If you think "0 detections on VirusTotal" means it's safe, you don't know how malware works. I reversed this binary in IDA Pro and checked sandbox logs. Here are the hard proofs:
LSASS Memory Dumping: The game imports dbghelp.dll -> MiniDumpWriteDump and targets lsass.exe. NO legitimate indie game needs to touch LSASS. This is used exclusively to steal plaintext Windows passwords and active session tokens.
Spying on Personal Files: Sandbox logs show the game opening your \Desktop, \Documents, and \Pictures folders on startup. Games load assets from their own folder. This thing is scanning for passwords.txt, wallet.dat, and Discord/Telegram session files.
Suspicious Network Setup: It bundles low-level sockets (WS2_32) with high-level web requests (WININET -> HttpSendRequestA). It uses Sleep and GetSystemInfo to detect sandboxes, act dead for 2 minutes to get a "clean" VT scan, and then exfiltrates your data via HTTP.
THIS GAME IS BUILT ON GAMEMAKER, which natively handles all network requests using its own built-in functions like
http_post_string(). There is absolutely ZERO reason for a GameMaker game to bypass its own engine and manually import low-level Windows APIs like WININET, WS2_32, or dbghelp.dll (MiniDumpWriteDump)Don't run this trash unless you want your accounts hijacked and crypto drained. The dev is a clown.