37994775f0212a1c6d4ffae7d60b4312ab6628ed4f57fa828428ba58a159fd95

Analysis

user interaction
yes
max time kernel
48s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gmaker.exe
Size 3.4MB
Sample260802-ama3cazhnd
SHA256 37994775f0212a1c6d4ffae7d60b4312ab6628ed4f57fa828428ba58a159fd95
MD5 e5ff58dd32e673e5876ec0cbc3e14638
SHA1 2314d5dbc62ae7304fc6f70d594d3194bb27d835
SHA512 10f05bea9c7b01d7f02c2eb6b52f3ecc1d0e72a0589358923aaca89879cb70bac8ffa4d436dc34893256986e2b0f5df723eaa682301bec6714b79b088b24e4fb
SSDEEP 98304:hFKFz2SYK8nFtL3uQyb0rWEWQeSo/iW/CwnPnvfj:bKpDkL3Hy9QeSo/iW6w/j
TLSH
T14FF5331BD7C02E36E41314B48E1F9FDE65A7F964EA70C68C592C59AC0A6C7AB243C4D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3812	GPInstall.exe
1976	Game_Maker.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\pacman\scared.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\GM_License.txt	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\lib\02_main1.lib	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\lib\01a_move2.lib	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\maze\wall.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\pacman\monster1.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\various\Fire.ico	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bullet.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\maze\hole.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\maze\rock.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\various\Dot.ico	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Game_Maker.chm	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\ball1.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bonus09.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Examples\street race.gmd	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\stone05.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\stone06.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\lib\01_move.lib	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sounds\beep5.wav	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bonus12.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\stone07.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Examples\1945.gmd	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\lib\05_draw.lib	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bonus06.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\various\Dot.ico	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sounds\beep4.wav	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sounds\boink1.wav	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bomb01.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bomb02.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bomb04.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\monster1.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\maze\atoms.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\various\Explode1.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Game_Maker.exe	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bonus12.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\stone09.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\maze\mine.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\maze\mine.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\various\Fire.ico	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\fnames	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\lib\01_move.lib	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sounds\beep6.wav	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\maze\ghost.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\various\Explode1.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Examples\pacman.gmd	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\stone01.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\maze\ball_green.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\maze\rock.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\rundata	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Backgrounds\stars.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bonus06.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\maze\ball_blue.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\various\Stop.ico	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sounds\gunshot2.wav	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sounds\zap.wav	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\stone03.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\maze\shovel.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\pacman\monster4.gif	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\various\Ghost2.ico	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\various\Stop.ico	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sounds\explosion.wav	GPInstall.exe
File opened for modification	C:\Program Files (x86)\Game_Maker5\Sprites\pacman\pacman_stand.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\breakout\bonus05.gif	GPInstall.exe
File created	C:\Program Files (x86)\Game_Maker5\Sprites\pacman\pacman_left.gif	GPInstall.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\GPInstall.exe	gmaker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gmaker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game_Maker.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gmd\ = "gmdfile"	GPInstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmdfile	GPInstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gmdfile\ = "Game Maker File"	GPInstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmdfile\Shell\open\command	GPInstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmdfile\Shell	GPInstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmdfile\Shell\open	GPInstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gmdfile\Shell\open\command\ = "\"C:\\Program Files (x86)\\Game_Maker5\\Game_Maker.exe\" %1"	GPInstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gmd	GPInstall.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	Game_Maker.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3812	4532	gmaker.exe	90
PID 3812 wrote to memory of 1976	3812	GPInstall.exe	92

C:\Users\Admin\AppData\Local\Temp\gmaker.exe
"C:\Users\Admin\AppData\Local\Temp\gmaker.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\GPInstall.exe
  "C:\Windows\GPInstall.exe" "/SOURCE=C:\Users\Admin\AppData\Local\Temp\gmaker.exe" "/DATA=C:\Users\Admin\AppData\Local\Temp\GPI5B07.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files (x86)\Game_Maker5\Game_Maker.exe
    "C:\Program Files (x86)\Game_Maker5\Game_Maker.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GM_Changes.txt

Path C:\Program Files (x86)\Game_Maker5\GM_Changes.txt
Size 5KB
SHA256 5d1e4dcfda7252820bff2d4ae214acca673d14458239a17362b57381d6fd1895
MD5 d463736ed4f3774181c61c646021ff9f
SHA1 0299ac9e97afc5188b708ace988481ddc7c81813
SHA512 967af0b90a92258858120ab39f86e1221a558b97b1c4d75329858d2dcc0e7f0103d93bc802b8840dbaf2a4f3f6594a42bab6b33d69dc945089c0cf375867f99d
SSDEEP 96:QuqQ5i2dsYe5iFyhdTsQLL4Gk1BB1KaPX/FCkVM1uizyRWXi3Yz316WmSDg:UQB5eLDTsQ4NMaf9XM1uHwOk31LXE
TLSH
T10CB1310B7F40937B4173D651515F9280EB31A039B2046341389DC29C5B325EAC7BF9EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GM_License.txt

Path C:\Program Files (x86)\Game_Maker5\GM_License.txt
Size 3KB
SHA256 91592b8265e54c48fa87b32d10f78cbb479e3d3a5f4a9712a1afe5949ac23a0d
MD5 2da23a6ad4def55944db4bf17d65f110
SHA1 41febad68291da492035b0814954be5b728e0ad8
SHA512 595506ad25eb90c7525395f4cfddae25aa21d7c4405fa21965cfe61dc6b037eab7521e5bdce1fa5489c43d3a0773c402fb3fe3f81d83cc902005a17894b4b061
TLSH
T12781E7BEF2130BA0165D07267A526882E344C065B95FE7D03879B25C1731F2642F79FE
MD5 SHA1 SHA512 TLSH

Submit Download

GM_Readme.txt

Path C:\Program Files (x86)\Game_Maker5\GM_Readme.txt
Size 3KB
SHA256 eb05103ea4579529d75583c04c2b41f75c89e9b5a760f677b73b3c811bf5786a
MD5 be7f4558086ab5db75bd56603b2cf982
SHA1 48eb76cea00d7604c32a8d4af3c043fa7c99aed2
SHA512 0267860b1001ecd955fe5911bb89e661ebaf97c26d5bd5b0fb511ad63dc5eed199862b4683270fa7b3c7a8319cd59a14f95d3f502c09ce4a83c5d5dae2974c0e
TLSH
T1266174CFBD49C3BB2593C315124A6581F73D8215A21943083CAFC1992756A1B03BFFAC
MD5 SHA1 SHA512 TLSH

Submit Download

Game_Maker.chm

Path C:\Program Files (x86)\Game_Maker5\Game_Maker.chm
Size 750KB
SHA256 073053a5107cbcf2dcd285fa4ce027c2509c094859b6bbe94561b6def7df5c17
MD5 f235c4b5c6b8bbed198442e478e01c2a
SHA1 9907f78ff147fdb1c7d27a62275e27331b055e6d
SHA512 db0a9d8c9f8e6b9b585e0ff80fc78242a2d51b648de25be5fdec2f8c2805774cd802f84f0f396ca741025fe6562b515c0fa508252c58ec70963edcdbcf1a54d4
SSDEEP 12288:5nFtcfQXD1K6WypU/H/5fzT0Mt8T/b3zqsOlH4AakOL8Fjq2u6tC44ltlvVcaDXC:5nFz5K6WScjt8TbOWAav8Fjqv6t5u1Vi
TLSH
T18CF42394D2729793C39DFD36B11FECEB9F60278A559EE6E42FAA4610F4B200D043A075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Game_Maker.exe

Path C:\Program Files (x86)\Game_Maker5\Game_Maker.exe
Size 2.1MB
SHA256 9cb16395d6f82c324541eebdba182d87f8e2779c361c1f57bd8e94d5a7f2ca66
MD5 bbdbcb4b82984b7d28334aabe4b12042
SHA1 2144b4b088be8c5c8755a0c5d60f3d12c33692cd
SHA512 23030034286e0c4d5909ffb06297391792fde40f8e951f7124720c40ef39c40c9f01fea0f4a4ccf68088cc3a930f67a394e27efe6eaea4ea344e10c2041d2ba4
SSDEEP 24576:d+xfkEeR1EhesWDAbCzY86bCnGx020/8m5H6P4LKxT7bWNTGQkDC/eWRrp3EIY6L:d91NG020/DwFdOpGqb+/47
TLSH
T1CDA57C22B2418437C0770638DD4B97FC5935BE20FE249A8B36F47E4CBE7968076252A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fnames

Path C:\Program Files (x86)\Game_Maker5\fnames
Size 27KB
SHA256 810d3a34696d98716080db7a89b5e7056296fb3e0bc8e17e60a74fafc672b25e
MD5 d8bf4a599834611d51c88d964e9d944e
SHA1 d8f5725f377f3b61a7dcf4c2474d2f0254044caa
SHA512 43d36f0ffebea7f8df3660c517fe2d8265453d1617b9880f858c87e22cd20000fbb38bc1f510ce33bfaf5372156d96a16e671f295e9925bc2b32d6b5370c7627
SSDEEP 384:E6XA1C4VnkdKAiA0WTiAx95l7OxPUQOSXgnko1Brpe1x0G+i8ttB:E6XWMiAeRHd0Br81ey8ttB
TLSH
T1A5C2A7341ED9908EB4B36D183FB49D4850750396A6312E17AFFCC0F44B12AE61F6FA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01_move.lib

Path C:\Program Files (x86)\Game_Maker5\lib\01_move.lib
Size 95KB
SHA256 001d8a82f686d529b54bc7351b9734de335f437767b4e36401e75b639cf62d58
MD5 cc75ff52c4c92594b963d09803e61ddd
SHA1 84538dc3d6982a4cabe31fce39c96a8c967ca124
SHA512 bbe9e877b101de1d4f18c017746eddbfdce8ca229d6967e61bdba48546aef50dbe412d4c6ad07f908c42f0cd05e20a1c8bd564ad54ebc3a1e3553d55db952e84
SSDEEP 384:uSQiXgH3v4IfXI34gYHwoXfoYQnXw26nXfIYQogYvXI4vHgH3QiXgUKN1Xv5/Zb2:gNPy
TLSH
T1CA93C915FD3D8870D56013383B6B8E7188D46C2AFA82351271F9AF7EFE65BC16819236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01a_move2.lib

Path C:\Program Files (x86)\Game_Maker5\lib\01a_move2.lib
Size 45KB
SHA256 50cf4f53276321df8d054df9243f30ea8a77575f6ff44ea004e873ea7ca6fd24
MD5 2ca8fac12a2448bc41d674cc1d57c2d4
SHA1 bcd46bd09f8b34369fdaf27e87db8e4444d42950
SHA512 b768f371a36c74907c781767e2cd377e628f1b1912744485e5c6ba94ce258c56406d1b382b0e29b6906c29adfc73911cf406af0a74082d35a9497d228642406c
SSDEEP 192:nSKwfffffffffffffffffEfffffffffffffffffEfffffffffffffffffEfvfffc:SJKd2L2Vjigmf
TLSH
T13A237755FD6D8574C61123383F2BCE7158D82C2AF98124026AF8AE7EFE71FC16A19235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02_main1.lib

Path C:\Program Files (x86)\Game_Maker5\lib\02_main1.lib
Size 91KB
SHA256 d291c54d417e6c44d2499ba20305d5cd65abaff4ad663e1ff88f0fbcef33c7e1
MD5 e063d0d1e6f4e52652ed34f8f1fb2176
SHA1 c481d09ef2876fa9cf55563fa8901c0b4c4ee17e
SHA512 8fe6dfbbd85108da3896799b79a2372baad7c7713874a667bf7a5abb4d2aaaabc52624b8a68e1dfef5bb3729e0739f3f87f53a8168de42d62030085bec5a8b58
SSDEEP 192:Mive2G3PO8nG3JhTUnUEtoOXZrPYleyumKyw94mgjOJ2Q07OJ2QKOJ2QqOJ2Q88M:M+e2q3UEtouN6eyumJhDtL
TLSH
T127930415FD2DA431D56017387B2BCD744AD82C2AFC81301231F9AE7EFEA6BCA5819275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03_main2.lib

Path C:\Program Files (x86)\Game_Maker5\lib\03_main2.lib
Size 72KB
SHA256 4e3c9d050ca1e312d8f2b3f4079e67a3528eabc6afcd6fd424b8f42d2621ba31
MD5 1441064c996ecab5b8b5d3547bda6b37
SHA1 03cc92ff61cc71667b6517896f8d08d3fe108c22
SHA512 cff6c2c3b91fe46d2005601077560aa441a9133217aa005cdf09f3fd0aec81c1d3cd7685d8ce21f22f93fff0c7cde34324071b020f29be8715c6d1e899c9ab84
SSDEEP 192:77uN8V+Qb4fmudIg6DAZGX7rN8PlyBPGcDhzToR1FaB1jnfJ99Sf:7ycc8UGXfNslcecDhzToRS1jnfJ9cf
TLSH
T115732516FD2D8871D46017387F6B9E7598D47C2AF880301230FAAE7EFEA5BC16819275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04_control.lib

Path C:\Program Files (x86)\Game_Maker5\lib\04_control.lib
Size 77KB
SHA256 1eb1d0dbaf8c57a9e056e81c0aa12ca1602f7517b9282760fc1eda32f4f26082
MD5 4f1b6117384bd70623cd1e1afbad4931
SHA1 8cde6d15226895eedbaca7645b3c32a8d0404a25
SHA512 baf8417aef10ace46378cabe4c15537c269af4c38fb74abac1c1ee676614ce6dfee969973af5116cfe076b71c49d6b7c48c1896e79806f085f6ed35ba0211f69
SSDEEP 192:oZ/tbBss2ID19YWcsSbBxA0MS6QYz5S41Ftffi27wfyPvSsfU+:U/FBss2ID19YXlBxNp6QaM4Ry9O
TLSH
T16C73491AFD417132C66423387A8ECF755BDC6C1CFCA13052B4F8AE463AA21DF552A876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05_draw.lib

Path C:\Program Files (x86)\Game_Maker5\lib\05_draw.lib
Size 76KB
SHA256 b9d2d6afd7bc809837ffa4747e94fc1a21932b321edff13d4c3e4d205dae16b4
MD5 fa92cb1c347a72d2a179d1c28040c424
SHA1 18c643c539584e9abf31067d1c5f8a979bc007a5
SHA512 4e935ebbad5e43887642f8a36584855273faa2847516f555429141657aa3b62c59528a7bac7423558e8a9fa9c420e037deeee3cef967b1d063150963f3b64c86
SSDEEP 384:D3Ma55R/wDuLihUeVDwk7mVNK0OXH6NUi9nnngg4NO1y:DPU57kNWXRdNO1y
TLSH
T159733012FD818430D6542339BA9E8A7284D16C18E9431C722AF42D7AF963FFDA9DD077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06_score.lib

Path C:\Program Files (x86)\Game_Maker5\lib\06_score.lib
Size 95KB
SHA256 49bec63b1829795b478a1a200827989ee2269b493798b5076f0c531342776f47
MD5 fa26e7cbb614b1aa8c2b9b5941c373e7
SHA1 112a53a4fbe75b3ff2f54cc71db264d058176daa
SHA512 970c211319b74afcf38c46736b9c96ab7f6bdfafa2e829d836b3bd49d6eb8606266472e4a69eb93fe0cb3cc2b6a6a6206f2f9fcc5f840592ccbe16c4ff5b5351
SSDEEP 384:vL5qOfvjKbR6eaGkAkr+E0BzbZ6L4veGTqzp+RTy9:HfvjIRza0krl0pZ6RGHRTy9
TLSH
T1B1A3CA11FD5DA430D16013387B5ECE758AD82C19F8432C2221F86E7EFD62BEA689D172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07_code.lib

Path C:\Program Files (x86)\Game_Maker5\lib\07_code.lib
Size 54KB
SHA256 c21a11a96711827eece0259810a6d3895aee46115adef6b1302f74fd72e413d8
MD5 c6d92cee7089098e166a6dfec38f449a
SHA1 d12f05f811bdceb6bbaf772d861aa86073bbb468
SHA512 f89c71ae7444351bfa38338112098f4d30fde18281409565acfe1c1e1f02e93aa5422b78d0ddb796dd9a4be717ff9700113cc8d1c6ba17e7299217bcb647de47
SSDEEP 96:TVN/dkSu8JGs/8Z+/LJyYmCCdpKkbtdGIbmxH:jTG4Xe3pix
TLSH
T14543F211FD1E9970C46013383B1ECE75A9E82C19F882293231F46E7EFD627EA949D176
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08_extra.lib

Path C:\Program Files (x86)\Game_Maker5\lib\08_extra.lib
Size 95KB
SHA256 a5deeb08d96d29553e98b083ff40bfaf2fe5356b09efbfa31151684edf2524ae
MD5 0b640723440820e4cf79f29191e2730f
SHA1 fcfb7c8ce396cb5c4a039793db7f3837d29d2784
SHA512 d308a691c962955fdaeb224c9136d4d725990af482ea8b01e1ca7cc33e9dc9a7a6a4e483aa9a2a303355ae247d5e23d305196385003037e9360fe73ee522d441
SSDEEP 768:JPSqsI8MqzZjFqkmQq3SlR2F1W7rSx7VFh4c:J4/PsSf2fx5zp
TLSH
T164937915FD2D9471D56013393F2BCE7189E86C2AF880305230F9AE7EFE65BCA5829671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09_particles.lib

Path C:\Program Files (x86)\Game_Maker5\lib\09_particles.lib
Size 78KB
SHA256 1531a15624fd3a8c07393442e41a994f5e2b035bc1d571964ce7c78539af6442
MD5 85d623ce7c87a90476e2c59ec97ca194
SHA1 56ddbdd408a54f6bce94a5bfa0488dc09b08eac8
SHA512 1ee1aeb2918b9fbbc0cdeb250e54300332876613f38475d7dc5f8eb54d979eae36d378c9cc229416c2374e6557178f5e2c40b7f50ac885e8b1ef5c280fe0f854
SSDEEP 384:qPJfAu2J6AutFYAuvTGnepVm87Y81MUHFd0:oJfAuC6Au0AuvTsEVDY81i
TLSH
T1CD73A652ED2C4931D4A007747B2AAF7169E0BC19F98025C130F91E3DFE66BE19C1AB76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPI5B07.tmp

Path C:\Users\Admin\AppData\Local\Temp\GPI5B07.tmp
Size 412KB
SHA256 b2fdcd34b13d08de82f096b45f4dd8fed539e1a05332e9e47633f3cfa7a89763
MD5 283eefab3b76320202f94616fb988945
SHA1 f1f6ca0798a30f8c5132e7d70ccca0345bfb8177
SHA512 81b7afb9c4040a8e66d4fc5b342488b5ef55fa937c8272fcbd5339c08d11afaaa24b54b76d0edc9d5744e8cb00db5b0e8fa7c407bcecc65ea91a531828b1417a
SSDEEP 12288:dWK2twBRZAXncNN/e1IByzcjvk/4Z+Ovws5wV:cKJDZAv1fGQOIso
TLSH
T17594232687A0ACE88C3381E816DDF61EFB0773F54E5C5F98605898F05DB9CD7520AD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup2.tmp

Path C:\Users\Admin\AppData\Local\Temp\GpiTmp\Setup2.tmp
Size 2.9MB
SHA256 dadd00c99d75c78f013dfbabf933f2aa91e4f233135ec482ad37be199602eb72
MD5 f5e03b20599d690450a39aee16943b83
SHA1 e1a1ef21e635edfc5bbeedd1185d3f5c06811da3
SHA512 28d1edcdfe1ec3a3e7dd3fc6b501912bf0e33998015a9cc33266b3093107adcab7a9a102413e64aee25342863482466fa1a4500a5e007c0c4780579f881bb966
SSDEEP 49152:z9gcseK8O+JeAtL3HSdqEQ7lrneOUZWDTC5xHULigWEPuQeSo/tcWD9JCarnPUi7:zSYK8nFtL3uQyb0rWEWQeSo/iW/CwnPD
TLSH
T105E5331F9E883B26E40A24B1E31B8EDF65E3C54EE2A1D68C4C2E75BC119877F217D491
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game maker logo.jpg

Path C:\Users\Admin\AppData\Local\Temp\GpiTmp\game maker logo.jpg
Size 7KB
SHA256 674114b9ec142e1fa7f2c16abc07b54fdfbf062634a953bdbf0620c9007b0bbb
MD5 f4ed4a2b9fa6f3a1afe526d170427d1e
SHA1 f1b3e04bb1ac509fb31045c3da5fc450a28297aa
SHA512 c60b4ee2bec9059ff5b8b5ace3ccbae8229d0b8acf9f749679fa50d32f0c227f96f09a99105107736dc0048df1a76484872fed0af10a2eb9966bea8e9ae59a03
SSDEEP 96:TEnI49vZB7sEcIopu41Bv+li5bPlU19CI0TVxBbyt++70990Q3Mv0AGUInsrLfSc:TCZ2TC41B2y219Ayw793lUmsnw6IZpA
TLSH
T149F18EB2135F1BF9B468D2331B5A2C84A8F89A205CA5EF6A4CDA1B14B243CD47A4850C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPInstall.exe

Path C:\Windows\GPInstall.exe
Size 778KB
SHA256 cbcde28d74504c837609bdef937c0a8af7338605efec63e995fb1a0a591326ba
MD5 a75a03e2fe261297c3cbb128c32be3d8
SHA1 196db9c736a5b07fe053cc9f4bce600080ec8cb7
SHA512 9d8e1ace0f72e318ea1a5b10f0d8746dde9d1001a7865c2efb9c9517ceced3d44d2c04c397a2c69a7d98ba8bfc5609e65e6f7394bf04fd06abfd2b2c91a263cc
SSDEEP 12288:NOrZ9JTUvUQA74LZ+xsGYiqHQ1whNAy+wc1rugCSBFtUSS9TjZU:YJTUvF0FYyy+l1rASWS+
TLSH
T179057D22F3A09837E0731A398D1B97A55836BE102E38E9877BF51E4C4F356817D2539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1976-644-0x0000000000400000-0x0000000000635000-memory.dmp

Download

memory/1976-645-0x0000000000400000-0x0000000000635000-memory.dmp

Download

memory/1976-659-0x0000000000400000-0x0000000000635000-memory.dmp

Download

memory/3812-646-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3812-33-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3812-31-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3812-29-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3812-28-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/3812-12-0x00000000004A7000-0x00000000004A8000-memory.dmp

Download

memory/3812-11-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/4532-647-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4532-27-0x0000000000400000-0x000000000041C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads