banload | 7f0005d39580ba537d4f9581b47c28adf132a6586d62881a62cd56fa1b24ab27

Analysis

max time kernel
510s
max time network
457s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
02-07-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RPGXP_E.exe
Size

27.2MB
MD5

4db4691a4f71af97b109b11ee2c70ec9
SHA1

ba5eaa22936505df35a10319dbce60ed6e873383
SHA256

7f0005d39580ba537d4f9581b47c28adf132a6586d62881a62cd56fa1b24ab27
SHA512

2688575f993dd7c2b0bff1634465149103412032bc882d09ccd492033ec94b27c84e4a1655118264728fea358969504ff748a8e6fe73dd313789f2a2d142f15a
SSDEEP

786432:F6HKbIBBYy9IMhfpNIubCq9iS2wvX1RA6rxiShm0RML1P:+iI3/9IM6uejAX1RUShT

Score

10^/10

banload aspackv2 discovery downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
aspackv2

Processes:

resource yara_rule

C:\Program Files (x86)\Enterbrain\RPGXP\RGSS104E.dll aspack_v212_v242
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

RPGXP.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RPGXP.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate RPGXP.exe
Executes dropped EXE 7 IoCs

Processes:

RPGXP_E.tmpxp_rtp104e.exexp_rtp104e.tmpRPGXP_E.tmpxp_rtp104e.exexp_rtp104e.tmpRPGXP.exe

pid process

4944 RPGXP_E.tmp
2836 xp_rtp104e.exe
1904 xp_rtp104e.tmp
4668 RPGXP_E.tmp
3852 xp_rtp104e.exe
3908 xp_rtp104e.tmp
3196 RPGXP.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe

resource	yara_rule
C:\Program Files (x86)\Enterbrain\RPGXP\RGSS104E.dll	aspack_v212_v242

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RPGXP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	RPGXP.exe

pid	process
4944	RPGXP_E.tmp
2836	xp_rtp104e.exe
1904	xp_rtp104e.tmp
4668	RPGXP_E.tmp
3852	xp_rtp104e.exe
3908	xp_rtp104e.tmp
3196	RPGXP.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Drops file in System32 directory 6 IoCs

Processes:

xp_rtp104e.tmp

description	ioc	process
File created	C:\Windows\SysWOW64\is-GGIJ7.tmp	xp_rtp104e.tmp
File created	C:\Windows\SysWOW64\is-LQ6AJ.tmp	xp_rtp104e.tmp
File created	C:\Windows\SysWOW64\is-Q22HJ.tmp	xp_rtp104e.tmp
File created	C:\Windows\SysWOW64\is-FQNFU.tmp	xp_rtp104e.tmp
File created	C:\Windows\SysWOW64\is-MFFFT.tmp	xp_rtp104e.tmp
File created	C:\Windows\SysWOW64\is-K6RP0.tmp	xp_rtp104e.tmp

Drops file in Program Files directory 64 IoCs

Processes:

xp_rtp104e.tmpRPGXP_E.tmpRPGXP_E.tmp

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGS\is-RC6BS.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlebacks\is-PPHGC.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-87SB7.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlers\is-1N469.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-VLM99.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-KU0GI.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-LTA1K.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\is-42CIM.tmp	RPGXP_E.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-72KOD.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-B42M8.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-V3EP3.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-2EQNA.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-RJ368.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-3U54A.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-R2581.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGS\is-CAJU9.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-A2DRB.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Fogs\is-H7GBK.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-B1ETT.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-E1EB4.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-NHIV5.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Enterbrain\RPGXP\drm\is-33HRN.tmp	RPGXP_E.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-2RHL1.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-NJLR4.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-MFSHK.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGM\is-2OE1N.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlebacks\is-OG4L5.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-10UTO.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Icons\is-5KUD7.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGM\is-3KQOD.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-1A2LN.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-63MRN.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlers\is-OH6AN.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlers\is-NMPTN.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlers\is-O5Q7P.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-ELOAO.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Tilesets\is-TO3DQ.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-AIODG.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-2N9AI.tmp	xp_rtp104e.tmp
File opened for modification	C:\Program Files (x86)\Enterbrain\RPGXP\unins000.dat	RPGXP_E.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Autotiles\is-S8NUJ.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Tilesets\is-2GLP9.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Tilesets\is-U754R.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGM\is-7GOUT.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-4K0PG.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGM\is-U19S1.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-102JD.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Icons\is-BDBQM.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Enterbrain\RPGXP\System\is-8AM1C.tmp	RPGXP_E.tmp
File created	C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\is-IPOLQ.tmp	RPGXP_E.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-S0HA8.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlers\is-1CEKB.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-7AK1C.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Autotiles\is-OUBPC.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Characters\is-RQHNJ.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Transitions\is-8K14I.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-CNFTO.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Autotiles\is-IBH70.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-P46ID.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\SE\is-LQP8A.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Battlebacks\is-OAEU6.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Graphics\Tilesets\is-E2C3R.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGM\is-Q342S.tmp	xp_rtp104e.tmp
File created	C:\Program Files (x86)\Common Files\Enterbrain\RGSS\Standard\Audio\BGM\is-CODRR.tmp	xp_rtp104e.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

RPGXP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	RPGXP.exe
Key created	\REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RPGXP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RPGXP.exe
Key created	\REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Software\Microsoft\Internet Explorer\Main	RPGXP.exe

Modifies registry class 60 IoCs

Processes:

RPGXP_E.tmpRPGXP_E.tmpRPGXP.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxproj	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\shell\open\command	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\shell	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\DefaultIcon\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\",2"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\DefaultIcon	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rgssad\ = "RPGXP.Archive"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxproj	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\DefaultIcon	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\DefaultIcon	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\shell\open	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\DefaultIcon	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\shell\open\command\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\" \"%1\""	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\shell	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxdata\ = "RPGXP.Data"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\DefaultIcon\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\",3"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\ = "RPGXP Project"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxdata	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\shell\open\command	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\ = "RPGXP Data"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\shell\open\command	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rgssad	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33CC1979-AF01-1C1F-8930-A34DE15A1DA7}\ProgId	RPGXP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\shell\open\command\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\" \"%1\""	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\shell\open	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\shell\open\command\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\" /n \"%1\""	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\ = "RPGXP Data"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\DefaultIcon	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\DefaultIcon	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\shell	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\DefaultIcon\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\",1"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\shell\open\command\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\" /n \"%1\""	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\shell\open\command	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxproj\ = "RPGXP.Project"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\shell\open\command	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rgssad	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\ = "RGSS Encrypted Archive"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33CC1979-AF01-1C1F-8930-A34DE15A1DA7}\ = "Msi install server"	RPGXP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33CC1979-AF01-1C1F-8930-A34DE15A1DA7}\AppId = "{000C101C-0000-0000-C000-000000000046}"	RPGXP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2198854727-3842442895-2838824242-1000\{F001D182-409A-4E40-B886-13A5F3B6161F}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\DefaultIcon\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\",2"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\DefaultIcon\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\",3"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\ = "RPGXP Project"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxproj\ = "RPGXP.Project"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\shell\open\command	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\ = "RGSS Encrypted Archive"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\shell\open	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rgssad\ = "RPGXP.Archive"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Data\shell\open\command\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\" /n \"%1\""	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33CC1979-AF01-1C1F-8930-A34DE15A1DA7}\ProgId\ = "IMsiServer"	RPGXP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxdata	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Archive\shell\open\command\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\" /n \"%1\""	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGXP.Project\DefaultIcon\ = "\"C:\\Program Files (x86)\\Enterbrain\\RPGXP\\RPGXP.exe\",1"	RPGXP_E.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rxdata\ = "RPGXP.Data"	RPGXP_E.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33CC1979-AF01-1C1F-8930-A34DE15A1DA7}	RPGXP.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RPGXP_E.tmpRPGXP_E.tmp

pid process

4944 RPGXP_E.tmp
4944 RPGXP_E.tmp
4668 RPGXP_E.tmp
4668 RPGXP_E.tmp
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

RPGXP_E.tmpRPGXP_E.tmp

pid process

4944 RPGXP_E.tmp
4668 RPGXP_E.tmp
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

RPGXP.exeOpenWith.exe

pid process

3196 RPGXP.exe
3196 RPGXP.exe
3472 OpenWith.exe

pid	process
4944	RPGXP_E.tmp
4944	RPGXP_E.tmp
4668	RPGXP_E.tmp
4668	RPGXP_E.tmp

pid	process
4944	RPGXP_E.tmp
4668	RPGXP_E.tmp

pid	process
3196	RPGXP.exe
3196	RPGXP.exe
3472	OpenWith.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

RPGXP_E.exeRPGXP_E.tmpxp_rtp104e.exeRPGXP_E.exeRPGXP_E.tmpxp_rtp104e.exe

description	pid	process	target process
PID 1276 wrote to memory of 4944	1276	RPGXP_E.exe	RPGXP_E.tmp
PID 1276 wrote to memory of 4944	1276	RPGXP_E.exe	RPGXP_E.tmp
PID 1276 wrote to memory of 4944	1276	RPGXP_E.exe	RPGXP_E.tmp
PID 4944 wrote to memory of 2836	4944	RPGXP_E.tmp	xp_rtp104e.exe
PID 4944 wrote to memory of 2836	4944	RPGXP_E.tmp	xp_rtp104e.exe
PID 4944 wrote to memory of 2836	4944	RPGXP_E.tmp	xp_rtp104e.exe
PID 2836 wrote to memory of 1904	2836	xp_rtp104e.exe	xp_rtp104e.tmp
PID 2836 wrote to memory of 1904	2836	xp_rtp104e.exe	xp_rtp104e.tmp
PID 2836 wrote to memory of 1904	2836	xp_rtp104e.exe	xp_rtp104e.tmp
PID 1492 wrote to memory of 4668	1492	RPGXP_E.exe	RPGXP_E.tmp
PID 1492 wrote to memory of 4668	1492	RPGXP_E.exe	RPGXP_E.tmp
PID 1492 wrote to memory of 4668	1492	RPGXP_E.exe	RPGXP_E.tmp
PID 4668 wrote to memory of 3852	4668	RPGXP_E.tmp	xp_rtp104e.exe
PID 4668 wrote to memory of 3852	4668	RPGXP_E.tmp	xp_rtp104e.exe
PID 4668 wrote to memory of 3852	4668	RPGXP_E.tmp	xp_rtp104e.exe
PID 3852 wrote to memory of 3908	3852	xp_rtp104e.exe	xp_rtp104e.tmp
PID 3852 wrote to memory of 3908	3852	xp_rtp104e.exe	xp_rtp104e.tmp
PID 3852 wrote to memory of 3908	3852	xp_rtp104e.exe	xp_rtp104e.tmp

C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe
"C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\is-T91ML.tmp\RPGXP_E.tmp
"C:\Users\Admin\AppData\Local\Temp\is-T91ML.tmp\RPGXP_E.tmp" /SL5="$4023E,28152842,118784,C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\is-GRIFA.tmp\xp_rtp104e.exe
"C:\Users\Admin\AppData\Local\Temp\is-GRIFA.tmp\xp_rtp104e.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\Temp\is-MBTEM.tmp\xp_rtp104e.tmp
"C:\Users\Admin\AppData\Local\Temp\is-MBTEM.tmp\xp_rtp104e.tmp" /SL5="$4014A,22729139,53248,C:\Users\Admin\AppData\Local\Temp\is-GRIFA.tmp\xp_rtp104e.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:792

C:\Users\Admin\Desktop\RPGXP_E.exe
"C:\Users\Admin\Desktop\RPGXP_E.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\is-FPQQ0.tmp\RPGXP_E.tmp
"C:\Users\Admin\AppData\Local\Temp\is-FPQQ0.tmp\RPGXP_E.tmp" /SL5="$6022A,28152842,118784,C:\Users\Admin\Desktop\RPGXP_E.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4668

C:\Users\Admin\AppData\Local\Temp\is-P78F0.tmp\xp_rtp104e.exe
"C:\Users\Admin\AppData\Local\Temp\is-P78F0.tmp\xp_rtp104e.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852

C:\Users\Admin\AppData\Local\Temp\is-J10F3.tmp\xp_rtp104e.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J10F3.tmp\xp_rtp104e.tmp" /SL5="$1028C,22729139,53248,C:\Users\Admin\AppData\Local\Temp\is-P78F0.tmp\xp_rtp104e.exe"
4⤵
- Executes dropped EXE
PID:3908

C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe
"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3196

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:4104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4592

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Enterbrain\RPGXP\RGSS104E.dll
Filesize
740KB

MD5
71354278675a4deea20fb3cbb5f77170

SHA1
073e9f1db6c1be847f186553e985e35e4de03c70

SHA256
7b6acb5e2c245b8cfda77fced2cc0e94108384cd1b9ffc8510e7304fcb9feb6c

SHA512
e664f02f2d2918c30a6fb75ab7dfe22ab0f2eea8e7ebbcd5b211463062744e51e3956d320127570db0b5dc9c12fb39c6b204bc2967bd4708bccab17d5c980915

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.chm
Filesize
339KB

MD5
d9d8473625ba8d184133c7bddaeb99ab

SHA1
fbc88a90316132999de1cdb63c197555b0daa764

SHA256
25dac8b0eeadc8332c7ae783c0f03b7260e7934f28e694ef997fdaa876a9519c

SHA512
9652d7e84e098a2570f54ec185fd5cdb6ca34f323987623512d8737f28fb70b2c3a59fec4513bd5f897f3bdde8ae5c9314fcd058b60ef9303f02308ec2a20288

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe
Filesize
3.2MB

MD5
6f6ccdccf5bd0946a2b55a014329bdac

SHA1
48bbe60410e70a991d7ffea90e3e1279ee456c78

SHA256
ecb1f0805161e359adedb28b2fa7f8c4d8586d6d5d69a37dd05757618f9e551f

SHA512
092d982773dd62e4d6f3a60c83d7e0f7c8ab07afaca3ecfdf960014452e78d4f6437008e8b110993b8e6a798110a736b9be0189f932c348d5b74b23c6cd7b7e1

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\SciLexer.dll
Filesize
348KB

MD5
5bf76222d6ef78e83cf6ea2c21dfdbef

SHA1
01d57370ff4e022a57addb60498acb2130a68d26

SHA256
8ba69dcf9d373efc9e994314f1d5bee5683096561f9db24ed1e1df6fdfd8235e

SHA512
d23d4af4d4b70003a40a1ce1744bdde89777c36065023e3082cd741bc6f0327b0344d41e823c8c111fabed0a2cbacf9b12317e8bbbbe99631597590aca533e89

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Actors.rxdata
Filesize
10KB

MD5
10d635ee5d21f6d8978960e4682f96b5

SHA1
8d299669571edc57e9bf3ea69b7c9ae440466df4

SHA256
a099769d59f40522e92ad0e0df44de2ee23307d2a2c1dd5a38d85bd93d640d1d

SHA512
f8777be46871e18f11cbcc56b45a53d6957534ff440ea6ddf7a999be9e575bbc731319044e839a4881b03a702fe05a54da1a2067e45493e6719ba7eecdd0d6fe

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Animations.rxdata
Filesize
133KB

MD5
76dae0e4b0b895136d8591013aa822c9

SHA1
fd7a84f38f5fa091f0ba33372ae489177e9e0e05

SHA256
a16c5a1cea3316ff3863cc3853ff3307f92abc52a65b64bfa1f71cc851df0262

SHA512
5e4d72f7a6184fec360d6e3d6b93e755d368a0408567593a11a52c978f20b0f65d1b340b474776e006def1f66909fa4a96bce805716d68d3a7360c823e4878ce

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Armors.rxdata
Filesize
4KB

MD5
78bd65bcf563e1ff1a893aff33a399f2

SHA1
ae02dac32535b6f5e0f0a3d4306cd735bd7b0942

SHA256
eacccfbac03a12c2a23a7eaf33087ce7748d53a8c2e804380a18e14962ee32ab

SHA512
4d77d8bef9a588db388c2d0b7e65fc4fb2e00fe7d9c793326bbdecac27158ca11c0f2731068f7c494b633c879adb9a627f6c60503c4058814be3d1cd41c9a87f

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Classes.rxdata
Filesize
2KB

MD5
e92a564eeaac6bbe8d05e4aaa7b204f9

SHA1
c79b337da270457c7c928c5a556c91487deb7eaf

SHA256
bbbee36db659864740fa0230a6ef41dabe729ee8d8edc610d7925ea1210d0a1a

SHA512
a4bbe06ade17ec9c88dea9408fbb6f7a30233607ea900c21bc5b58f7095657fd9ec68ee986fcdd3539d03b4ba3ac4a8229bb1a50ce5c8a16e52007ecd6c3a7dd

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\CommonEvents.rxdata
Filesize
132B

MD5
33d714659b70225011dc4e75a072a2cb

SHA1
badd54b13348bef1299890f986734372b21128a7

SHA256
a645fd83f651873e3f807c8b002523f3a140bf0e7ba5bfabdaa805a40723fe5f

SHA512
a9b8e3c3930f991d486054c4a56a2968044a0a3c53f0b735cd7629e6509e943576c55d51e023480e2643838e1654d51b70038af10b0ffc8e8b8ffd7053473e95

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Enemies.rxdata
Filesize
10KB

MD5
ec6fb34d02af772aed850ac5629c4424

SHA1
33e8d255a8649f1f71540381e3085e6e91efdaf5

SHA256
0802c4aa1d90584d7af059ca9d5d22ce64109068af53130c3fa627459fac69ec

SHA512
93e0d528fc68079035adc43f220341a58f51da7e28df327106c5b5514f4e74055e828759dbb69b2d6e400025da7a5f1460c635a7088908394b27f5e23785290a

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Items.rxdata
Filesize
5KB

MD5
0672885d9f5dcea988c1b87ec2b992a0

SHA1
5328b7aac1c26315d2eb07c73fd0b9f8675f90eb

SHA256
e11ced3cd02109d98a7a2361f27af2a67642e6bace3a012f3cf0b486cc603553

SHA512
d058ba009204f0ee6d3ebaf5de2249e58047d129557398fe54b5d4bdd19b6b1112da5c2fa5a1d8c69c02dc27be0daa3394107e3ef98306f6568012d52b98786e

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Map001.rxdata
Filesize
1KB

MD5
7830c6d19e97e16edfe0b33cdabce7c6

SHA1
65f27016ac0059cab5ccc96857eaac445f246cab

SHA256
77539c2ef77df5087eb839de2a1a749aed72f50720498385de5bf3e2626fe151

SHA512
ad57065024bfbb3f8f8f8c0dd7e1a6eb5114b2f99440d8888ec2dbd6e926043d2d61a16f7f361f689a06b19ddba854369ef47d060452b7879e984c656d2bd7ac

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\MapInfos.rxdata
Filesize
102B

MD5
458415d2a30dd8d904febdbb4366570a

SHA1
fa2dd7e70d1ed96e4fefbf11085d483f630e29f4

SHA256
040a47d5a080c73202b28610b5166598380cacefbe4581b8fdb4aa66fe939991

SHA512
befe2287424f164eb3b996065c1a20fe3455618751b6b3e5128e6bca1fa860ba8b9b6ebca2ba6a8db97ce0695645200b3fe5ee4674010b47e5090f2420ca9061

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Scripts.rxdata
Filesize
106KB

MD5
2d9ce7bc566313d2884312e14012c93a

SHA1
59c77d04eb1b17aea4dd649d50d886c91261aae5

SHA256
af503820428e97276b98223ea2b8a0450001404f64d4c32019d5712944aee8a6

SHA512
4bebb034b7739b87a64010f842486dd628a6f519e1d012256a64f228158d4f7ef0b2b60126f266bacf7a46f173dd6e0a1ed6f9e4aa03b30b431cf9b324fab2de

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Skills.rxdata
Filesize
13KB

MD5
bf7754da3fe9253bc3d55da8bd63e039

SHA1
dfb68914bf225865fabd925facc3e8bc4c50ae2a

SHA256
83ff7e87dd99850b500e865fb71edae8f169bc2fb39dd1b79db58bba76d75742

SHA512
c6337b681676cd6652bc9387fe111c669d70ec1cabd3a88888f4da0358c760a91fd159a496bc6b6db832f9022538016520338fa7d94817a5a10d0df95a1b57cd

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\States.rxdata
Filesize
2KB

MD5
95a3f35213e74266beb29df36a0b1079

SHA1
10e70a22117cbc425e09c1fe6e81e148820d5723

SHA256
708662c054a65a5bf4bbc33bddb33620e601d1b03cc14fc12a4950f432c4680b

SHA512
c8a4f0dbd8e22c9a5ac9446357a57bd3ab6444eb0cd2dff50b3349e964a2693cbe42265eca9ad640e3043a5f8d01c93b3f904b17e22cb2875829405aa5d2dd7c

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\System.rxdata
Filesize
1KB

MD5
85d4f483d350172c804b2b133f86b3c5

SHA1
449357395661214c5ae9be18c1a1c654059f310f

SHA256
b927a69e05ec6fe3e76231a9d7fca33b606827078e0c7fd5d915db7710da179e

SHA512
4e4001acaec0404436b3a7f361742ac94a69e830e7daa3f7a378a2a32feb79d28101d18cb419ef919f384c1ae09c48cbf3956cc100f26f7c6516157598427bcd

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Tilesets.rxdata
Filesize
189KB

MD5
9b3e08065326a4ca33f6b7d44fbc2709

SHA1
df1dd63dd9b8a793277e935c48fb1c1591c8292f

SHA256
0050017a0c5b17daabe840790747c83bb42251578a888378b0de158f7bfa7bda

SHA512
8caa96291f1ed6d47402cc52421168340427adb91baaa170af3095c02a20f247ae6cd45f31f04236e4d54d78aa217bb29af48732d8cdacc8ce3d2b6dca97ff4a

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Troops.rxdata
Filesize
5KB

MD5
a6d6845f04492760af55dabbcbe6f893

SHA1
6b347f4f5de9c4834cd2e0a3549130dce060f53a

SHA256
6712e0ff9923b1a61029b375a7d56064169dfe428502c313f8a79b31b41e3a7a

SHA512
6290781e87c1b063ba2293ffd4c6e7e3fdd2b996e3817be80a19d7159b62270982c383b4acef739c0bbe74a2ac7c6db049243c8453ab76849618971bedd28a6d

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Data\Weapons.rxdata
Filesize
3KB

MD5
08269b097a6a8323be92de07e0b6a847

SHA1
8e8f8e46329ff17e6247ace3c91e3b81f67f87d8

SHA256
3786f4e1a7a702dbe103807e0a8897b7b458f73d1b9686f0f0d7b2213b72e907

SHA512
7276cb84e34621828a32d9595ea8d4e522d0c8a71c307f83de383eacfd8a3d2a66a049172fb5f9fdcf0e838fe455d463d8e28ff22f7cda4a77d3b227172543d4

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\System\Game.exe
Filesize
68KB

MD5
c22b8d8acb738776d94ea0cc10277144

SHA1
4dcc713487826be8c67f614d0f90b0ab59d2215c

SHA256
0ed9b5139edb0ad0f0f4b5b88dd0265ddbf56d36d6f173d6a22f3b23e8212e22

SHA512
9d6c734e6fb6edc4d7944345293332c2b9637c67e9abba359553710189d007051e5f0084aa919e70a9d2fa0c328e92c8c06d398074c7d64a255b9227fe4468e2

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\Thumbs.db
Filesize
6KB

MD5
b9a5171151044a4cfd2a8d8779af929f

SHA1
8f9d7bea706cb8432380c4f1f84400d1affbf91d

SHA256
704e1c9e9ee6379e9450c35c32b30099663abdfc9f626e4fe2fa1ac5eca2bffb

SHA512
98ad46b4c396bd5b981f08f568b6fde060ef89a9d7cb16e784edf5ad7e67a982385b444e88aaf65e8c78875f22b0d5616a44ba520c1a9b1592922479713703b2

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-activate.png
Filesize
8KB

MD5
592adc03e205672e8a4f790f685c658f

SHA1
70e40b322ad187e9860d3619edac25d30624d17f

SHA256
aabb33a465c18dcba522190d57100cf3e07107651084275645785625f3f4ff7e

SHA512
c21e1eaee0ced3e57e518bc72c87b9cfa615d84d44081e868dcaa4f5fcb95273028a1ebb7854d7feab098973e066a607d586b537b5ad2ac2a04f88e7048ec03e

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-background.png
Filesize
644KB

MD5
2ecb353c8974f1020d1425dfb8d4f591

SHA1
64b4196b78b4cdba32d8a5f14391861973dbe676

SHA256
614ffaa33a9bf1453dbac9033c941aea534cf12fe89f568344d94217497ac674

SHA512
0b079efff3c97d059eeed87df6433fc3929f18542d700bbee5c4f32ba5e2e216c68cc8403c2d9224cae2cc92550c7e668b1152586db6b8579f4ddaa8fbbbb9df

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-buy-now.png
Filesize
9KB

MD5
ffffdaaf9f1c7c47a4761df64f4ee56b

SHA1
6a3fd89cf56f9341bd872fad778af56f39a418f2

SHA256
c4c87ffce5df52d6acf28a94aa5414fd7305d44825394fe4cb809ca20e6bcf54

SHA512
b19ddd75a6a6d1dc44e70c30a01c7474bed5eab02d366786ef063be756a4993896038f0a368a00b5e383d639005ecf1f2e0f1d4223133b0b40340f8d777d0c2d

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-cancel.png
Filesize
8KB

MD5
f09d55b8cf19610a2627e06dd0952856

SHA1
f8835c697d15c03efeb30cd14fe707ec30fb2675

SHA256
d7fe0116348622b63511cd0527c00914797ac4689e1ac5473b585ed9760aaf14

SHA512
7807cb81efa99c328e5eaf138a1d4d17d15c1f103645ced91cd3afaddc38316d9c71d4b1fc61ece995d6e61c7f37b458c6f78c32d692bb58c69c79e8382756c9

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-continue.png
Filesize
10KB

MD5
ff708a85d46bc03f24dbf1e5119aadab

SHA1
39882cb9b2c82f8d1fbcefe1e0b0b41acbff5205

SHA256
dba7d3497b93f4752169ea3b19ee9a2727aed3dc0f58f722908d77e315851497

SHA512
f1869c1f5f46d8d906cbe142aa4f1b08e21ce388265e80622dbc099ecdc1987709a20546f8b33018cfc4806d8c4eda3e1b4ee1f362a77802bc0eb592e30c3fd4

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-enter-key.png
Filesize
9KB

MD5
93634f19561211768bafeb632327f1eb

SHA1
f281989bd5adb3a581e4d3f1fa7408d8a8e377a4

SHA256
f7c0a0d2ad9afacfeb7cc5a88a1e697a3303d7745b759d66d8d2a2ce98cf919f

SHA512
54d8d703d54fb2b476ae6c3e7acb59237ddda99fe9e89cdbbd7bfa27ef16b55ed0fe93aac8a372ddd89a4dbdb3a08b82c4967267c6a7f881af1dbee3f2ff2ec6

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-key-box.png
Filesize
4KB

MD5
7f1b95225ec76ae446a9f149bd6124f5

SHA1
0c0e5c159facd1a075e1b50b013123fab5ad6706

SHA256
a90e6a055e9b38788ca782a0641a247b58e857bdd91364ac6248d67497b1c817

SHA512
d914061975c0f1debfabe59a0bca8db00a5ac4af96d3f530cbf0cdd02e6e848bc0cff17cddd9436b7d0159671b3e791770b665fafabba89a642304b2b1cd5965

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\drm\drm-unlock.png
Filesize
9KB

MD5
874f7d1c5dbc62eca93226a0a0d1b69e

SHA1
f991c2694e7ad66fef7fedfaf9d5570b06ca52fa

SHA256
9e79ac74da3139c652e8008255d8a19e13c85d0e0347cb173c31d2765e831810

SHA512
fc88aafe33f09022afe9caabe7d749526444f9f000f0f8ab0998cc395959d0057f8209e1ad520c5be829b0f2e1d0fb3cc4db3892ac987205ef11828d3afa8403

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\unins000.dat
Filesize
7KB

MD5
de911270ef3adfb2d6a4bedef5a083d2

SHA1
882982d2e8f0b61f8cc6adb98c8f9e7f3d40a3af

SHA256
72f1c22c0f1a6805f5123128729a914a7566a2ca273dcfabf0fab68db08eada9

SHA512
15e516143ca61780d4841c61eaa61e96884559053839a47e92dc0b36f7705e87270dcbcbb856a8a95936c288c9f523959cbccc920f35c76a6ed7d70696f6cc32

Download Submit
C:\Program Files (x86)\Enterbrain\RPGXP\unins000.exe
Filesize
1.1MB

MD5
6c75c2c4417b872e059a60dcd7ffab44

SHA1
390c5c7fbc44b35c2e79cf679d1dac3c88c5e5ff

SHA256
07dc8c7a636032a0cbe18e33c320718bed321b4e0622284d44b62a57e5af1e9d

SHA512
b58c739e578459d1967db7857bc3451bf28f8e609611d7f6d33c6a7adf2edfbb59b3bdfb9e30ce13792a4b4593deb840098eb4aeb5ec45d75a81bc9aa3160c2d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RPG Maker XP\RPG Maker XP Help.lnk
Filesize
1KB

MD5
f88602d8c0e5218bbcbf984511033c67

SHA1
b3c32db0eead1d49b259e98b0cdfee8b007ac558

SHA256
f6047bb8d28b531c4591162e8aaaac241f22261b51e6d3d80d65321aff486864

SHA512
f2c489ac1806008db43253e6c439d2b3e14b398c4951f777e836d946681f6107e0b56cada1065a81cb97833b1a0a131a8d73a0a291a4bd1f231ffd5421d89335

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RPG Maker XP\RPG Maker XP.lnk
Filesize
1KB

MD5
0849605babe8e9ca19c78f155947595c

SHA1
3fdcd56e0f1a059490a361bdba69ee2900017192

SHA256
d23dfd995f98222ee8a6fdc29958170d3dabbdc32816f29a4b14631e63188ae8

SHA512
ca573e7911dfbb403610570ff92bacde2032ec7be39bd79d52e2e081d7bb81c8e4abd24c40961870b4646989186590ea2dcbe678431a1189663f0aec721fa6f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\HTMB2AE.tmp
Filesize
3KB

MD5
7741ca655eae3de3edd79b3ff5c09091

SHA1
e51c78456b97069163d2151bb05b47be9d9063cc

SHA256
88e77e4d914a55963121af6ebdeb47adac43ffd5997beb0cfeb20047bb9f6cfc

SHA512
8bc9e1e0432942d97d3cb301c5138bf10107ca91d9a613747a645af9a22525ca1d135d64984d7cd4ff7764894cc7b9929dc86ddf4e43ce53156ddf02f23cfabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRIFA.tmp\xp_rtp104e.exe
Filesize
21.9MB

MD5
611881d2a5b8825df189616e7a2760f3

SHA1
2a907a5371d27dbf80cd9efc399fff76109a3968

SHA256
b3bd20ad7f413b40ac233aafd2e061de1dc429c2eadb59d0b3157ba3c47f16b2

SHA512
d79d8f57f8219574723239c0091068db64d2304e6b7495187247397491371e8761e711d027cab36bd08cbf86a1bf805dfbfeaff910f6b49458ff9c0c5872af23

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I4PLM.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MBTEM.tmp\xp_rtp104e.tmp
Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T91ML.tmp\RPGXP_E.tmp
Filesize
1.1MB

MD5
63b15124be653dbe589c7981da9d397c

SHA1
af8874bdf2ad726f5420e8132c10becc2bbcd93c

SHA256
61674b90891ca099d5fee62bf063a948a80863530ab6a31e7f9e06f0e5bc7599

SHA512
339b284b5dd7386dcfa86c8fdcf239a0e97cc168229ea9a66fc0c6b26771401fa7f27c2c6a435a836a43ea9c7e634a3e47ec77e0d27985794bbb4416dfc97ac8

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/1276-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1276-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1276-1918-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1276-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1492-1919-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1492-1929-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1904-1913-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1904-107-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1904-103-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1904-1909-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1904-125-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2836-1914-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2836-106-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2836-91-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2836-93-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3196-2086-0x00000000043B0000-0x00000000045B4000-memory.dmp

Filesize
2.0MB

Download
memory/3196-2064-0x00000000043B0000-0x00000000045B4000-memory.dmp

Filesize
2.0MB

Download
memory/3196-2099-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/3196-2055-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/3196-2056-0x00000000043B0000-0x00000000045B4000-memory.dmp

Filesize
2.0MB

Download
memory/3196-2060-0x00000000043B0000-0x00000000045B4000-memory.dmp

Filesize
2.0MB

Download
memory/3852-2091-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3852-2041-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3908-2092-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4668-1930-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4668-2090-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4944-7-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4944-1917-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4944-13-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4944-15-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4944-17-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4944-105-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download