA512 SSDEEP TLSH

          6ced63e67b34498032395f42881cac19

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\6c\ed\6ced63e67b34498032395f42881cac19
          • Size 14KB
          • SHA256 daf81fafcc73ec5650d63574900d2110e35de1262d4b1abfff6b6449882bd472
          • MD5 SHA1 SHA512 SSDEEP TLSH

          7c0501cbce2d646223468f9c56558db5

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\7c\05\7c0501cbce2d646223468f9c56558db5
          • Size 9KB
          • SHA256 504b356fdfb265990eb7884f4b33a1e0a4f5d9c09b0bd04a5dff25dcd45cf992
          • MD5 SHA1 SHA512 SSDEEP TLSH

          BigOK.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\BigOK.png
          • Size 3KB
          • SHA256 59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a
          • MD5 SHA1 SHA512 TLSH

          EULAAccepted.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\EULAAccepted.png
          • Size 2KB
          • SHA256 0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c
          • MD5 SHA1 SHA512 TLSH

          EULAShow.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\EULAShow.png
          • Size 1KB
          • SHA256 6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462
          • MD5 SHA1 SHA512 TLSH

          GOG_new.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\GOG_new.png
          • Size 3KB
          • SHA256 0804b385c1736e009fe8c3b1b14085b9b9abb40ce487360002ab4a8f3505f4e0
          • MD5 SHA1 SHA512 TLSH

          b3521f06cc7d2a61cfc4a295e4a9d3f0

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\b3\52\b3521f06cc7d2a61cfc4a295e4a9d3f0
          • Size 8KB
          • SHA256 12e9c7012f2b9e563126d288c69aa4a3112428f52d6f602dcbd7ecfbbfde5443
          • MD5 SHA1 SHA512 SSDEEP TLSH

          background.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\background.jpg
          • Size 328KB
          • SHA256 8e6fe85811805965c658bfe80dad7fc112966d93bea1a810a8b9802e6dc6d41a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          botva2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\botva2.dll
          • Size 35KB
          • SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
          • MD5 SHA1 SHA512 SSDEEP TLSH

          btn_md5.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\btn_md5.png
          • Size 8KB
          • SHA256 b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47
          • MD5 SHA1 SHA512 SSDEEP TLSH

          crcdll.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\crcdll.dll
          • Size 69KB
          • SHA256 23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          e805e8772a9c54efef53988263d8586a

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\e8\05\e805e8772a9c54efef53988263d8586a
          • Size 17KB
          • SHA256 8b954044fb280e73124773247b4ea924016502af69cbe8dc22ad60749827f6b2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ee3771c4fb4b14d93bd48920fcf96874

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\ee\37\ee3771c4fb4b14d93bd48920fcf96874
          • Size 2KB
          • SHA256 50cf3ed49b0a6c90d163be49c018c45cc8e6292fa0de3146a6ea6963d6f23929
          • MD5 SHA1 SHA512 TLSH

          error.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\error.png
          • Size 726B
          • SHA256 142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b
          • MD5 SHA1 SHA512 TLSH

          error_icon.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\error_icon.png
          • Size 1KB
          • SHA256 acdf96ee4261fae138e6350a0ad50b367022ed5b908fa168baad92644f566ee8
          • MD5 SHA1 SHA512 TLSH

          f0e1ae5b5dce6c23cb3c8c4abe74d58e

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\f0\e1\f0e1ae5b5dce6c23cb3c8c4abe74d58e
          • Size 578B
          • SHA256 5c393351289444b94413272283300a3aa6cd8b266f927309abcdc1b488ff5c93
          • MD5 SHA1 SHA512 TLSH

          f391a7199682cf8ef3179753c8e21699

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\f3\91\f391a7199682cf8ef3179753c8e21699
          • Size 655B
          • SHA256 d438ae32fef59b6cceca49c625c8dd18343e73615a0c931e584ebd5ee10b8732
          • MD5 SHA1 SHA512 TLSH

          f46de36302a5f4734bc8e221eee7b361

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\f4\6d\f46de36302a5f4734bc8e221eee7b361
          • Size 1.2MB
          • SHA256 fe6c8ed6e507c561012d1ea33fea271116e22642545b543ba1017bfa2acb64f3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          innocallback.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\innocallback.dll
          • Size 63KB
          • SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ok.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\ok.png
          • Size 1KB
          • SHA256 0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e
          • MD5 SHA1 SHA512 TLSH

          progress_center.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\progress_center.png
          • Size 1KB
          • SHA256 2b9dae87340e66b67ab1d8247d4a137628e324969f92fe1098f95a7c5bab2f43
          • MD5 SHA1 SHA512 TLSH

          progress_left.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\progress_left.png
          • Size 1KB
          • SHA256 85e39d909a7300fa2043ec42818582867b981401264b14fc5408e477ae0b4668
          • MD5 SHA1 SHA512 TLSH

          progress_right.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\progress_right.png
          • Size 1KB
          • SHA256 396a3351fe409328782ab138282cf9cec061a5a9540a3506700a620db1f54e7d
          • MD5 SHA1 SHA512 TLSH

          slideshow.ini

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\slideshow.ini
          • Size 684B
          • SHA256 4072793e43d92932a246a00fddc94386564969078643f38ca4033655aa608277
          • MD5 SHA1 SHA512 TLSH

          track_center.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\track_center.png
          • Size 1KB
          • SHA256 794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860
          • MD5 SHA1 SHA512 TLSH

          track_left.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\track_left.png
          • Size 1KB
          • SHA256 a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8
          • MD5 SHA1 SHA512 TLSH

          track_right.png

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\track_right.png
          • Size 1KB
          • SHA256 f54cd6e42f2b2bc5cb8a15f6a28f1499abf094a519ebdf39f4c4e167312c9c16
          • MD5 SHA1 SHA512 TLSH

          uninstall.dll

          • Path C:\Users\Admin\AppData\Local\Temp\is-L45HE.tmp\uninstall.dll
          • Size 691KB
          • SHA256 cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).tmp

          • Path C:\Users\Admin\AppData\Local\Temp\is-VTNN6.tmp\setup_the_executive_-_movie_industry_tycoon_1.3.1_(82910).tmp
          • Size 1.3MB
          • SHA256 abf8d4d522ca94a179d644ec0464474b580ec82441b118b663da3bd879f91d85
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/1828-3003-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-1466-0x0000000003760000-0x0000000003817000-memory.dmp

          memory/1828-3318-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3062-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3021-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3061-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2941-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2940-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3333-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3334-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2936-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2785-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2550-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-5-0x0000000002590000-0x0000000002591000-memory.dmp

          memory/1828-3128-0x0000000006EE0000-0x0000000006EEE000-memory.dmp

          memory/1828-3363-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3368-0x0000000006EE0000-0x0000000006EEE000-memory.dmp

          memory/1828-3366-0x0000000003740000-0x0000000003755000-memory.dmp

          memory/1828-3365-0x00000000000F0000-0x0000000000242000-memory.dmp

          memory/1828-3367-0x0000000003760000-0x0000000003817000-memory.dmp

          memory/1828-3369-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3370-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3371-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2551-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3024-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2300-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2297-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3302-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3249-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-2021-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-1731-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-1730-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-1464-0x00000000000F0000-0x0000000000242000-memory.dmp

          memory/1828-3406-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-1465-0x0000000003740000-0x0000000003755000-memory.dmp

          memory/1828-3319-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3410-0x00000000000F0000-0x0000000000242000-memory.dmp

          memory/1828-1467-0x0000000006EE0000-0x0000000006EEE000-memory.dmp

          memory/1828-3408-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-1468-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-11-0x0000000003740000-0x0000000003755000-memory.dmp

          memory/1828-3441-0x00000000000F0000-0x0000000000242000-memory.dmp

          memory/1828-1158-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-835-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-501-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3132-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-345-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3203-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3202-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3157-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3146-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3145-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-3125-0x00000000000F0000-0x0000000000242000-memory.dmp

          memory/1828-172-0x0000000003740000-0x0000000003755000-memory.dmp

          memory/1828-173-0x0000000003760000-0x0000000003817000-memory.dmp

          memory/1828-174-0x0000000006EE0000-0x0000000006EEE000-memory.dmp

          memory/1828-171-0x00000000000F0000-0x0000000000242000-memory.dmp

          memory/1828-17-0x0000000003760000-0x0000000003817000-memory.dmp

          memory/1828-169-0x0000000002590000-0x0000000002591000-memory.dmp

          memory/1828-168-0x0000000003820000-0x0000000003821000-memory.dmp

          memory/1828-3126-0x0000000003740000-0x0000000003755000-memory.dmp

          memory/1828-3127-0x0000000003760000-0x0000000003817000-memory.dmp

          memory/1828-3131-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

          memory/1828-62-0x0000000006EE0000-0x0000000006EEE000-memory.dmp

          memory/2236-3356-0x0000000000A40000-0x0000000000B92000-memory.dmp

          memory/2556-170-0x0000000000ED0000-0x0000000000F09000-memory.dmp

          memory/2556-0-0x0000000000ED0000-0x0000000000F09000-memory.dmp

          memory/2556-3442-0x0000000000ED0000-0x0000000000F09000-memory.dmp

          memory/2724-3357-0x0000000000B80000-0x0000000000BB9000-memory.dmp

          memory/2724-3315-0x0000000000B80000-0x0000000000BB9000-memory.dmp