September 2, 2021

Found suspicious behavior on popular game patch that I download from torrent

So I got a game on steam properly, that game is Nekopara. However, patch of it to unlock some *good stuff* need to be purchase separately. I know that I should’ve just buy the official patch instead on their official retailer site or on steam but instead I download patch of it. It’s also very widely used so I thought it gonna be fine…. I think I made big mistake

I installed it and there’s no sign of infection. However, few days later I can definitely hear my computer fan noise way louder than usual. I start to think about any infection on my PC which may not even come from this patch. But just in case, I run in again with setting on Kaspersky changed to put all app like this on High Restricted…. I saw 1 script that pop up on High Restricted that suddenly made after close that patch and suddenly delete itself too. It change name every time I run that installation. Pattern is like EXEC50B.tmp.bat or EXEF022.tmp.bat. My concern raise to very high instantly as this is completely abnormal behavior on any program. In comparison to it patch, fewer than 1,000 KSN users used this patch while **0 user** is using script that instantly dropped after close installation and it change every time I run it.

I can’t upload file to service like Virustotal as file is too big (175MB for Vol.1 patch and 1.28GB for Vol.4 patch). However, I can provide link to that torrent in DM.

Leave a Reply

Your email address will not be published. Required fields are marked *

Note: By filling this form and submitting your commen, you acknowledge, agree and comply with our terms of service. In addition you acknowledge that you are willingly sharing your email address with AiOWikis and you might receive notification emails from AiOWikis for comment notifications. AiOWiksi guarantees that your email address WILL NOT be used for advertisement or email marketting purposes.

This site uses Akismet to reduce spam. Learn how your comment data is processed.