e165c5bc9ccee8e2c61f6bf132cf6aad5f7611d0cdd95266c9fd7610e69dd8f6

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
94s
max time network
73s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_undertale_2.0.0.2.exe
Size 124.1MB
Sample261002-2547pavdpf
SHA256 e165c5bc9ccee8e2c61f6bf132cf6aad5f7611d0cdd95266c9fd7610e69dd8f6
MD5 9b5e4e948e9159b6ce5f320f201e66e2
SHA1 2f93b29ea6396260419354bd9f555993ce1a1af4
SHA512 2358db83659ce5facc720e9acb4f8855c34367f6d003119d1085b0bf9bff914fdfcef3bd5d77810deb38e6755a0687dd136df2e840e69100e90a0992837d3959
SSDEEP 1572864:TM5vbZD/0FnKeF8KC9dUITSs4s6mJIohl3C8XM5jI5hP4w0emUUsZAUgXRJO1Msv:oL/inKesfVSzn/+l3T5hXoU3eUg+eC
TLSH
T1C0583312DC28C525C34D2B3ED0E2AC4BEB6F0E1D9BD4471048CA5EC97DEA6748536ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4168	setup_undertale_2.0.0.2.tmp

Loads dropped DLL 7 IoCs

pid	Process
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_undertale_2.0.0.2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_undertale_2.0.0.2.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3172-0-0x0000000000400000-0x0000000000446000-memory.dmp	innosetup
behavioral2/memory/3172-186-0x0000000000400000-0x0000000000446000-memory.dmp	innosetup

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Colors	setup_undertale_2.0.0.2.tmp

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\NotificationData	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	setup_undertale_2.0.0.2.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	setup_undertale_2.0.0.2.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	setup_undertale_2.0.0.2.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	setup_undertale_2.0.0.2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	setup_undertale_2.0.0.2.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	setup_undertale_2.0.0.2.tmp

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp
4168	setup_undertale_2.0.0.2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4168	3172	setup_undertale_2.0.0.2.exe	89

C:\Users\Admin\AppData\Local\Temp\setup_undertale_2.0.0.2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_undertale_2.0.0.2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\is-DKQAI.tmp\setup_undertale_2.0.0.2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DKQAI.tmp\setup_undertale_2.0.0.2.tmp" /SL5="$502B6,129584939,242688,C:\Users\Admin\AppData\Local\Temp\setup_undertale_2.0.0.2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01.Baldur's-Gate-2-Complete.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\01.Baldur's-Gate-2-Complete.png
Size 1.5MB
SHA256 139025852cb530b179c84c1748692be0f0ac21fc18d7f49dffc5f0a6b7aa85f1
MD5 b399afa2fb7d5b793c1cddfee90c8829
SHA1 ca8e45034947e40c643f2cb18d16d75d438afc30
SHA512 1fb6ddaf5e1985f5b430436cc3952eb92d9d5d04f9598ab67157430a95e28939fa9d600da45e5ad214d5f605d467f7f4cf7a28594f53ff7b6c55eee1108f536d
SSDEEP 24576:5b2D2JSpTKqnhs8C593pzalthDrAm03llCdaPpL5hCZqWkM:t2KcFhBC593M7hvAm03lDhuqk
TLSH
T19B6533792B87602331D2F0B7AE2424521B25D05EA84CCDAA0ADFFD65C317D473699F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01.System-Shock-2.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\01.System-Shock-2.png
Size 1.0MB
SHA256 58cb880d7487feb7f6c550af1bffe46680ada0ebd092d155bfec92b759c8eab2
MD5 5f0539ce5754ab5c5e0a2c34c7cfb370
SHA1 f33268b73f9c899823ab3b6eeb122f84e4d67357
SHA512 a5e4248032acabb847df604780d57f69a5dd3e21d8e6509dd211903a7bcdc467ff9a78b71e0da10c9f6967717df207fc8c685c8e217d05fbf634305bf887859b
SSDEEP 24576:rwmjXhTkt9wMGxR3DWudUMxVMvYJPpEuiqAaPlM1V86:rtTZkuHcgheaPi1O6
TLSH
T13F3533E7541A281FC83D1CBD8807009ADB3C1F3DBE667F36961B5BB854A0750C9A5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.Planescape-Torment.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\02.Planescape-Torment.png
Size 1.1MB
SHA256 9ed27528f03e8abf32cac836472fe27d8012e476ff148615a118977056f7e183
MD5 0fed0da056d9d6f7debe898c44f79d3d
SHA1 c76646c642377e1bd8d101febc4986d8fa37d7c1
SHA512 6c17ff7e8fd41aa3a75b3662591006cf706fc6af6e92369dde4514187da95b85ee6797b2ca9f0b1cb1bd30142bca3e5d190ccd0255706684d72fef9ce51f0bb3
SSDEEP 24576:7kqXFK8mQkEguw3qzc+tWeTWFHqixUv0baI94EOszjH+fGJOv5dLhLue0M08Els:flmTB3SWeqFVO0+I9fvzjHeG0LLhLuef
TLSH
T1DE3533287F312550A24F4101A57E945EB2E1F5A399D8B76C08E3D4E98CBDECADC4CA3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04.Witcher-2-Assassins-of-Kings.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\04.Witcher-2-Assassins-of-Kings.png
Size 1.3MB
SHA256 af33c715c9eac00434b6e4dbc5dde8bbdb98ab6f0f0a3daeb2d7272b40e39c90
MD5 6754c9c260530bebf5926600117d13a8
SHA1 c95f4847f39d2ca42b600ecd16baff4a88d98924
SHA512 29f1b4562c8095d90210183fbeee3a2cf54a636d2f5cf7f36fa4a5ffa48f8c2340c487e975eef65656085fbfb352ad4dbe35a823b696f059b2d6de9e2c685bbe
SSDEEP 24576:Kw1Ey4td0vUeKpha2rfTLsqjnkX+iBTbYg1W3/ETVY3moKdYxvYSlD0i8:Cd0vUzhaYTXI9bYl3aVyfKuxYA8
TLSH
T120553347E6266152931534A110B6C63E551453C33EF87A3FA31EA9E3E9AE168FDEC0F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05.Might-and-Magic-6-Pack-Limited-Edition.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\05.Might-and-Magic-6-Pack-Limited-Edition.png
Size 1.3MB
SHA256 301d622cdb7628f02df53def69da5eedcc19959daf091fc63c4db5160adfd24e
MD5 ed161483c5a79f3f381ad19d1e6ebd25
SHA1 afcb96430d1cdb5b85e1c177fb09b99e1c0e6952
SHA512 79b097b8371ee4eb3b3eb3f0777a77676fce0ed97838be4666c3ee96b0895e19f26142f28b145dcbb21fc9aab648afc46fdb07ca532f7cb12509db65e5ca18d8
SSDEEP 24576:7tS8SowbA4jrLEt1+yNsPqX2TRdCnEFHF7M3oSbsOKCU5enjadyZPCJEiJtyiQqZ:7cNrL81+KsUC7coGsFL5QjcyZ61btPzN
TLSH
T1F66533C392179E0451CF57227B3CAED469C4AE6279A5452BE10B04D79B28F20FD86E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1456487183.ini

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\1456487183.ini
Size 724B
SHA256 9a0b177c544189a32121751db047d727d31b1012de2b90bc4fda8e7cfa125ead
MD5 4329204bf23061a738b6c5ea40a61ae1
SHA1 08cd0b3d309c8c7cc279a3dd99945e85c811c6bf
SHA512 8119b744a5b0d00e3ebdd1bec67a900914e01ed94929c9bd27fcf2b346591665964cb861f5d5f72138f9d5b9360773032d0603fc26b29714010fba8355ddf00d
TLSH
T19E014CED42059883AF60DD1D70F19AC5D0F433B1C282E9E87384869C0C5727628CDACF
MD5 SHA1 SHA512 TLSH

Submit Download

BigOK.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\BigOK.png
Size 3KB
SHA256 59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a
MD5 5b43a5d975a53f4fc1da67ce9f7784c1
SHA1 8543fa1e471030049942252b23cb22e0880c3af5
SHA512 5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5
TLSH
T17B614DD1323C683EC7F40B2CA1881A5EC1AB1340654B66A852CF64580798A79B77A777
MD5 SHA1 SHA512 TLSH

Submit Download

EULAAccepted.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\EULAAccepted.png
Size 2KB
SHA256 0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c
MD5 461dfeb75927bdb39f9db5348612a611
SHA1 b7893b1fff6801e37ee7337d876962a09184941e
SHA512 68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b
TLSH
T1BC512BEFF5921C02C255B8E918E9A6939EE5C9C58DD1542578CFC08B14794B4006A2CF
MD5 SHA1 SHA512 TLSH

Submit Download

EULAShow.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\EULAShow.png
Size 1KB
SHA256 6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462
MD5 c596bc9111edc702bbbb29b70984254f
SHA1 d4712c7b91ff4f8994e7907d31357c42eb47c738
SHA512 db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a
TLSH
T19C31B5C9F640B801C245ECD028E9A4328D7E9D805AE1BDA9F8CFE4C745365F8142C1CB
MD5 SHA1 SHA512 TLSH

Submit Download

GOG_new.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\GOG_new.png
Size 1KB
SHA256 ab52ceed113fa6bf9e6bd267b6302f61cc86365cdfd7253fed4ec8dfe01dfcaa
MD5 4ae6f5b38a7dafc08c75e3ba3c141eb3
SHA1 f423034b8ddad1cee41261e809d216c97f2d8e7b
SHA512 10afbb5404b1a67b376845d8e2b7f15faee975b55c61d2a98b3c2fa22bc3c4811a9d0795d210d51a3ea50f8ba4a6278fec173c9d435db7bb372ecd6319c3de60
TLSH
T14541F808B5929C4546CAD191FCFB483A4EBA5090D9EDA827609CD88F0AEC7A8550C4EF
MD5 SHA1 SHA512 TLSH

Submit Download

GameuxInstallHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\GameuxInstallHelper.dll
Size 94KB
SHA256 b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6
MD5 4d3ac88054df63fc810427bdaa96c458
SHA1 e4d554e03ba91f6b53a2a80253b339f56e303c94
SHA512 d4732ad89bbb19b316dff1b9c534acf98bb985c89d1295f08e24b21531123426500b3712979dda2f0e941a5969c0cbca15bbd52f6c167653f96a494a6677ca54
SSDEEP 1536:B+cZE7LuH82vbVSEru0QrtLMNYxKoqbEnz8Gj1Nh5vIexy8Cy/3:YcE7LV2ULMZowGjJ5vIexy8Cy/3
TLSH
T14F936B617AD4C031E9A3107956ECB261263FB5B11B36D8CBF30456DEAA327C2E93531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\background.jpg
Size 102KB
SHA256 e7fed16156e54ddb197272ab6ca1da0cdbe0492baf870ed0c6df01e5d61505a2
MD5 e186979c952749422f41229b396f03ba
SHA1 07b98bae245203d2e33ed726f4c4fdccc44000ea
SHA512 c6b926011a1a97ad4e50a12c3ba0bec8e0f4ec9103f52447e5003921efb5afafd0196180042a749adea1c04f6add91a53ad0526c785481b7c819d20d3e4e0d4a
SSDEEP 1536:BfDO97it0mpEQRxmEY2ep6QzoU0LAA9A02mhEYJ0hNSNWJXYFaLWXJcZCqgcy3:BU7it0S2EYJpFzHjV0zJJ0njKJcEq3M
TLSH
T163A30219C2309435E6EF53BAAFE21D24F9085E8A94D6D18FEF6AF00389165158D8CCF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btn_md5.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\btn_md5.png
Size 8KB
SHA256 b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47
MD5 3befe9739354ee24a0b1ea8df05ce274
SHA1 ab0bda986a8c46aa19f57b75a2b7b22445a3c625
SHA512 ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd
SSDEEP 192:+CgAPOTLq6/bkYNuQJA6hcxuGcjMTch2kmBm/5o:+IPOTLq6oAANOjTh2kmE/S
TLSH
T119029FD4E3E5CD10C688BB8B1DCA8526E80C1593E7A6C7C2F536E4029A3327826D97C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crcdll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\crcdll.dll
Size 69KB
SHA256 23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
MD5 1d51fac9e2384eeb674199cfd5281d7d
SHA1 861dfdc121357d605d0cc3793266713788109eb2
SHA512 921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda
SSDEEP 768:tCrczqrdE7n1KuGUlKTs3RLflC7ZWL/sebzx7jMKkkg8dODMh1MK/N58n:tCrczqJ8U5s3R7lYZWbzx7jPgRE5
TLSH
T1EC637C207951D176C08A6835551AC3B11A7DB8322AF9C983BF971B7E9F203D1F63B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\error.png
Size 726B
SHA256 142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b
MD5 df10adc25b673e74e19971c17bee5a98
SHA1 ee16fb1cf9491f5e611282f0574b27d76fede412
SHA512 dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f
TLSH
T11401946FF800FAA8AD7A1DDA97752550C4FE877D66A200D0B4D2C44831822680F17789
MD5 SHA1 SHA512 TLSH

Submit Download

error_icon.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\error_icon.png
Size 1KB
SHA256 acdf96ee4261fae138e6350a0ad50b367022ed5b908fa168baad92644f566ee8
MD5 263720c4b8bb111567a2a49989b8f467
SHA1 cf346fa3c70164648e0eaf72a37c6f4920ab4792
SHA512 94f06a81dc735cf264abde86e6169e5fd78d873d2e926fd48287d2ac5208fc930c3c432186e3510add002bd1b4ae32ad8d35270b17c3ce5f18c43764a8e9de43
TLSH
T1AE319986F6811401DB18849211D640368F674540E9E8E1B6B6DFCC434A703FE669BBCB
MD5 SHA1 SHA512 TLSH

Submit Download

get_hw_caps.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\get_hw_caps.dll
Size 76KB
SHA256 869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d
MD5 2e35d2894df3b691dbd8e0d4f4c84efc
SHA1 d0fc14963e397d185e9f2d7dea1d07bc6308d5b9
SHA512 29ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90
SSDEEP 768:9zI+dcMjCvFMUHeE5+LanKyvpEeRzH9Ci15bQJ7Ky1MwuPixbEULq8r:98+dYt+E2m6eRD9ZJQDMwuPRUm8r
TLSH
T108734A0273D18072E0BB173854B297510F7ABC527EF6C25F2F913A9E2C71394AA39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ok.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\ok.png
Size 1KB
SHA256 0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e
MD5 103c1368e60806b1b7995a0894eacf87
SHA1 971392527f6e4b655044773132505c901a6b5469
SHA512 652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a
TLSH
T10A21B7FC167568EA76B543B9428B0D65C9BAEE2D640D730AB076CCB45C43491C6DCF60
MD5 SHA1 SHA512 TLSH

Submit Download

progress_center.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\progress_center.png
Size 1KB
SHA256 2b9dae87340e66b67ab1d8247d4a137628e324969f92fe1098f95a7c5bab2f43
MD5 ad7fc1e37e40da38dd57adc446cc6c0e
SHA1 08033265deb9b45243cfa0065d98ffe13a039e26
SHA512 dd715d74f8e1ed6ab75b7b6530b383ac47040d8baa7728be160f6d230bf485a9cc54f15f7dc85b122ce56e54d63fa4890e510dfc89d9c9344e31f789ebac8756
TLSH
T16321634AF9446C82628ED19238FA542B592EC941E9F4E865BCEEC88B05383F855294D7
MD5 SHA1 SHA512 TLSH

Submit Download

progress_left.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\progress_left.png
Size 1KB
SHA256 85e39d909a7300fa2043ec42818582867b981401264b14fc5408e477ae0b4668
MD5 290c7612ad7a077028cd3dc78ce99673
SHA1 18995fbe39d05e4a1cafc7cc2e0f6fb745442f77
SHA512 799841f5b8a1056e78a49c823009750e4b93af130a6c4ff9dc6d386c06b88614e53b46a6df62f5a217d5c99da01cf4e2fe8392c73d39e81000045291cf24205a
TLSH
T1E121744EFA106C41628DE5C638FA4427991A8400D9F0E951E9DEC85B09303F9656E0E7
MD5 SHA1 SHA512 TLSH

Submit Download

progress_right.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\progress_right.png
Size 1KB
SHA256 396a3351fe409328782ab138282cf9cec061a5a9540a3506700a620db1f54e7d
MD5 c25a41f022a74308d944d1e807d72f44
SHA1 83c6bbec3fb373fcc78ce0e737742100994cd6d4
SHA512 d2f4449195f3e60c826cfabb52a083d829eb9d0509272977d8fdb33bc5214678949cd27d0594684594e0a3eda2351c39cec8d91923cb716ad144ccf2b966c8e6
TLSH
T15421AA5DF6006C41569DD08238FA54639A0F8840C9F4F551FEDED85B04323F9645D0D7
MD5 SHA1 SHA512 TLSH

Submit Download

track_center.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\track_center.png
Size 1KB
SHA256 794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860
MD5 3f2b0c22f8ea28dcbb82b39a16a039aa
SHA1 b3f4dfc2ea86fbdad05877b4c356b7fa8016731d
SHA512 b4bf65d751717e85418947662d315ae3bcb177f60914832fefeeb95da9eddb75eb5531c62e5a5a70ff03c8a025b5a03e61ffbdecc9f483bea9684454ca9362d3
TLSH
T181216046FE005C01718AE6D228FB8432952A8480E9F4F460BADEDC5B47353F8492E1DB
MD5 SHA1 SHA512 TLSH

Submit Download

track_left.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\track_left.png
Size 1KB
SHA256 a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8
MD5 55dacb00cbe2825a8540236c5777a205
SHA1 18a52ac6c741b558500fbc1716d46b4fe4471982
SHA512 2ea444cc1080f20761c8d71d96fcd04ef48254cdc1dc41d1d139f459ea5613fe12f6e4bd026bf33a5c01ff038e72e05dae2f8fba33ff517dd395e1911f10ff10
TLSH
T14D21968AFA409802B1CAD45328FB80379A198400DDF4E561B8DFDC8B05657F9892C1D7
MD5 SHA1 SHA512 TLSH

Submit Download

track_right.png

Path C:\Users\Admin\AppData\Local\Temp\is-3B1AV.tmp\track_right.png
Size 1KB
SHA256 f54cd6e42f2b2bc5cb8a15f6a28f1499abf094a519ebdf39f4c4e167312c9c16
MD5 ddec70b6c49be3e8c3a7d01c2f6ff1c5
SHA1 5383271999f787c36b1dc8f3cc13c8407b195439
SHA512 f43f94b194b5a7eafcec9e831f61042859c30e1af2e2447195bdd06b12c90982181161a1c1be5aa5223ff664f88e4891bd71cfffb7ef672d6fe4f614030e0e01
TLSH
T1D2216349FA40580276CAE5923CFA90339A998580CEF8F1B379DEC86B05363B5465C4EB
MD5 SHA1 SHA512 TLSH

Submit Download

setup_undertale_2.0.0.2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DKQAI.tmp\setup_undertale_2.0.0.2.tmp
Size 1.3MB
SHA256 9783653f6a21c1c36da87ee8ee80b6f3d047af99690d9310260362a493c1268e
MD5 a348289ef079798dc7d48faad4a64b87
SHA1 7e15a36ebadec0ccc65d6a68c7b467e63e14a1be
SHA512 33b392ebbf2db63890dd2c0f1d4b3bb1443cf1b8d6e9fe0b3f7b33a0337c031746218beedf1281a6775d52d7e52fd7d9b46ba1d323d82d86a969f95c7515579f
SSDEEP 24576:O2dsU5drL69+1uIe+Im/YYhGAG4VmthA3xkNEBdajWFHDthntVXt1NC5bxj4n:9m0dYYhG0dajWFTjgzY
TLSH
T14A555C22A3D14437D4731F795D6BD6945C3ABE202EA4948A7EF89E4C0E39B407D3A393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gog_eula.txt

Path C:\Users\Admin\Documents\gog_eula.txt
Size 1KB
SHA256 5dc12cf6501771051b162d2965e7bb5970dd050bacb69790483a7555ccd9e566
MD5 28f903deb4770d00e359a107e19f8cc7
SHA1 8b60172cf3c7d72ea76fa7876802f08507dc4223
SHA512 5a6a30ae71344d7ffba237cfe4e2228cd9bd2ff117a783b02afec0da7c70061eafb36a8d45e8f9e4d3d922a92905ac35d2a4dd33d283bbd1f3bf238102340b73
TLSH
T18431418E774E837214FB02DB7E468A85F6275F38FA9E09A1306CC0AC27AA754427116D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3172-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3172-186-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4168-185-0x00000000035C0000-0x00000000036C0000-memory.dmp

Download

memory/4168-198-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4168-7-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/4168-189-0x0000000007990000-0x000000000799E000-memory.dmp

Download

memory/4168-190-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/4168-187-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4168-188-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-191-0x00000000035C0000-0x00000000036C0000-memory.dmp

Download

memory/4168-194-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-195-0x0000000007990000-0x000000000799E000-memory.dmp

Download

memory/4168-193-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4168-73-0x0000000007990000-0x000000000799E000-memory.dmp

Download

memory/4168-199-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-21-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-203-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4168-208-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-207-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4168-213-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-212-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4168-218-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-223-0x00000000025F0000-0x0000000002605000-memory.dmp

Download

memory/4168-222-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4168-226-0x0000000000400000-0x000000000054E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads