Malwagon
EXE
setup.exe File Analysis · first seen Oct 23, 2026 20:31 · 4.8 MB
8proc 108files 35reg 15drops 32IOCs
Suspicious60 Completed Public
Get sample Report Sign in

setup.exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

36.2sto launch
339telemetry events
186observed
79agent notes

Suspicious

60/100

25 points past the suspicious line at 35, 10 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+36
Static analysis
  • Packed (Inno Setup, confidence 40)
  • 2 high-risk capability(ies): sandbox evasion, token manipulation
  • 4 supporting capabilities in one unsigned binary: file discovery, obfuscation, registry query, system information
  • 1 high-risk capability bucket(s): Privilege escalation
  • Weak exploit-mitigation posture (no ASLR/DEP/CFG) and unsigned
+24
Runtime behavior
  • Dropped an executable to disk (+1 more runtime behavior)
+0
Model review
  • findings review (advisory, not scored): suspicious - installer drops dlls and executables, timestomping, anti-analysis timing loop, packed inno setup

Model reading

Measured SUSPICIOUS60 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score
Dynamic ran moved the score
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution139s
Guest hardware2 vCPU4095 MB RAM

Detection signatures

13 detected · 5 withheld as common
Severity Detection Evidence Layer
MED
Anti-analysis strings present
MITRE T1497
string qemu matched string
static
MED
Disables WOW64 FS redirection (evasion)
MITRE T1497
string wow64disablewow64fsredirection found in the sample's strings
static
MED
Dropped an executable to disk
MITRE T1105
file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_shfoldr.dll dropped
file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_iscrypt.dll dropped
file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\ISDone.dll dropped
file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll dropped
dynamic
MED
Executes external code / commands
MITRE T1059
confirmed at runtime, seen in 30% of benign software statically
capability createprocessw capability: execution
capability system capability: execution
static
MED
Forces reboot/shutdown (post-impact)
MITRE T1529
import user32.dll!ExitWindowsEx
static
MED
Packed with Inno Setup
MITRE T1027.002
packer Inno Setup packer identification
entropy 7.96 file entropy (8.0 = random)
static
MED
TLS callback (pre-main execution)
MITRE T1055
pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point
static
MED
Timestomping
runtime timestomping observed in the guest
dynamic
MED
Weak exploit mitigations and unsigned
MITRE T1027
mitigation posture: weak
signature unsigned
static
LOW
Adjusts token privileges (SeDebug / escalation)
MITRE T1134
seen in 8% of benign software
import advapi32.dll!AdjustTokenPrivileges
static
LOW
Checks free disk space (sandbox sizing check)
MITRE T1497.001
seen in 6% of benign software
import kernel32.dll!GetDiskFreeSpaceW
static
LOW
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
import kernel32.dll!VirtualProtect requires virtualprotect
import kernel32.dll!VirtualAlloc requires virtualalloc
static
LOW
Spawns child processes
MITRE T1106
seen in 16% of benign software
import kernel32.dll!CreateProcessW
static
Withheld: 5 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
Dynamic API resolution (obfuscation) fires on 65% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Reads its own startup info (parent/desktop check) fires on 36% of benign software
Queries system information (host recon) fires on 25% of benign software

What the tests returned

7 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Network connectionsnot tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection
Anti-analysis / evasion checksnone above the reporting threshold - the anti-analysis calls this run did make are listed with their counts

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Observed. Observed at runtime and attributed to this sample by one layer. The one fact that decided it: payload written to disk.

Instrument coverage

3 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch measured Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
API call sequence measured Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else.
Explicit module loads measured Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts.
Network capture not on this plan Not included on this scan's plan.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Inno Setup Module(5.5.0)[unicode]
Packed Unsigned
CompilerEmbarcadero Delphi(2009-2010)[Enterprise]
LinkerTurbo Linker(2.25*,Delphi)[GUI32]
InstallerInno Setup Module(5.5.0)[unicode]
Identity
File
typeexecutable
size4.8 MB
file arch32-bit (x86)
subsystemGUI
entropy7.9593
date2014-07-09 07:58:13 UTC
version
descriptionCastle of Illusion HD MULTi8 - ElAmigos Setup
productCastle of Illusion HD MULTi8 - ElAmigos
languageEN, NEU, NL

Antivirus engine

no signature matched signature set 28162 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28162
Signatures in the set3,642,894
Set published23 Oct 2026 06:24 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

8.1 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 8.1 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural featureWhat it meansPushesWeight
parser warning: Suspicious flags set for section... Header defect reported by the parse: Suspicious flags set for section... (0) towards benign -0.8178
resource directory size Size of the resource table (415300) towards benign -0.4962
feature column 993 Byte randomness of the data appended after the last section towards benign -0.4577
image flag dll Image flag: a library rather than a program towards malicious +0.3547
import comctl32.dll:InitCommonControls Calls InitCommonControls from comctl32.dll towards benign -0.2800
file size Size of the file (5002099) towards benign -0.2789
feature column 2478 When a timestamp authority countersigned the signature towards malicious +0.2616
optional.checksum Header checksum, which is zero on most files that were never signed (0) towards malicious +0.2607

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing
Packed with Inno Setup
Packed code is compressed or encrypted on disk and only appears once the sample runs.
installer
40/100
packer confidence
Detonation is the reliable read here A packed file hides its behaviour from a static pass, so the verdict leans on what it does when it runs.
Evidence 3 signals
  • High-entropy overlay (8.0, 4512627 bytes)
  • Marker 'Inno Setup' (Inno Setup)
  • TLS callback present

Family configuration search

Incomplete

1 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available69
Returned a result2
Failed to decode1

Secrets & malicious strings

1 flagged string

Flagged string categories

anti-analysis / evasion med 1 hit
IndicatorFound inEvidence from the sample
qemu raw bytes present in the file bytes only

Capabilities

7 behaviour buckets · 1 high-risk
SeverityCapabilityMITREAPIs
high Privilege escalation
Adjusts tokens / privileges
 T1134, T1134.001 adjusttokenprivileges, openprocesstoken
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497.003 gettickcount, queryperformancecounter, sleep
med Code execution
Creates processes / runs commands or shellcode
 T1059, T1106 createprocessw, system
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress, loadlibraryw
med Ransomware behaviour
Enumerates + encrypts files, deletes backups
 T1083 findfirstfilew
med System shutdown / reboot
Reboots or shuts down the host
 T1529 exitwindowsex
low Discovery
Enumerates the host, users, processes or network
 T1082 getsysteminfo

Security mitigations

weak posture
OFF ASLR (DynamicBase)
OFF High-entropy ASLR (64-bit)
OFF DEP / NX (NxCompat)
OFF Control Flow Guard
? SafeSEH
? Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Atypical for a benign modern build - common in packed/repacked malware.

Sections

8 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.text
Executable code
 0x1000
60.5 KB
60.3 KB
EXECUTEREAD
6.3915
.itextEP
Initialisation code
 0x11000
3.0 KB
2.8 KB
EXECUTEREAD
5.7321
.data
Initialised data
 0x12000
3.5 KB
3.1 KB
READWRITE
2.2463
.bss
Uninitialised data
 0x13000
0.0 B
21.7 KB
READWRITE
0.0
.idata
Import table
 0x19000
3.5 KB
3.5 KB
READWRITE
4.9719
.tls
Thread-local storage
 0x1a000
0.0 B
8.0 B
READWRITE
0.0
.rdata
Read-only data
 0x1b000
512.0 B
24.0 B
READ
0.2045
.rsrc
Resources
 0x1c000
406.0 KB
408.0 KB
READ
6.65
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

120 funcs / 11 DLLs · 14 suspicious
▸oleaut32.dll3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
SysFreeString 0x000192fc - -
SysReAllocStringLen 0x00019300 - -
SysAllocStringLen 0x00019304 - -
▸advapi32.dll3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
RegQueryValueExW 0x0001930c - -
RegOpenKeyExW 0x00019310 - -
RegCloseKey 0x00019314 - -
▸user32.dll4 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetKeyboardType 0x0001931c - -
LoadStringW 0x00019320 - -
MessageBoxA 0x00019324 - -
CharNextW 0x00019328 - -
▸kernel32.dll32 funcs 5 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetACP 0x00019330 - -
Sleep 0x00019334 - -
VirtualFree 0x00019338 - -
VirtualAlloc 0x0001933c - T1055
GetSystemInfo 0x00019340 - -
GetTickCount 0x00019344 - T1497
QueryPerformanceCounter 0x00019348 - T1497
GetVersion 0x0001934c - -
GetCurrentThreadId 0x00019350 - -
VirtualQuery 0x00019354 - -
WideCharToMultiByte 0x00019358 - -
MultiByteToWideChar 0x0001935c - -
lstrlenW 0x00019360 - -
lstrcpynW 0x00019364 - -
LoadLibraryExW 0x00019368 - -
GetThreadLocale 0x0001936c - -
GetStartupInfoA 0x00019370 - -
GetProcAddress 0x00019374 - T1129
GetModuleHandleW 0x00019378 - -
GetModuleFileNameW 0x0001937c - -
GetLocaleInfoW 0x00019380 - -
GetCommandLineW 0x00019384 - -
FreeLibrary 0x00019388 - -
FindFirstFileW 0x0001938c - T1083
FindClose 0x00019390 - -
ExitProcess 0x00019394 - -
WriteFile 0x00019398 - -
UnhandledExceptionFilter 0x0001939c - -
RtlUnwind 0x000193a0 yes -
RaiseException 0x000193a4 - -
GetStdHandle 0x000193a8 - -
CloseHandle 0x000193ac - -
▸kernel32.dll4 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
TlsSetValue 0x000193b4 - -
TlsGetValue 0x000193b8 - -
LocalAlloc 0x000193bc - -
GetModuleHandleW 0x000193c0 - -
▸user32.dll13 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
CreateWindowExW 0x000193c8 - -
TranslateMessage 0x000193cc - -
SetWindowLongW 0x000193d0 - -
PeekMessageW 0x000193d4 - -
MsgWaitForMultipleObjects 0x000193d8 - -
MessageBoxW 0x000193dc - -
LoadStringW 0x000193e0 - -
GetSystemMetrics 0x000193e4 - -
ExitWindowsEx 0x000193e8 - -
DispatchMessageW 0x000193ec - -
DestroyWindow 0x000193f0 - -
CharUpperBuffW 0x000193f4 - -
CallWindowProcW 0x000193f8 - -
▸kernel32.dll53 funcs 6 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
WriteFile 0x00019400 - -
WideCharToMultiByte 0x00019404 - -
WaitForSingleObject 0x00019408 - -
VirtualQuery 0x0001940c - -
VirtualProtect 0x00019410 - T1055
VirtualFree 0x00019414 - -
VirtualAlloc 0x00019418 - T1055
SizeofResource 0x0001941c - -
SignalObjectAndWait 0x00019420 - -
SetLastError 0x00019424 - -
SetFilePointer 0x00019428 - -
SetEvent 0x0001942c - -
SetErrorMode 0x00019430 - -
SetEndOfFile 0x00019434 - -
ResetEvent 0x00019438 - -
RemoveDirectoryW 0x0001943c - -
ReadFile 0x00019440 - -
MultiByteToWideChar 0x00019444 - -
LockResource 0x00019448 - -
LoadResource 0x0001944c - T1129
LoadLibraryW 0x00019450 - T1129
GetWindowsDirectoryW 0x00019454 - -
GetVersionExW 0x00019458 - -
GetUserDefaultLangID 0x0001945c - -
GetThreadLocale 0x00019460 - -
GetSystemInfo 0x00019464 - -
GetStdHandle 0x00019468 - -
GetProcAddress 0x0001946c - T1129
GetModuleHandleW 0x00019470 - -
GetModuleFileNameW 0x00019474 - -
GetLocaleInfoW 0x00019478 - -
GetLastError 0x0001947c - -
GetFullPathNameW 0x00019480 - -
GetFileSize 0x00019484 - -
GetFileAttributesW 0x00019488 - -
GetExitCodeProcess 0x0001948c - -
GetEnvironmentVariableW 0x00019490 - -
GetDiskFreeSpaceW 0x00019494 - -
GetCurrentProcess 0x00019498 - -
GetCommandLineW 0x0001949c - -
GetCPInfo 0x000194a0 - -
InterlockedExchange 0x000194a4 - -
InterlockedCompareExchange 0x000194a8 - -
FreeLibrary 0x000194ac - -
FormatMessageW 0x000194b0 - -
FindResourceW 0x000194b4 - -
EnumCalendarInfoW 0x000194b8 - -
DeleteFileW 0x000194bc - -
CreateProcessW 0x000194c0 - T1106
CreateFileW 0x000194c4 - -
CreateEventW 0x000194c8 - -
CreateDirectoryW 0x000194cc - -
CloseHandle 0x000194d0 - -
▸advapi32.dll5 funcs 2 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
RegQueryValueExW 0x000194d8 - -
RegOpenKeyExW 0x000194dc - -
RegCloseKey 0x000194e0 - -
OpenProcessToken 0x000194e4 - T1134
LookupPrivilegeValueW 0x000194e8 - T1134
▸comctl32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
InitCommonControls 0x000194f0 - -
▸kernel32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
Sleep 0x000194f8 - -
▸advapi32.dll1 func 1 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
AdjustTokenPrivileges 0x00019500 - T1134

Binary metadata

what the headers declare about this build
Resource langsENNEUNL
Debug infono
TLS callbacksyes

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Capability detection

43 capabilities
list is incomplete here

The capability analysis reports that this file is an installer, so the capabilities below are mostly its installer stub's, not the payload's.

Read what follows as the capabilities of the code that could be read, not of the file as a whole.

CapabilityNamespace
link function at runtime on Windows linking/runtime-linking
create or open file -
calculate modulo 256 via x86 assembly -
modify access privileges host-interaction/process/modify
create process on Windows host-interaction/process/create
allocate memory -
allocate or change RW memory -
delay execution -
generate random numbers using the Delphi LCG data-manipulation/prng/lcg
create or open registry key -
encode data using XOR data-manipulation/encoding/xor
get file attributes host-interaction/file-system/meta
create process suspended host-interaction/process/create
change memory protection -
allocate or change RWX memory host-interaction/process/inject
contain loop -
query or enumerate registry value host-interaction/registry
write file on Windows host-interaction/file-system/write
terminate process host-interaction/process/terminate
get geographical location collection
set thread local storage value host-interaction/thread/tls
get thread local storage value host-interaction/process
get disk size host-interaction/hardware/storage
get OS version -
query environment variable host-interaction/environment-variable
accept command line arguments host-interaction/cli
get common file path host-interaction/file-system
clear file content host-interaction/file-system/write
hash data with CRC32 data-manipulation/checksum/crc32
delete file host-interaction/file-system/delete
create directory host-interaction/file-system/create
shutdown system host-interaction/os
check if file exists host-interaction/file-system/exists
identify system language via API targeting/language
get system information on Windows host-interaction/os/info
extract resource via kernel32 functions executable/resource
delete directory host-interaction/file-system/delete
reference analysis tools strings anti-analysis
compiled with Borland Delphi compiler/delphi
reference anti-VM strings targeting Qemu anti-analysis/anti-vm/vm-detection
packaged as an Inno Setup installer executable/installer/inno-setup
contain a thread local storage (.tls) section executable/pe/section/tls
ATT&CK techniques
Defense Evasion::Obfuscated Files or Information [T1027]Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]Discovery::File and Directory Discovery [T1083]Discovery::Query Registry [T1012]Discovery::System Information Discovery [T1082]Discovery::System Location Discovery [T1614]Discovery::System Location Discovery::System Language Discovery [T1614.001]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]Impact::System Shutdown/Reboot [T1529]Privilege Escalation::Access Token Manipulation [T1134]
Malware Behavior Catalog
Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionAnti-Behavioral Analysis::Virtual Machine DetectionCryptography::Generate Pseudo-random SequenceData::Checksum::CRC32Data::Encode Data::XORData::ModuloDefense Evasion::Obfuscated Files or Information::Encoding-Standard AlgorithmDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create DirectoryFile System::Create FileFile System::Delete DirectoryFile System::Delete FileFile System::Get File AttributesFile System::Writes FileMemory::Allocate MemoryMemory::Change Memory ProtectionOperating System::Registry::Create Registry KeyOperating System::Registry::Open Registry KeyOperating System::Registry::Query Registry ValueProcess::Create ProcessProcess::Create Process::Create Suspended ProcessProcess::Set Thread Local Storage ValueProcess::Terminate Process

Signature matches

0 findings · 5 file properties · 0 scored
File properties
IsPE32IsWindowsGUIIsPackedHasOverlayborland_delphi

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

No signature rule identified a threat in this file.

Extracted strings

showing 200 of 530
  • This program must be run under Win32
  • .text
  • `.itext
  • `.data
  • .bss
  • .idata
  • .tls
  • .rdata
  • @.rsrc
  • AnsiChar
  • string(
  • AnsiString
  • TObject
  • FastMM Borland Edition (c) 2004 - 2008 Pierre le Riche / Professional Software Development
  • An unexpected memory leak has occurred.
  • The unexpected small block leaks are:
  • The sizes of unexpected leaked medium and large blocks are:
  • bytes:
  • UnicodeString
  • Unexpected Memory Leak
  • Xthf
  • PPRTj
  • SPRQ
  • t.Ht
  • 0123456789ABCDEF
  • GetLongPathNameW
  • Uhoi@
  • ExceptionLm@
  • EAbort
  • EHeapException
  • EOutOfMemory
  • EInOutError
  • EExternal
  • EExternalException
  • EIntError
  • EDivByZero
  • ERangeError$q@
  • EIntOverflow
  • EMathError
  • EInvalidOp
  • EZeroDivide
  • EOverflow
  • EUnderflow
  • EInvalidPointer t@
  • EInvalidCast
  • EConvertError
  • EAccessViolation
  • EPrivilege
  • EStackOverflow
  • EControlC
  • EVariantError
  • EAssertionFailed
  • EAbstractError
  • EIntfCastError
  • ESafecallException
  • EMonitor
  • EMonitorLockException
  • ENoMonitorSupportException
  • SysUtils
  • TEncoding
  • TErrorRec
  • TExceptRec
  • TUnitHashArray
  • TModuleInfo
  • WVUSj
  • TCustomFile
  • TFile
  • EFileError
  • ECompressError
  • ECompressDataError
  • ECompressInternalError
  • TCustomDecompressor
  • TCompressedBlockReader
  • TLZMA1SmallDecompressorS
  • TSetupHeader
  • TSetupLanguageEntry=
  • SetDllDirectoryW
  • SetSearchPathMode
  • SetProcessDEPPolicy
  • Error
  • Runtime error at 00000000
  • Inno Setup Setup Data (5.5.0) (u)
  • Inno Setup Messages (5.5.3) (u)
  • oleaut32.dll
  • SysFreeString
  • SysReAllocStringLen
  • SysAllocStringLen
  • advapi32.dll
  • RegOpenKeyExW
  • user32.dll
  • GetKeyboardType
  • LoadStringW
  • MessageBoxA
  • CharNextW
  • kernel32.dll
  • GetACP
  • Sleep
  • VirtualAlloc
  • GetSystemInfo
  • GetTickCount
  • QueryPerformanceCounter
  • GetVersion
  • GetCurrentThreadId
  • WideCharToMultiByte
  • MultiByteToWideChar
  • lstrlenW
  • lstrcpynW
  • LoadLibraryExW
  • GetThreadLocale
  • GetStartupInfoA
  • GetProcAddress
  • GetModuleHandleW
  • GetModuleFileNameW
  • GetLocaleInfoW
  • GetCommandLineW
  • FreeLibrary
  • FindFirstFileW
  • FindClose
  • ExitProcess
  • WriteFile
  • UnhandledExceptionFilter
  • RtlUnwind
  • RaiseException
  • GetStdHandle
  • CloseHandle
  • TlsSetValue
  • TlsGetValue
  • LocalAlloc
  • CreateWindowExW
  • TranslateMessage
  • SetWindowLongW
  • PeekMessageW
  • MsgWaitForMultipleObjects
  • MessageBoxW
  • GetSystemMetrics
  • ExitWindowsEx
  • DispatchMessageW
  • DestroyWindow
  • CharUpperBuffW
  • CallWindowProcW
  • WaitForSingleObject
  • VirtualProtect
  • SizeofResource
  • SignalObjectAndWait
  • SetLastError
  • SetFilePointer
  • SetEvent
  • SetErrorMode
  • SetEndOfFile
  • ResetEvent
  • RemoveDirectoryW
  • ReadFile
  • LockResource
  • LoadResource
  • LoadLibraryW
  • GetWindowsDirectoryW
  • GetVersionExW
  • GetUserDefaultLangID
  • GetLastError
  • GetFullPathNameW
  • GetFileSize
  • GetFileAttributesW
  • GetExitCodeProcess
  • GetEnvironmentVariableW
  • GetDiskFreeSpaceW
  • GetCurrentProcess
  • GetCPInfo
  • InterlockedExchange
  • InterlockedCompareExchange
  • FormatMessageW
  • FindResourceW
  • EnumCalendarInfoW
  • DeleteFileW
  • CreateProcessW
  • CreateFileW
  • CreateEventW
  • CreateDirectoryW
  • OpenProcessToken
  • LookupPrivilegeValueW
  • comctl32.dll
  • InitCommonControls
  • AdjustTokenPrivileges
  • ZFEI
  • tYXjcED
  • oLLLLL
  • cGEhaAB
  • XXRss
  • SetupLdr
  • RedirFunc
  • UTypes
  • SysInit
  • System
  • 7PathFunc
  • eCharacter
  • KWindows
  • "RTLConsts
  • Math
  • SysConst
  • YStrUtils
  • ImageHlp

Stack and decoded strings were not recovered: no reason was recorded. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x4113bc55pushebp
0x4113bd8becmovebp, esp
0x4113bf83c4a4addesp, -0x5c
0x4113c253pushebx
0x4113c356pushesi
0x4113c457pushedi
0x4113c533c0xoreax, eax
0x4113c78945c4movdword ptr [ebp - 0x3c], eax
0x4113ca8945c0movdword ptr [ebp - 0x40], eax
0x4113cd8945a4movdword ptr [ebp - 0x5c], eax
0x4113d08945d0movdword ptr [ebp - 0x30], eax
0x4113d38945c8movdword ptr [ebp - 0x38], eax
0x4113d68945ccmovdword ptr [ebp - 0x34], eax
0x4113d98945d4movdword ptr [ebp - 0x2c], eax
0x4113dc8945d8movdword ptr [ebp - 0x28], eax
0x4113df8945ecmovdword ptr [ebp - 0x14], eax
0x4113e2b82c004100moveax, 0x41002c
0x4113e7e8e851ffffcall0x4065d4
0x4113ec33c0xoreax, eax
0x4113ee55pushebp
0x4113ef689e1a4100push0x411a9e
0x4113f464ff30pushdword ptr fs:[eax]
0x4113f7648920movdword ptr fs:[eax], esp
0x4113fa33d2xoredx, edx
0x4113fc55pushebp
0x4113fd685a1a4100push0x411a5a
0x41140264ff32pushdword ptr fs:[edx]
0x411405648922movdword ptr fs:[edx], esp
0x411408a1485b4100moveax, dword ptr [0x415b48]
0x41140de816d8ffffcall0x40ec28
0x411412e865d3ffffcall0x40e77c
0x411417803ddc2a410000cmpbyte ptr [0x412adc], 0
0x41141e740cje0x41142c
0x411420e82bd9ffffcall0x40ed50
0x41142533c0xoreax, eax
0x411427e88032ffffcall0x4046ac
0x41142c8d55ecleaedx, [ebp - 0x14]
0x41142f33c0xoreax, eax
0x411431e8e2a3ffffcall0x40b818
0x4114368b55ecmovedx, dword ptr [ebp - 0x14]
0x411439b850864100moveax, 0x418650
0x41143ee85538ffffcall0x404c98
0x4114436a02push2
0x4114456a00push0
0x4114476a01push1
0x4114498b0d50864100movecx, dword ptr [0x418650]
0x41144fb201movdl, 1
0x411451a13cbf4000moveax, dword ptr [0x40bf3c]
0x411456e8cdacffffcall0x40c128
0x41145ba354864100movdword ptr [0x418654], eax
0x41146033d2xoredx, edx
0x41146255pushebp
0x41146368061a4100push0x411a06
0x41146864ff32pushdword ptr fs:[edx]
0x41146b648922movdword ptr fs:[edx], esp
0x41146ee889d8ffffcall0x40ecfc
0x411473a35c864100movdword ptr [0x41865c], eax
0x411478a15c864100moveax, dword ptr [0x41865c]
0x41147d83780c01cmpdword ptr [eax + 0xc], 1
0x4114817548jne0x4114cb
callbranchretstackarithregisterimmediatememory

Installer package analysis

21 packaged files
Packagescript-driven installer (setup data 5.5.0 (unicode))
NameCastle of Illusion HD MULTi8 - ElAmigos 5.5.0
Contents listed21 entries · 21 unpacked to a temporary path
Password protectedno
Languages
englishfrenchitaliangermanspanishpolishczechjapanese
What stands out
1 executable land in the temporary directory11 libraries land in the temporary directoryevery contained file is dropped to the temporary directory rather than installed
Packaged contents (21)
PathSizeDigest
tmp/issi_splash.bmp temporary 447 KiB 75009ce51783d270a25…
tmp/English.ini temporary 15.4 KiB a7953fe1bf71d900997…
tmp/unarc.dll temporary 320 KiB 8e2e6d6855095cc032e…
tmp/ISDone.dll temporary 452 KiB 7f17e5e1b088fc73690…
tmp/records.inf temporary 2 B ba8ab5a0280b953aa97…
tmp/CLS-MSC.dll temporary 334 KiB 2ed842e3244992dc2d5…
tmp/arc.ini temporary 352 B fd5c70053fb0d6f4f27…
tmp/cls.ini temporary 65 B 3e2e56189742a4c64d9…
tmp/facompress.dll temporary 355 KiB 9aa415b9e8039caf6e0…
tmp/facompress_mt.dll temporary 204 KiB 0cedf5289c102e75554…
tmp/CLS-precomp.dll temporary 4.68 KiB 3b994a996a932a434e2…
tmp/packjpg_dll.dll temporary 9.35 KiB 469dfb916a2cde41134…
tmp/precomp.exe temporary 753 KiB 1c4cd17a1c82b99df12…
tmp/zlib1.dll temporary 58.5 KiB 2acfa98d5f4bf8b2adf…
tmp/wintb.dll temporary 16 KiB a4fa6bdd2fe146fda2e…
tmp/callbackctrl.dll temporary 4 KiB 8d5fd0a741dd3fd8465…
tmp/1.ico temporary 1.12 KiB f76b792473face8303d…
tmp/2.ico temporary 1.12 KiB 34ec6d797a3ada1a90a…
tmp/3.ico temporary 1.37 KiB 76fc86e7453a376e66f…
tmp/4.ico temporary 1.12 KiB 1e28ad988dc0b22f19f…
tmp/CLS-srep.dll temporary 85.5 KiB e04def966208b662eed…

Import fingerprint

no related sample
Fingerprint48:o4/c+4QjuC5Q4FNO0MeAXGo4E/gjF5J/RscZr91budS19WOG/iB:oc94A5TNO0MHYZrHeS1oXiB
Imports read120 functions from 5 libraries (98 distinct)
Comparableyes
Compared against105 stored samples
Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

41 frames · screen recording · 140s
Screen recording frame
1 / 41
0:00 · 1/41
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 139s

8 process(es) observed; malicious behavior: dropped_executable, timestomping; 15 dropped executable(s)

LaunchedC:\Users\user\Desktop\setup.exe
Privilegestandard
Defense Evasion::Timestomp [T1070.006]
dropped_executabletimestomping
Telemetry sources: Kernel ETW (326 of 1462 events) agent poll: 94Process audit: 8keydiff: 2In-process monitor: 130Autostart diff: 1

Evasion / anti-analysis checks

6 checks
MED
System Checks Capability analysis
MITRE T1497
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Reference anti-VM strings targeting Qemu Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Dynamic Analysis Evasion::Delayed Execution Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Virtual Machine Detection Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Anti-analysis strings (VM/debugger/tool names) strings
MITRE T1497 · qemu

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Anti-analysis API trace

3 APIs · 6 processes hooked

Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

APISignalCallsSleepScored
GetTickCount timing 1000 - no corroborates, never convicts on its own - ordinary software calls this
GetTickCount64 timing 11 - no corroborates, never convicts on its own - ordinary software calls this
Sleep sleep 1 1000 ms total · 1000 ms max no under the floor a stall has to cross (30s in total or 10s at once)
Call order 19 events sampled
GetTickCountGetTickCountGetTickCount64GetTickCountGetTickCountGetTickCount64GetTickCountGetTickCount64GetTickCount64GetTickCountGetTickCountGetTickCount64SleepGetTickCount64GetTickCountGetTickCountGetTickCount64GetTickCountGetTickCount

How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

Module loads

4 notable · 9 from system directories

Modules the sample asked for by name while it ran, recorded inside its own process. Loads from system and installed-program directories are counted but not listed - what is listed is a module from somewhere else, a load that failed, or one whose loader is the question.

ProcessModuleLoadedWhy listed
setup.tmp 860 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1d… asked for comctl32.dll yes resolved by search order, not by a full path
setup.tmp 860 C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll yes outside the system and installed-program directories
setup.tmp 860 C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CallbackCtrl.dll yes outside the system and installed-program directories
setup.tmp 860 C:\Windows\SYSTEM32\SspiCli.dll asked for sspicli.dll yes a module whose loader is the question

What this list cannot say: only an explicit LoadLibrary call is recorded, so a module the sample brought in through its own import table never appears here - absence from this list is not absence from the process. There is no signature check behind these rows, so an unlisted module is not a module that was verified. The hooks are placed a few seconds after a process starts, so the first loads of a launch are missed.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 883 operations on the machine during the run; none of them came from the sample's process tree.

File timestamp writes

12 files

Captured in the calling process, so the values are the ones the sample asked for rather than what the file ended up with. Setting file times is ordinary - installers and archivers do it - so only a write that moves a file's history backwards is marked as timestomping.

BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll pid 860
created=unchanged modified=2012-10-28T11:17:18Z accessed=unchanged
was created=2026-10-23T17:33:10Z modified=2026-10-23T17:33:10Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\callbackctrl.dll pid 860
created=unchanged modified=2010-02-26T15:04:16Z accessed=unchanged
was created=2026-10-23T17:33:10Z modified=2026-10-23T17:33:10Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\unarc.dll pid 860
created=unchanged modified=2012-12-13T00:40:56Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-srep.dll pid 860
created=unchanged modified=2013-08-10T18:22:52Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-MSC.dll pid 860
created=unchanged modified=2013-08-26T13:34:24Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress.dll pid 860
created=unchanged modified=2014-03-15T23:53:36Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-precomp.dll pid 860
created=unchanged modified=2013-09-25T09:09:06Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\packjpg_dll.dll pid 860
created=unchanged modified=2011-10-10T16:41:18Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\precomp.exe pid 860
created=unchanged modified=2011-09-25T16:23:52Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\zlib1.dll pid 860
created=unchanged modified=2005-07-20T07:48:10Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress_mt.dll pid 860
created=unchanged modified=2014-03-15T21:53:38Z accessed=unchanged
was created=2026-10-23T17:33:33Z modified=2026-10-23T17:33:33Z
C:\Games\Castle of Illusion HD\is-2HKM9.tmp pid 860
created=unchanged modified=2026-10-23T17:33:04Z accessed=unchanged
was created=2026-10-23T17:33:47Z modified=2026-10-23T17:33:47Z

Command lines, unwrapped

8 read

8 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

8processes
80file operations
34registry operations
15dropped files

setup.exe

8 processes
8 processes

Attributed activity

Not attributed to any process

2 kinds

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

File operations28
Registry operations2
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 50 write 0 modify 28 delete 29 rename 1

Dropped files

15 payloads
PathSHA-256SizeProcessTimeDownload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_shfoldr.dll 9884e9d1b4f8a873ccbd81f8… 22.8 KB setup.tmp pid 860 2026-10-23T17:33:07.109Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_iscrypt.dll 2f6294f9aa09f59a574b5dcd… 2.5 KB setup.tmp pid 860 2026-10-23T17:33:07.109Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\ISDone.dll bb8a0245dcc5c10a1c7181ba… 452.5 KB setup.tmp pid 860 2026-10-23T17:33:07.171Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll 1910537aa95684142250ca0c… 16.0 KB setup.tmp pid 860 2026-10-23T17:33:10.769Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\callbackctrl.dll 68f42a7823ed7ee88a5c5902… 4.0 KB setup.tmp pid 860 2026-10-23T17:33:11.966Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\unarc.dll 89952411324163a635942db3… 320.5 KB setup.tmp pid 860 2026-10-23T17:33:33.457Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-srep.dll af4379f3d8e12938a2f4e6d8… 85.5 KB setup.tmp pid 860 2026-10-23T17:33:33.457Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-MSC.dll 6d3d6b0ff25fd2ac2c8d478b… 334.0 KB setup.tmp pid 860 2026-10-23T17:33:33.457Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress.dll 17a9ffdf381f7a9f6cdfc85b… 355.5 KB setup.tmp pid 860 2026-10-23T17:33:33.457Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-precomp.dll 55b217742bd9b6e9586b7968… 4.7 KB setup.tmp pid 860 2026-10-23T17:33:33.457Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\packjpg_dll.dll 06c9508f8368964338e5c148… 9.3 KB setup.tmp pid 860 2026-10-23T17:33:33.566Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\precomp.exe ed5151ae802db7e6a1a52e84… 753.0 KB setup.tmp pid 860 2026-10-23T17:33:33.566Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\zlib1.dll 4ad2098b625b99c00aa8b44f… 58.5 KB setup.tmp pid 860 2026-10-23T17:33:33.582Z -
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress_mt.dll 7eeb2c50920e30544e2f180b… 204.5 KB setup.tmp pid 860 2026-10-23T17:33:33.582Z -
C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup\_shfoldr.dll - - _iu14D2N.tmp pid 992 2026-10-23T17:33:47.508Z -

Dropped payload analysis

not examined

The run recorded 15 payload writes and the guest returned no payload capture, so no bytes were kept and none of these files was examined. Their paths are listed above. Read this as a gap in the evidence: nothing here says those payloads were harmless.

File & registry ops

108 file · 35 registry · sample scope

File operation times: 88 timed19 operation time1 not observed

OperationTargetProcess
create
C:\Users\user\AppData\Local\Programs
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:07.109
create
C:\Users\user\AppData\Local\Programs\Common
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:07.109
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:07.109
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_shfoldr.dll
22.8 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:07.109
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_iscrypt.dll
2.5 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:07.109
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\ISDone.dll
452.5 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:07.171
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\issi_splash.bmp
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:07.265
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll
16.0 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:10.769
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:10.769operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\callbackctrl.dll
4.0 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:11.966
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\callbackctrl.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:11.966operation time
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\1.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:11.966
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\1.ico
in-process only
 setup.tmp pid 860 2026-10-23 20:33:11.966operation time
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\2.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:11.966
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\2.ico
in-process only
 setup.tmp pid 860 2026-10-23 20:33:11.966operation time
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\3.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:11.966
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\3.ico
in-process only
 setup.tmp pid 860 2026-10-23 20:33:11.966operation time
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\4.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:11.966
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\4.ico
in-process only
 setup.tmp pid 860 2026-10-23 20:33:11.966operation time
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_shfoldr.dll
22.8 KBsame pathpoll
 - 2026-10-23 20:33:07.109
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_iscrypt.dll
2.5 KBsame pathpoll
 - 2026-10-23 20:33:07.109
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\ISDone.dll
452.5 KBsame pathpoll
 - 2026-10-23 20:33:07.171
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\issi_splash.bmp
same pathpoll
 - 2026-10-23 20:33:07.265
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll
16.0 KBsame pathpoll
 - 2026-10-23 20:33:11.966
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\callbackctrl.dll
4.0 KBsame pathpoll
 - 2026-10-23 20:33:11.966
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\1.ico
same pathpoll
 - 2026-10-23 20:33:11.966
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\2.ico
same pathpoll
 - 2026-10-23 20:33:11.966
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\3.ico
same pathpoll
 - 2026-10-23 20:33:11.966
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\4.ico
same pathpoll
 - 2026-10-23 20:33:11.966
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\unarc.dll
320.5 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\unarc.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-srep.dll
85.5 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-srep.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
create
C:\Games\Castle of Illusion HD\steam_api.dll
in-process only
 setup.tmp pid 860 not observed
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-MSC.dll
334.0 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-MSC.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress.dll
355.5 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\arc.ini
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\arc.ini
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\cls.ini
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\cls.ini
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\English.ini
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\English.ini
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-precomp.dll
4.7 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.457
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-precomp.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.457operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\packjpg_dll.dll
9.3 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.566
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\packjpg_dll.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.566operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\precomp.exe
753.0 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.566
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\precomp.exe
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.566operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\zlib1.dll
58.5 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.582
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\zlib1.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.582operation time
createpayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress_mt.dll
204.5 KBsame pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:33.582
create
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress_mt.dll
in-process only
 setup.tmp pid 860 2026-10-23 20:33:33.582operation time
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\unarc.dll
320.5 KBsame pathpoll
 - 2026-10-23 20:33:33.457
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-srep.dll
85.5 KBsame pathpoll
 - 2026-10-23 20:33:33.457
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-MSC.dll
334.0 KBsame pathpoll
 - 2026-10-23 20:33:33.457
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress.dll
355.5 KBsame pathpoll
 - 2026-10-23 20:33:33.457
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\arc.ini
same pathpoll
 - 2026-10-23 20:33:33.457
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\cls.ini
same pathpoll
 - 2026-10-23 20:33:33.457
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\English.ini
same pathpoll
 - 2026-10-23 20:33:33.457
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-precomp.dll
4.7 KBsame pathpoll
 - 2026-10-23 20:33:33.566
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\packjpg_dll.dll
9.3 KBsame pathpoll
 - 2026-10-23 20:33:33.566
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\precomp.exe
753.0 KBsame pathpoll
 - 2026-10-23 20:33:33.566
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\zlib1.dll
58.5 KBsame pathpoll
 - 2026-10-23 20:33:33.582
modifypayload
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress_mt.dll
204.5 KBsame pathpoll
 - 2026-10-23 20:33:33.754
create
C:\Games\Castle of Illusion HD\unins000.dat
in-process only
 setup.tmp pid 860 2026-10-23 20:33:47.190
create
C:\Games\Castle of Illusion HD\unins000.dat
kernel trace
 setup.tmp pid 860 2026-10-23 20:33:47.190operation time
create
C:\Games
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:47.190
create
C:\Games\Castle of Illusion HD
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:47.190
rename
C:\Games\Castle of Illusion HD\unins000.exe
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:33:47.190
modify
C:\Games\Castle of Illusion HD
same pathpoll
 - 2026-10-23 20:33:47.190
modify
C:\Games\Castle of Illusion HD\unins000.dat
same pathpoll
 - 2026-10-23 20:33:47.190
modify
C:\Games
same pathpoll
 - 2026-10-23 20:33:47.643
delete
C:\Games\Castle of Illusion HD\unins000.dat
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:47.643
delete
C:\Games\Castle of Illusion HD\unins000.exe
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:48.264
delete
C:\Games
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:48.264
delete
C:\Games\Castle of Illusion HD
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:48.264
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\1.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\2.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\3.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\4.ico
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\arc.ini
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\callbackctrl.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-MSC.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-precomp.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-srep.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\cls.ini
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\English.ini
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress_mt.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\ISDone.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\issi_splash.bmp
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\packjpg_dll.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\precomp.exe
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\unarc.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\zlib1.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_iscrypt.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_shfoldr.dll
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
modify
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup
same pathpoll
 - 2026-10-23 20:34:03.112
delete
C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup
same pathkernel tracepoll
 setup.tmp pid 860 2026-10-23 20:34:03.112
create
C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:47.508
create
C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup\_shfoldr.dll
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:47.508
delete
C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup\_shfoldr.dll
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:48.264
delete
C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup
same pathkernel tracepoll
 _iu14D2N.tmp pid 992 2026-10-23 20:33:48.264
modify
C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup\_shfoldr.dll
same pathpoll
 - 2026-10-23 20:33:47.508
modify
C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup
same pathpoll
 - 2026-10-23 20:33:48.264
create
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\WBEM\CIMOM
kernel trace
 setup.tmp pid 1736 not timed
create
\REGISTRY\MACHINE\Software\WOW6432Node
kernel trace
 setup.tmp pid 1736 not timed
create
Software\Microsoft\RestartManager\Session0000
kernel tracein-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000 = <92 bytes, type 7>
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash = <32 bytes, type 3>
in-process
 setup.tmp pid 860 not timed
create
Software\ElAmigos
kernel tracein-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\ElAmigos
InstallPath = C:\Games
read backin-process
 setup.tmp pid 860 not timed
create
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Inno Setup: Setup Version = 5.5.5 (u)
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Inno Setup: App Path = C:\Games\Castle of Illusion HD
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
InstallLocation = C:\Games\Castle of Illusion HD\
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Inno Setup: Icon Group = Castle of Illusion HD
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Inno Setup: User = user
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Inno Setup: Selected Tasks = desktopicon
in-process
 setup.tmp pid 860 not timed
create
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
kernel trace
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Inno Setup: Deselected Tasks =
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Inno Setup: Language = english
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
DisplayName = Castle of Illusion HD MULTi8 - ElAmigos version 1.0 u1
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
DisplayIcon = C:\Games\Castle of Illusion HD\COI_0.ico
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
UninstallString = "C:\Games\Castle of Illusion HD\unins000.exe"
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
QuietUninstallString = "C:\Games\Castle of Illusion HD\unins000.exe" /SILENT
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
DisplayVersion = 1.0 u1
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
Publisher = SEGA
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
NoModify = 1
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
NoRepair = 1
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
InstallDate = 20261023
in-process
 setup.tmp pid 860 not timed
setvalue
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1
EstimatedSize = 828667
in-process
 setup.tmp pid 860 not timed
create
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
kernel trace
 setup.tmp pid 1736 not timed
deletevalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash
in-process
 setup.tmp pid 860 not timed
deletevalue
SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
in-process
 setup.tmp pid 860 not timed
deletevalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000
in-process
 setup.tmp pid 860 not timed
deletevalue
SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
in-process
 setup.tmp pid 860 not timed
deletevalue
SOFTWARE\Microsoft\RestartManager\Session0000
Owner
in-process
 setup.tmp pid 860 not timed
setvalue
System\CurrentControlSet\Control\Session Manager
PendingFileRenameOperations = \??\C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp
autostart diffautostart diff
 - not timed
create
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager
kernel trace
 unins000.exe pid 5076 not timed
setvalue
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
TrapPollTimeMilliSecs = 15000
read backread back
 - not timed

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

17 answered no 1 could not answer 5 had nothing to check
0Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 3,003 records
3 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
3 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,153 records
3 minutes ago
URLhaus payload hashes File hash clean not in feed 1,680 records
3 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer
SourceChecksResultDetailFeed
URLhaus IP / domain / URL feed unavailable 2 observed indicators, none listed no records ingested
blocklist.de IP / domain / URL clean 2 observed indicators, none listed 27.6k records
3 minutes ago
CINS Army IP / domain / URL clean 2 observed indicators, none listed 15k records
3 minutes ago
Emerging Threats IP / domain / URL clean 2 observed indicators, none listed 482 records
3 minutes ago
Feodo Tracker IP / domain / URL clean 2 observed indicators, none listed 5 records
3 minutes ago
IPsum IP / domain / URL clean 2 observed indicators, none listed 19.7k records
3 minutes ago
Phishing.Database IP / domain / URL clean 2 observed indicators, none listed 391.5k records
3 hours ago
ThreatFox IP / domain / URL clean 2 observed indicators, none listed 1,153 records
3 minutes ago

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
9 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

2 clear
SourceChecksResultDetailFeed
Sigma rules Behavior log clean - 2,275 records
5 hours ago
Signature rules Sample content clean 5 structural rules matched (file properties, not findings) 110 records
3 minutes ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 8 process image paths, none masqueraded 245 records
3 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
2 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
3 minutes ago
LOLRMM Names and domains clean 9 name/domain indicators checked, no remote-management tooling 360 records
2 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 32 suspicious 0 info

File indicators

32
SeverityTypeIndicatorDescription
suspicious sample_sha256 d6d15a25f57f06f386c56d5c85d1a6697d735574cecf439b4554cb0f6cb3d4e1 Submitted sample (SHA256)
suspicious sample_md5 ef1ca4075a4c456d7678206f996050d0 Submitted sample (MD5)
suspicious imphash 48aa5c8931746a9655524f67b25a47ef Import table hash (imphash)
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_shfoldr.dll Executable written to disk during execution
suspicious dropped_sha256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\_isetup\_iscrypt.dll Executable written to disk during execution
suspicious dropped_sha256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\ISDone.dll Executable written to disk during execution
suspicious dropped_sha256 bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71 SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\wintb.dll Executable written to disk during execution
suspicious dropped_sha256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435 SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\callbackctrl.dll Executable written to disk during execution
suspicious dropped_sha256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\unarc.dll Executable written to disk during execution
suspicious dropped_sha256 89952411324163a635942db33dd0087508e20d112e1e75403dc1d5e852927dd7 SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-srep.dll Executable written to disk during execution
suspicious dropped_sha256 af4379f3d8e12938a2f4e6d8f7d8f135181c415fa6c443b27eb44c3be173b2ef SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-MSC.dll Executable written to disk during execution
suspicious dropped_sha256 6d3d6b0ff25fd2ac2c8d478b068af55cb053d9b2c08c53964d6559c7c8b8047d SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress.dll Executable written to disk during execution
suspicious dropped_sha256 17a9ffdf381f7a9f6cdfc85b157fc6cf80cd4b45ed8ad43edac73008923501a0 SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\CLS-precomp.dll Executable written to disk during execution
suspicious dropped_sha256 55b217742bd9b6e9586b7968cf66e1f97c1af5245a3034ce35c9872c7ee9671e SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\packjpg_dll.dll Executable written to disk during execution
suspicious dropped_sha256 06c9508f8368964338e5c1481457640d0776fe6d721bc0b8eaf7a495ee66d8b8 SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\precomp.exe Executable written to disk during execution
suspicious dropped_sha256 ed5151ae802db7e6a1a52e84a382f750eab2221ffa082de2cf4fa30e164b4ece SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\zlib1.dll Executable written to disk during execution
suspicious dropped_sha256 4ad2098b625b99c00aa8b44f27829649634c08299a48f1cea2124a0a91c1d12d SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-HN0FS.tmp\facompress_mt.dll Executable written to disk during execution
suspicious dropped_sha256 7eeb2c50920e30544e2f180b0c39488501372a8f8bd8393bcb095353e9114cde SHA256 of a file written during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\is-25G53.tmp\_isetup\_shfoldr.dll Executable written to disk during execution

MITRE ATT&CK

1 technique
Defense Evasion
Timestomp
T1070.006

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2930_sigma_reg

Auto-generated
title: Auto-generated registry behavior rule (sandbox scan 2930)
id: sandbox-auto-2930-reg
status: experimental
description: Auto-generated from sandbox scan 2930
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\WBEM\CIMOM'
            - '\REGISTRY\MACHINE\Software\WOW6432Node'
            - 'Software\Microsoft\RestartManager\Session0000'
            - 'SOFTWARE\Microsoft\RestartManager\Session0000'
            - 'Software\ElAmigos'
            - 'SOFTWARE\ElAmigos'
            - 'SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1'
            - '\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E73D00F8-56AC-40A5-8868-395EA26EC0F5}_is1'
    condition: selection
level: medium

YARA: auto_file_2930_yara

Auto-generated
rule auto_file_2930_yara
{
    meta:
        description = "Auto-generated from scan 2930"
        author = "sandbox auto-generator"
        imphash = "48aa5c8931746a9655524f67b25a47ef"
        anchors = "5 independent regions"
    strings:
        $s0 = "Inno Setup Setup Data (5.5.0) (u)" ascii fullword
        $s1 = "Runtime error     at 00000000" ascii fullword
        $s2 = "Castle of Illusion HD MULTi8 - ElAmigos Setup" wide fullword
        $s3 = "Privileged instruction" wide fullword
        $s4 = "Object lock not owned(Monitor support function not initialized" wide fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 20008396 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2930

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run
SubmittedEnvironmentVerdictScore
2026-10-23 20:31 Shown below Windows 10 22H2 Suspicious 60/100