Analysis
- user interaction
yes - max time kernel
69s - max time network
78s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/08/2026, 10:38
General
- Target Escape from the Abandoned Hospital with an Emotionless Girl.rar
- Size 168.3MB
- Sample260823-mpff3azzht
- SHA256 09afded98d34aa4c5752e5d682fd3d467bc24453cefa0aaaddaa4360d933c444
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Escape from the Abandoned Hospital with an Emotionless Girl.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Escape from the Abandoned Hospital with an Emotionless Girl\" -ad -an -ai#7zMap31962:176:7zEvent17601⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Escape from the Abandoned Hospital with an Emotionless Girl\Escape from the Abandoned Hospital with an Emotionless Girl\game.exe"C:\Users\Admin\Desktop\Escape from the Abandoned Hospital with an Emotionless Girl\Escape from the Abandoned Hospital with an Emotionless Girl\game.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f8 0x4a41⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
GalleryLabels.txt
ManualTranslations.txt
_AutoGeneratedTranslations.txt
_Substitutions.txt
game.exe
0Harmony.dll
Assembly-CSharp-firstpass.dll
Assembly-CSharp.dll
Assembly-UnityScript-firstpass.dll
ExIni.dll
Mono.Cecil.dll
MonoMod.RuntimeDetour.dll
MonoMod.Utils.dll
System.Core.dll
System.dll
BaiduTranslate.dll
BingLegitimateTranslate.dll
BingTranslate.dll
CustomTranslate.dll
DeepLTranslate.dll
GoogleTranslate.dll
GoogleTranslateCompat.dll
GoogleTranslateLegitimate.dll
LecPowerTranslator15.dll
LingoCloudTranslate.dll
PapagoTranslate.dll
WatsonTranslate.dll
YandexTranslate.dll
ezTransXP.dll
UnityEngine.Networking.dll
UnityEngine.UI.dll
UnityEngine.dll
XUnity.AutoTranslator.Plugin.Core.dll
XUnity.AutoTranslator.Plugin.ExtProtocol.dll
XUnity.Common.dll
XUnity.ResourceRedirector.dll
mscorlib.dll
config
mono.dll
unity default resources
unity_builtin_extra
globalgamemanagers
globalgamemanagers.assets
level0
sharedassets0.resource
memory/1644-186-0x0000000005440000-0x0000000005540000-memory.dmp
memory/1644-185-0x0000000005440000-0x0000000005540000-memory.dmp
memory/1644-187-0x0000000005440000-0x0000000005540000-memory.dmp
memory/1644-188-0x0000000005440000-0x0000000005540000-memory.dmp
memory/1644-189-0x0000000005440000-0x0000000005540000-memory.dmp