Unity True Facials [v0.58b Pro] [HenryTaiwan]

[DenabuNeko]

I appreciate anyone trying to call out a possibly malicious file if they're just intending to make people aware, but gotta be honest, posting it out of the blue from a brand new account with a memey JC Denton pfp is just gonna make me skeptical of any claims.

 

[JhonLui]

Okey,

I've checked evry single "guilty" file mentioned and I have no trace of them on my computer...
Also have to say that I uninstalled most of the google and microsoft shit.. and run browsers trough sandbox.
I usually scan every program dld with 3 AVs. Nothing showed up..
I can also confirm there was an infected version (0.50) distributed trough Mediafire, but was blocked at the source by my VPN.

If they did it, they are good.. since 2021 is like Dinosaur age in therms of malwares.
IF they did it (as a personal feeling), it was dev's doing: guts feeling for a conversation I had with one of the staff, but it might have been just a coincidence..

IF they didn't... we have a serious case of paranoia

In any case if you have W11, you are already fucked from down-under so... whatever...

 

[Purple_Heart]

I'm running a 4060 at 4K and it's struggling to maintain double-digit frames.

The RTX 4060 isn't really a 4K card. It's designed more for smooth 1080p gameplay, maybe 1440p in some cases. Expecting it to handle unoptimized games in 4K isn't realistic. The 60-model cards have always focused on delivering stable 60 FPS performance at 1080p, not high-end 4K gaming.

But if your friend's getting 60 FPS on a 4070, he should consider himself lucky.

This isn't about luck, it's about understanding your hardware. Nearly every 3D game on this site, whether built in Unity or Unreal, struggles with optimization. You're essentially trying to achieve the impossible: running 4K games on a 4060 and doing it with notoriously unoptimized 3D titles. The person I quoted below understands their GPU's limits; you should take a cue from that.

Unless you set the screen AND the game at 4K, but that's nonsense you (we) don't have enough Vram nor power to run effective 4K

The truth has been said.

Here's a screenshot showing the actual 1080p performance of the RTX 4060 paired with an underclocked i5-10600K (reduced from ~4.5GHz to a fixed 3.2GHz to keep temperatures low):

Spoiler: Screenshot

You don't have permission to view the spoiler content. Log in or register now.

 

[Purple_Heart]

DO NOT RUN THIS GAME THROUGH TrueFacials.exe IT CONTAINS AN INFO STEALING MALWARE / VIRUS

The genuine executable for the game is bin.exe, while the fake TrueFacials.exe is a malicious file intentionally renamed to appear legitimate and trick users into running it. In reality, it is an info-stealing malware that extracts and executes a batch script in your temporary folder with elevated permissions, patches your default browser with a fake updater (updater.exe), and steals sensitive personal data.

This malware was first seen in the wild on 2021-08-27 13:21:44 UTC, and remains active in the distributed build. If you ran it and your antivirus did not block the payload, assume your information has been compromised.

I personally tested the executable in an isolated virtual machine to verify the earlier analysis by user poopybutt77 and can confirm with 100% certainty that it is an info stealer.

Do not try to reproduce this on a real host machine, only test in an isolated VM or sandbox. Run it on your main system and you'll get your shit rocked and your data looted.

Key evidence I observed inside an isolated VM

• Two files observed:
  You must be registered to see the links
  (legitimate Unity executable) and
  You must be registered to see the links
  (malicious impersonator).
• Malicious behavior reproduced in a VM: extraction of a .bat into the temporary folder and execution via cmd.exe.
• The malware attempts to download / place updater.exe in a path that impersonates a browser updater (e.g. C:\Program Files (x86)\Google...\updater.exe) and launch it.
• Registry modifications observed targeting persistence and service manipulation:
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run (adds startup entry).
  • HKLM\SYSTEM\CurrentControlSet\Services (modifies/creates service entries).
  • HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE (modified).
  • etc... all files created and accessed can be seen at the
    You must be registered to see the links
• Network activity: connections to numerous external IPs consistent with C2 behavior.
• Spawns additional processes/services and creates multiple .tmp files and batch scripts in %LOCALAPPDATA%\Temp.
• Associated file hashes/parents noted in analysis indicate affiliation with keygens and random archives (IOCs that increase suspicion).
• Earliest seen timestamp in the wild (per the provided analysis): 2021-08-27 13:21:44 UTC indicates this malicious build has been available for years.

Sample batch content observed (exact snippet reproduced from legit TrueFacials.bat launcher):

Echo off
cd ntleas\x64
ntleas.exe ../../bin.exe "L1041"
cls

This is what the legitimate launcher should do. Instead, TrueFacials.exe extracts and runs a malicious batch that patches the browser and runs updater.exe


Why “false positive” claims are wrong

• This is not a heuristic alert with no side effects. The binary actively modifies registry keys, creates & executes batch files, spawns processes/services, and downloads/places a payload that impersonates a browser updater. Those are explicit malicious behaviors, not a heuristics mistake.
• Behavior reproducible in an isolated VM.

Here is a video of the analysis with a guide on how to verify it yourself.

View attachment 5363357

Original analysis by:

I've been running this "game" from the so-called "infected" .exe for several years now, and I've never encountered any of the behaviors you mentioned, such as impersonating a browser updater, modifying the registry, creating .tmp files or batch scripts in the temp folder, or showing unusual network activity.

It's quite possible that the copy you downloaded was already compromised from another source. I've always downloaded mine from this thread, so it's likely your version didn't come from here.

If you intend to post warnings like this in the future, I'd recommend including the exact source of your download (a link to the specific post and the file itself). That way, others can independently verify your claims. As it stands, there's no way for anyone to confirm whether the infection came from the game itself or, for example, from a fake "setup.exe" downloaded elsewhere. I'm not saying that's what happened in your case, only that your report, as it is, doesn't provide enough information for others to draw reliable conclusions.

 

[Vegetta9801]

DO NOT RUN THIS GAME THROUGH TrueFacials.exe IT CONTAINS AN INFO STEALING MALWARE / VIRUS

The genuine executable for the game is bin.exe, while the fake TrueFacials.exe is a malicious file intentionally renamed to appear legitimate and trick users into running it. In reality, it is an info-stealing malware that extracts and executes a batch script in your temporary folder with elevated permissions, patches your default browser with a fake updater (updater.exe), and steals sensitive personal data.

This malware was first seen in the wild on 2021-08-27 13:21:44 UTC, and remains active in the distributed build. If you ran it and your antivirus did not block the payload, assume your information has been compromised.

I personally tested the executable in an isolated virtual machine to verify the earlier analysis by user poopybutt77 and can confirm with 100% certainty that it is an info stealer.

Do not try to reproduce this on a real host machine, only test in an isolated VM or sandbox. Run it on your main system and you'll get your shit rocked and your data looted.

Key evidence I observed inside an isolated VM

• Two files observed:
  You must be registered to see the links
  (legitimate Unity executable) and
  You must be registered to see the links
  (malicious impersonator).
• Malicious behavior reproduced in a VM: extraction of a .bat into the temporary folder and execution via cmd.exe.
• The malware attempts to download / place updater.exe in a path that impersonates a browser updater (e.g. C:\Program Files (x86)\Google...\updater.exe) and launch it.
• Registry modifications observed targeting persistence and service manipulation:
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run (adds startup entry).
  • HKLM\SYSTEM\CurrentControlSet\Services (modifies/creates service entries).
  • HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE (modified).
  • etc... all files created and accessed can be seen at the
    You must be registered to see the links
• Network activity: connections to numerous external IPs consistent with C2 behavior.
• Spawns additional processes/services and creates multiple .tmp files and batch scripts in %LOCALAPPDATA%\Temp.
• Associated file hashes/parents noted in analysis indicate affiliation with keygens and random archives (IOCs that increase suspicion).
• Earliest seen timestamp in the wild (per the provided analysis): 2021-08-27 13:21:44 UTC indicates this malicious build has been available for years.

Sample batch content observed (exact snippet reproduced from legit TrueFacials.bat launcher):

Echo off
cd ntleas\x64
ntleas.exe ../../bin.exe "L1041"
cls

This is what the legitimate launcher should do. Instead, TrueFacials.exe extracts and runs a malicious batch that patches the browser and runs updater.exe


Why “false positive” claims are wrong

• This is not a heuristic alert with no side effects. The binary actively modifies registry keys, creates & executes batch files, spawns processes/services, and downloads/places a payload that impersonates a browser updater. Those are explicit malicious behaviors, not a heuristics mistake.
• Behavior reproducible in an isolated VM.

Here is a video of the analysis with a guide on how to verify it yourself.

View attachment 5363357

Original analysis by:

dude this is just lies, also you are just posting it based on simulations or something, i tried to see and follow the stuff you claim TF creates and i saw nothing on my computer, ofc people should always be cautious.. but this is just a massive false positive.. none of the things you say the game creates in the user folder is happening plus ur an account outta nowhere, seems like some troll or someone who wants to scare people about TF to favor other games or something.. just my 2 centz. oh and also i literally have zero new services generated on my system at all or any internet activity,, a post exactly like this one was posted a a while ago here too with a nobody account and it got debunked, is this a repost of that?

now everyone should still be careful, but i have nothing stolen from my computer or hacks at all from playing TF..

 

[Otaku111]

DO NOT RUN THIS GAME THROUGH TrueFacials.exe IT CONTAINS AN INFO STEALING MALWARE / VIRUS

 

[ProjectBGames]

This game has animated climaxes, I believe. It is unfair it is treated as only "animated" when it has such a cool feature. I just posted a thread on how desperately the community needs an ANIMATED CLIMAXES tag. And also a FULLY ANIMATED tag. Most games benefit from the animated tag and are mostly static images. Also, most games dont have animated climaxes, and animated climaxes are certainly THE MOST rewarding feature in an animated adult game. If you can, support the ANIMATED CLIMAXES and the FULLY ANIMATED tags.

 

[Otaku111]

But if your friend's getting 60 FPS on a 4070, he should consider himself lucky. You should probably tell him to try running the game with something better than a 800x600 CRT monitor. Most people I've talked to are getting performance somewhere between a screensaver and a slideshow.

GPU utilization barely cracks 50%. Something's rotten, and it's not my silicon.

Your might be right. My GPU only hits 98-99%. at 4k and 8k. RX 7900XT

Spoiler: 4K ~25FPS

You don't have permission to view the spoiler content. Log in or register now.

Spoiler: 8K ~6FPS

You don't have permission to view the spoiler content. Log in or register now.

Jokes aside, just a shot in the dark.
Check your Power options, and see if it's set to high performance or if processor power management is limited.
If it's not that, I wouldn't be surprised if your rig has outdated drivers (mainly MoBo and/or ChipSet).

 

[Sparowe]

a start..

https://f95zone.to/threads/true-facials-v0-57-full-pro-henrytaiwan.35192/post-18379465

Omg you're a godsend as well as the OP. I did find some keybinds via trial and error but never thought to hold a key while using the mouse buttons

 

[DenabuNeko]

Been working on materials to share as part of the Material Selector. Dark skin Zelda and Aunt Cass makes a pretty good shortstack goblin.

Spoiler: More Screenshots

You don't have permission to view the spoiler content. Log in or register now.

 

[HaKimxD4578]

 

[bogodit]

DO NOT RUN THIS GAME THROUGH TrueFacials.exe IT CONTAINS AN INFO STEALING MALWARE / VIRUS

The genuine executable for the game is bin.exe, while the fake TrueFacials.exe is a malicious file intentionally renamed to appear legitimate and trick users into running it. In reality, it is an info-stealing malware that extracts and executes a batch script in your temporary folder with elevated permissions, patches your default browser with a fake updater (updater.exe), and steals sensitive personal data.

This malware was first seen in the wild on 2021-08-27 13:21:44 UTC, and remains active in the distributed build. If you ran it and your antivirus did not block the payload, assume your information has been compromised.

I personally tested the executable in an isolated virtual machine to verify the earlier analysis by user poopybutt77 and can confirm with 100% certainty that it is an info stealer.

Do not try to reproduce this on a real host machine, only test in an isolated VM or sandbox. Run it on your main system and you'll get your shit rocked and your data looted.

Key evidence I observed inside an isolated VM

• Two files observed:
  You must be registered to see the links
  (legitimate Unity executable) and
  You must be registered to see the links
  (malicious impersonator).
• Malicious behavior reproduced in a VM: extraction of a .bat into the temporary folder and execution via cmd.exe.
• The malware attempts to download / place updater.exe in a path that impersonates a browser updater (e.g. C:\Program Files (x86)\Google...\updater.exe) and launch it.
• Registry modifications observed targeting persistence and service manipulation:
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run (adds startup entry).
  • HKLM\SYSTEM\CurrentControlSet\Services (modifies/creates service entries).
  • HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE (modified).
  • etc... all files created and accessed can be seen at the
    You must be registered to see the links
• Network activity: connections to numerous external IPs consistent with C2 behavior.
• Spawns additional processes/services and creates multiple .tmp files and batch scripts in %LOCALAPPDATA%\Temp.
• Associated file hashes/parents noted in analysis indicate affiliation with keygens and random archives (IOCs that increase suspicion).
• Earliest seen timestamp in the wild (per the provided analysis): 2021-08-27 13:21:44 UTC indicates this malicious build has been available for years.

Sample batch content observed (exact snippet reproduced from legit TrueFacials.bat launcher):

Echo off
cd ntleas\x64
ntleas.exe ../../bin.exe "L1041"
cls

This is what the legitimate launcher should do. Instead, TrueFacials.exe extracts and runs a malicious batch that patches the browser and runs updater.exe


Why “false positive” claims are wrong

• This is not a heuristic alert with no side effects. The binary actively modifies registry keys, creates & executes batch files, spawns processes/services, and downloads/places a payload that impersonates a browser updater. Those are explicit malicious behaviors, not a heuristics mistake.
• Behavior reproducible in an isolated VM.

Here is a video of the analysis with a guide on how to verify it yourself.

View attachment 5363357

Original analysis by:

 

[DenabuNeko]

 

[Purple_Heart]

I've updated the main post to include the v0.57 pre-modded version. Check the original post for the download link!

 

[Hellpnotme]

I've updated the main post to include the v0.57 pre-modded version. Check the original post for the download link!

Thanks, but for some reason i ran into what seemed to be the black screen problem that other people are reporting? My PC isnt AMD though so thats why im confused when i previously ran the 0.57 full version just fine.

 

[Purple_Heart]

Thanks, but for some reason i ran into what seemed to be the black screen problem that other people are reporting? My PC isnt AMD though so thats why im confused when i previously ran the 0.57 full version just fine.

That black screen is actually the loading screen for this "game". If you're running it on a slower HDD, it may just take some time to load, so please be patient. If it still doesn't load even after waiting, I'm not sure what might be causing the issue. I've tested version 0.57 myself (both before and after sharing), and it runs fine on my machine (both the modded and vanilla versions). You can see the screenshot I just took below if you'd like proof.

 

[Hellpnotme]

That black screen is actually the loading screen for this "game". If you're running it on a slower HDD, it may just take some time to load, so please be patient. If it still doesn't load even after waiting, I'm not sure what might be causing the issue. I've tested version 0.57 myself (both before and after sharing), and it runs fine on my machine (both the modded and vanilla versions). You can see the screenshot I just took below if you'd like proof.
View attachment 5368092

Still not sure either actually. Just now i decided to just overwrite all the files in my version with the "pre-modded" version that you sent, and that seemed to fixed it. Loading my captures and characters seem to work rn and fingers crossed nothing awful happens down the line lmao.

 

[Purple_Heart]

Still not sure either actually. Just now i decided to just overwrite all the files in my version with the "pre-modded" version that you sent, and that seemed to fixed it. Loading my captures and characters seem to work rn and fingers crossed nothing awful happens down the line lmao.

Hmm, if overwriting your original files with my Pre-Modded version made the game work, then it's possible that some files weren't properly extracted from the archive, or perhaps weren't extracted at all. I've never encountered this issue myself, but I have seen others mention similar problems in the past, though not specifically with my uploads.

The latest upload (v0.57 Pre-Modded) was archived using WinRAR 7.13 (64-bit) with the standard/normal compression method. If you still have the archive, try extracting it again with that version of WinRAR and see if the issue persists. I'm not entirely sure this will fix it, but it's worth a try.

 

[Dsafgh]

black screen бедолагас,

You must be registered to see the links

Try it

 

[CrvX1995]

Been working on materials to share as part of the Material Selector. Dark skin Zelda and Aunt Cass makes a pretty good shortstack goblin.

View attachment 5366058

Spoiler: More Screenshots

You don't have permission to view the spoiler content. Log in or register now.

Not if we can't mod a way to alter the proportions further, no matter how you adjust them, they all still have a pretty bimbo proportions and we can't actually control the height, it's more of a scale slider, so it all goes up or down, for a shortstack/goblin you need pretty short arms/legs but THICK BOI torso, and we could use a better hips and tits slider.