So I got a game on steam properly, that game is Nekopara. However, patch of it to unlock some *good stuff* need to be purchase separately. I know that I should’ve just buy the official patch instead on their official retailer site or on steam but instead I download patch of it. It’s also very widely used so I thought it gonna be fine…. I think I made big mistake
I installed it and there’s no sign of infection. However, few days later I can definitely hear my computer fan noise way louder than usual. I start to think about any infection on my PC which may not even come from this patch. But just in case, I run in again with setting on Kaspersky changed to put all app like this on High Restricted…. I saw 1 script that pop up on High Restricted that suddenly made after close that patch and suddenly delete itself too. It change name every time I run that installation. Pattern is like EXEC50B.tmp.bat or EXEF022.tmp.bat. My concern raise to very high instantly as this is completely abnormal behavior on any program. In comparison to it patch, fewer than 1,000 KSN users used this patch while **0 user** is using script that instantly dropped after close installation and it change every time I run it.
I can’t upload file to service like Virustotal as file is too big (175MB for Vol.1 patch and 1.28GB for Vol.4 patch). However, I can provide link to that torrent in DM.