487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474

Analysis

max time kernel
142s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yuka - Scattered Shards of the Yokai [ESP]/Game.exe
Size 1.5MB
Sample260820-dgg59aydrf
SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T12D759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Game.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{68788158-60D4-4955-985B-C47B05A5B3EC}	Game.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3000	Game.exe
3000	Game.exe
3680	Game.exe
3680	Game.exe
1892	Game.exe
1892	Game.exe
3680	Game.exe
3680	Game.exe
4860	Game.exe
4860	Game.exe
3988	Game.exe
3988	Game.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3680	Game.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3652	3680	Game.exe	82
PID 3652 wrote to memory of 2216	3652	Game.exe	83
PID 3680 wrote to memory of 3000	3680	Game.exe	86
PID 3680 wrote to memory of 1892	3680	Game.exe	87
PID 3680 wrote to memory of 4860	3680	Game.exe	97
PID 3680 wrote to memory of 3988	3680	Game.exe	98

C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x2d4,0x2d8,0x2dc,0x2d0,0x2e0,0x7560d0e0,0x7560d0f0,0x7560d0fc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x1e0,0x1e4,0x1e8,0x1d8,0x1ec,0x93d820,0x93d830,0x93d83c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=gpu-process --field-trial-handle=1648,3110750858545861722,6890210468515400256,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.19041.868 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --service-request-channel-token=FB25EBEB707AA13B0165B09F7F7D9E5E --mojo-platform-channel-handle=1664 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1648,3110750858545861722,6890210468515400256,131072 --service-pipe-token=E37248DA42BF4101B8FDA11A9EE9C42B --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=E37248DA42BF4101B8FDA11A9EE9C42B --renderer-client-id=3 --mojo-platform-channel-handle=2532 /prefetch:1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=utility --field-trial-handle=1648,3110750858545861722,6890210468515400256,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --service-request-channel-token=807226E253755DB8632BE8421E3D0091 --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=utility --field-trial-handle=1648,3110750858545861722,6890210468515400256,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --service-request-channel-token=59F6D3F35D01061B5D394D335280B055 --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2d489191-5401-429d-b3d0-d62930b4de1d.tmp

Path C:\Users\Admin\AppData\Local\User Data\2d489191-5401-429d-b3d0-d62930b4de1d.tmp
Size 1KB
SHA256 7675d05b0e3908194bb8bde17410cfbd04520b1f73caa82235941fc431d23382
MD5 0257a621622fc36153209bdc63ba1464
SHA1 fe79f6e8a7d318f00d25ff6bee51f1b55e36e08d
SHA512 b9d7194aca1d482554b0e82b212ad17011dfd62ca549c38f4835dc528a0958691b4d946f90b816c68e6300a134d80617b95990c4c5bde636cb006d06942a2e88
TLSH
T13B31FE6C695DC83BBE979506F88B2F278B7A105666595F00C2F40E3C56A979C2326107
MD5 SHA1 SHA512 TLSH

Submit Download

31ef3c60-d5b1-424c-8972-698078e6915f.tmp

Path C:\Users\Admin\AppData\Local\User Data\31ef3c60-d5b1-424c-8972-698078e6915f.tmp
Size 3KB
SHA256 70f5da3cfeafc01ee34c092d453b647e5e048816fc7f70d81b0839129d43c0ce
MD5 d9cb6377fb8877b826bcb77d4145e3b7
SHA1 949523c53d190e8e2cc92b1f2da18f81eac457c9
SHA512 488f27c0e8d85b6f667c1277ead86a8c25686cfc099d3dd0c77030f655ca2f4d43a389b74843f4b75e82e02fe1584a84abd5814a564f1112045931f7004e3100
TLSH
T1E261645AA949D53F6EE7C245FA4F2B43BFFB00535288AF40D1EA0B3D066DB5C1316206
MD5 SHA1 SHA512 TLSH

Submit Download

70e746b7-7d82-4e14-abf9-93c67cf4f042.tmp

Path C:\Users\Admin\AppData\Local\User Data\70e746b7-7d82-4e14-abf9-93c67cf4f042.tmp
Size 1KB
SHA256 1fe2e25edd1f13233b47f28f6cd1a507f0d33dafcefdcfe780db15e2063748d4
MD5 9dabede3e17d06ad24aea115f0ea066a
SHA1 aaa6e4f5df5b70d9015d3485528deb2d6434ca02
SHA512 3e4bced6055c75761e63cfa8d9fceb141831c77c17a9e46b13d3540aa3196be0a01b80395c118712c24f7b80e7ea8e966f0f9624b45ff45491e26be410d90517
TLSH
T1F7313F6C6959C82BBE97D506F8473F138B7A10526B552F00C2F84F3D12A9B8C2326107
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\User Data\Default\Download Service\EntryDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences~RFe59f4e5.TMP

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences~RFe59f4e5.TMP
Size 1KB
SHA256 33d21c19f84be9bea3191d1cf3cc35ec1724eb71de35f52b011bf7e24f5cd87f
MD5 ce764761c8a65e3eff735fecc7b9cddf
SHA1 d663fb8a64aba37261e5ad6919e5961f0c9f0ac7
SHA512 e5302041bf61e8846843bb3a22541aec4de38cb36724e6e343cad6d3eff2c407ed26393c8d4caabf77f2e2e5b36455e8280c7a55ba16171bfc0ab0db2cbb4717
TLSH
T10B3153158D24FD779DCED7187D2D7993D1F604529A80094C8AF84E9C0CAE6ED220B90B
MD5 SHA1 SHA512 TLSH

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

fde68d29-a4fc-4af9-bffb-05832b34da18.tmp

Path C:\Users\Admin\AppData\Local\User Data\Default\fde68d29-a4fc-4af9-bffb-05832b34da18.tmp
Size 1KB
SHA256 ae2f88fc9264de6fe710ab31043e59203f195e743b29f1403d43c88cd05a93b4
MD5 83e0bf83e958a4243d3b40f9a451ce21
SHA1 1380d2af0efd34645a1969a4df1e57087dbf79ee
SHA512 d1bf157f632366124df24fbb8a3ea3c9be8dba84de516e1b6b499a798b6217d2225b62df7cd6b4b5f51601190e4565803658457975b0568de5c5c1d646133af8
TLSH
T1DF3175158D34FD779DCED7187D2D7993D1F614629A80194CCAF88E5C0CAE6ED220B90B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59937c.TMP

Path C:\Users\Admin\AppData\Local\User Data\Local State~RFe59937c.TMP
Size 1KB
SHA256 d9637ae11b679e54748f15a3147857bb6059f9b40a36530585ec72adaea07841
MD5 3085822f1c69bb96c1e51002b3ab78bd
SHA1 57ef548e156209d9ef55ccd37e749fa5d90018b8
SHA512 2c9bd34058c207638be8f245f208f29db05405774c555a7a8c270b1c98a998bd3711444f863843a7868c905e218cd42cea11ff5bedba5dc92b3ac1d8e02fbf5d
TLSH
T16E311E6C6959C83BBE979506F88B3F278B7A109666591F00C2F80F3C06A9B9C2326107
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 a7d76ea7dadfad7b8be1429911f3a744d37e7480f48ee26677e090d027dc8f40
MD5 8dc37e87e45496d24862f4ecab0d0dc0
SHA1 b035ba90bc7101829ad8ad76266b3f0065de144d
SHA512 4bf33e86cd5fa4e539e3cc36229da1a20ee51b7b3dd1ba82272e1e0b6c9b9ee3f02604f4acc98a72a2fdf8f441298989e4da301c7e50eda6aecfa285c456251f
MD5 SHA1 SHA512

Submit Download