487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474

Analysis

max time kernel
152s
max time network
233s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yuka - Scattered Shards of the Yokai [ESP]/Game.exe
Size 1.5MB
Sample260820-dgg59aydrf
SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T12D759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{DE142055-6EFF-43E3-A710-59A46C30C3BD}	Game.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5860	Game.exe
5860	Game.exe
4972	Game.exe
4972	Game.exe
1744	Game.exe
1744	Game.exe
4972	Game.exe
4972	Game.exe
3656	Game.exe
3656	Game.exe
5312	Game.exe
5312	Game.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4972	Game.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 236	4972	Game.exe	88
PID 4972 wrote to memory of 5860	4972	Game.exe	89
PID 4972 wrote to memory of 1744	4972	Game.exe	90
PID 4972 wrote to memory of 3656	4972	Game.exe	93
PID 4972 wrote to memory of 5312	4972	Game.exe	94

C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x304,0x74f3d0e0,0x74f3d0f0,0x74f3d0fc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:236
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=gpu-process --field-trial-handle=1668,1654083137537885252,8045550528473547657,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.26100.1 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --service-request-channel-token=CEC42FBA45F223704753486E99B9430D --mojo-platform-channel-handle=1680 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5860
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1668,1654083137537885252,8045550528473547657,131072 --service-pipe-token=724266C652B7627C3FCEAFA354D8A2AC --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=724266C652B7627C3FCEAFA354D8A2AC --renderer-client-id=3 --mojo-platform-channel-handle=2540 /prefetch:1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=utility --field-trial-handle=1668,1654083137537885252,8045550528473547657,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --service-request-channel-token=438EA63A8430F8F3EAE245A74793C7E2 --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]\Game.exe" --type=utility --field-trial-handle=1668,1654083137537885252,8045550528473547657,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka - Scattered Shards of the Yokai [ESP]" --service-request-channel-token=7B6ED29D9AAA5D7798A08D96EC31575A --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

596d6e91-3f9e-4909-a284-9825d877d765.tmp

Path C:\Users\Admin\AppData\Local\User Data\596d6e91-3f9e-4909-a284-9825d877d765.tmp
Size 1KB
SHA256 6e2aa3915c3b00aa5a8d302dd62b0ea5e7e93f8faf4f0abde06dcb631f651de9
MD5 52ef6753e9e47ebe0424fb6a7ec4bbd5
SHA1 9c55e416fd8722a62b5eab4eb3b59b48c6d29d02
SHA512 d4ed996272e006aa16c59fa14066ff48d62d22e57381ea38a329723790a1649f095f91823360716761a3d6631ee0b1ea068238ba1cb3fb15de6816ce82cc78ce
TLSH
T16C31F15D695DC83BBDABD445F8473B239B6A10523B596F41C3F80F3D1669B8C2326107
MD5 SHA1 SHA512 TLSH

Submit Download

98a6fd3c-cecb-4b36-8f89-6a22d7c4b4da.tmp

Path C:\Users\Admin\AppData\Local\User Data\98a6fd3c-cecb-4b36-8f89-6a22d7c4b4da.tmp
Size 3KB
SHA256 cf350d63793c9aa54837c787af71ccab5bbec7cc38c1d9c9abc0cb8e453cf641
MD5 24846398d4eecd50ca94e6392bc37cc8
SHA1 323f30448d26a3dee4ed38a31bff773fad98f306
SHA512 81a154df22a2ed34f91e6ce74d771d368c6926f3ecd556ebc047fdfc6596350aab0072f0581beb7c8f6e219ea25b3efe0d7cc66834dd62445bdda54e6ec94429
TLSH
T19161565A7949D53F6EE7C245FA4F2B53BFBA00532248BF41D2E90B3D052DB5C1216207
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\Download Service\EntryDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences~RFe5b13c3.TMP

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences~RFe5b13c3.TMP
Size 1KB
SHA256 7e1e825f7d98db227a3d667e331c0135ddb17e95e0e1f2174571ecca95f70530
MD5 83ce9b9f970e5c0c4c964b1cccdb83e9
SHA1 0ddb3975a11e14bbc967016d1e137bb328ccc41a
SHA512 cf5d0e07260931cda90db61e06ebc83a6ca34c87edcb9736058df194b63377b2005189d1b34bdaf907d00cb945fbf6ee46f2c1359f14cbbf9f202312ac47c7d8
TLSH
T1923150068C64FE779C8ED7287E2C7E93D5F504A29A80194896F84A6C0C7E7ED220B906
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\User Data\Default\Thumbnails\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ae6035ac-74df-4f15-8aec-40efca9dcb43.tmp

Path C:\Users\Admin\AppData\Local\User Data\Default\ae6035ac-74df-4f15-8aec-40efca9dcb43.tmp
Size 1KB
SHA256 dc3431f8956dbca15ce452ccd7e2233db881be8acd2103d4bd99443056a6bcd3
MD5 c99e49235262679d4578f098ed07fc9c
SHA1 68d3657c6ef033a8b4ebf2f471917cffc94ae810
SHA512 0900adb53d2e1245432db00c185067997353c1f5ce92e9c93b3efba995de0e6cef56a315041fa3b77288a1507871ba335445bfbd6e83e3df254e9558c6706775
TLSH
T10B3151068C74FD779C89D2187E2D7EA3D5F114A29A80294CD6F88A6C0C7E6ED210B906
MD5 SHA1 SHA512 TLSH

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\User Data\Local State
Size 1KB
SHA256 ca968432bca851b21a5f325910a34d6f1f19c12f688f3cc2a6a9672097ab3850
MD5 8c7a148afb5ce290285bc701129bd603
SHA1 8b6469eb88fb4baa2e2c164fc0fbedb5547bc0fe
SHA512 c3f2af5f3c0c59d001e444abd794917c46feb8c5c926dddbfd4d16c9f56af25ef3ae5a349d1c7db0243ae1cf43ee44f02d0494d28bddbb18c91968d052d9bae6
TLSH
T18F31106C695DC83BBEA7D545F8873B278B7A109237096F41C2F80F3C1669B9C2326207
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a9d89.TMP

Path C:\Users\Admin\AppData\Local\User Data\Local State~RFe5a9d89.TMP
Size 1KB
SHA256 5af3b6c7444e55f63a08db05d4136dc6c687c30c91564b6b8cae2c60064895ee
MD5 32b6ec968872e594b1b1924034f9a8b3
SHA1 84a85601c25179b1116257ef3219cce59ad416a3
SHA512 351f9570c0c5ea273054004915c8e4933472f22f7c3318187929d5cbaa12637cd70f45e0758be13784cf3bb7b41359d3cda66cf95e3bd55ed657d5b28bf63a5c
TLSH
T16F31F16D695DC83BBEA7D545F8873B278B3A109637186F41C2F80F3C1669B8C2326207
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3827cf744ab295fb3ff6caf14f5062a762392d47cf083cf6021d835d7629e2d
MD5 7852a10f2e8f7420e737946650d108be
SHA1 6c49f35618b316835dbd43fca292d38907e617ff
SHA512 0fd0cc27e5669c2057792744482ade4a51bfd565fcf50775636328ec40ae96e0cf4587579e853c94499af5fef8d7229f0b87415f706e34b976d6be1c04b02812
MD5 SHA1 SHA512

Submit Download