487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474

Analysis

max time kernel
152s
max time network
184s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
072 Project_Useless Princess and the Village Renovation/Game.exe
Size 1.5MB
Sample261026-q69ysabc29
SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T12D759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Game.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{D285396A-1B44-4697-86D4-650A064DA403}	Game.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5848	Game.exe
5848	Game.exe
3064	Game.exe
3064	Game.exe
5568	Game.exe
5568	Game.exe
3064	Game.exe
3064	Game.exe
5500	Game.exe
5500	Game.exe
5712	Game.exe
5712	Game.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	Game.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1204	3064	Game.exe	88
PID 3064 wrote to memory of 5848	3064	Game.exe	89
PID 3064 wrote to memory of 5568	3064	Game.exe	90
PID 3064 wrote to memory of 5500	3064	Game.exe	93
PID 3064 wrote to memory of 5712	3064	Game.exe	94

C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe
"C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x304,0x74b5d0e0,0x74b5d0f0,0x74b5d0fc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe" --type=gpu-process --field-trial-handle=1712,12014287894448707773,3728918708527565980,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.26100.1 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation" --service-request-channel-token=EF867C278A1811DA82C5CC655108206D --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5848
- C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1712,12014287894448707773,3728918708527565980,131072 --service-pipe-token=9E8776BB39BE640F9F9B0FCA88062533 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=9E8776BB39BE640F9F9B0FCA88062533 --renderer-client-id=3 --mojo-platform-channel-handle=2544 /prefetch:1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe" --type=utility --field-trial-handle=1712,12014287894448707773,3728918708527565980,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation" --service-request-channel-token=388C496D66AA044BAB0E2524455A1329 --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5500
- C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation\Game.exe" --type=utility --field-trial-handle=1712,12014287894448707773,3728918708527565980,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\072 Project_Useless Princess and the Village Renovation" --service-request-channel-token=1C6C2383F4D2AA6F15293BE18730E0E0 --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1597f5ce-8605-4ee7-a15b-8d67ed43c937.tmp

Path C:\Users\Admin\AppData\Local\User Data\1597f5ce-8605-4ee7-a15b-8d67ed43c937.tmp
Size 1KB
SHA256 db91046e8de6d29d2ed35e188c21effb9394e26b8cd390fb60cf6a4348e8813f
MD5 7d6fa52b207f21eb4e505e38df610f26
SHA1 d3664265b62841c7f192884f98343e0f47caa3ed
SHA512 ebaf85c21ad0ff7de4bacb5f3988a51478f1f14f1c67d9712b4e7908c96782468a238d0ca789184d798f7658b77f10dcc731b46031cf203e6ca62bafaa0f2371
TLSH
T11331306C395ECC3BBE97D51AF9873B238B7A10562B455F04C2F84E3C065879C2316207
MD5 SHA1 SHA512 TLSH

Submit Download

6ab810ca-111a-4cb4-a333-c982e55311b8.tmp

Path C:\Users\Admin\AppData\Local\User Data\6ab810ca-111a-4cb4-a333-c982e55311b8.tmp
Size 1KB
SHA256 c1c9e5a7af1876285671a83f73663ae33ecdfbf221208c6df1f6e92883f989fb
MD5 ca389a3a70a09b7918edde55c4431bc5
SHA1 2e6352d8b2a1ec871546eb89c83f68dabd3403ed
SHA512 cb5695d9786040c563330affa3eddade45dca316551e82241854db459765c2548fd57f71df6287800b5b329b588df27fee501f95de7f1b034b85e7b0254f234c
TLSH
T180311F58295ACC2BBEDBD41AF8473B23D76A10566A552F01C3F84E3D16A978C2316207
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences
Size 1KB
SHA256 0499cf8f37aa92865c1973a5df11dec0c0d07eab321025ce7e39d0471e06b6f8
MD5 9f14e18051310d6ad16bfe938acee25b
SHA1 f50fe72751e1d963940114496f10e39e00234c5c
SHA512 7a4142a5dae7d742200f879e29334e62df83c3c09b1de88952844c9f21cad468662adbaf34717b6b6c9647e14153647c4e9111ff076e773b38e04995b197f46e
TLSH
T1673155068D24FD779DCED7187D2C7993D1F505619680194896F88A6C0D7D7DE210B907
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\User Data\Default\Thumbnails\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

db8b20ec-ee3e-4d02-8d98-04c1592a7cff.tmp

Path C:\Users\Admin\AppData\Local\User Data\Default\db8b20ec-ee3e-4d02-8d98-04c1592a7cff.tmp
Size 1KB
SHA256 b2f4f82218886d55f8bea64de96027cb6634e77121096b2e048aecc49fcfaef9
MD5 446a1e30eadde1170fad058bf2c58937
SHA1 40af5b657e8e74924d6df1cc3c39792a2fb864b4
SHA512 3cd9ed583652075fafe0ec816d0bd68f199d1749cae60ee2cab28da9a5d57dd29635201629acdfe068cc2837fd84adfc39eb130278b1d78275bb0e63750a7295
TLSH
T10A3153068D34FD778CCED7187D2D7993D1F614619A80194CD6F88A6C0C7E6EE210B90B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\User Data\Local State
Size 1KB
SHA256 14755e00bfe76d66c323705715cba525adc4722455a4a6817d7b76003699050f
MD5 80dd776ee97748ff9942ef171adaecab
SHA1 9dbfd23a8f2a3015bcae11500dbd0768864b3ee8
SHA512 9ed84246827bb34170f156f6c24646b07a46c89bd42c4bbb6223570bb81f073799c202abaee47d4b33a52bd19dcdb3711748c276b8b8231b5d1fef36e2916547
TLSH
T1A031106C395ACC3BBE97D519F9873B238B7A10566A451F05C2F84E3C065979C2316207
MD5 SHA1 SHA512 TLSH

Submit Download

a13c8292-33f8-49a2-8cc8-cdae6e4a23cb.tmp

Path C:\Users\Admin\AppData\Local\User Data\a13c8292-33f8-49a2-8cc8-cdae6e4a23cb.tmp
Size 3KB
SHA256 150495bf9c5f73ee6317576abfde1600fdcc9bbcb64b8a2bf190a344b82aff4b
MD5 a71ea723b4c9c2fba7b79b44da5e39a7
SHA1 c4e569a470e4d087f1b509df6ebecac89dd7af3e
SHA512 1d7f6f58024b8218ea3fb375597f347b75f7c1a5a97f82053e84b79fd257c437a870aef4355c06dd541b953dc7de7a73cbb1a0d055625e4129d3e7da1e4050c3
TLSH
T1406173597949D83F6EE7C215FA4A2B53BFBA00535288AF41D2EA0A3D0A2DB4C1316206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 5f8b72a1e91ce16f16ce893d0f062d0e75c7809b4e6df4a895479fc553fcefe8
MD5 cd89914b56298e481bfb5a63ef1ce36c
SHA1 c18012191c68c2bdba96a8e2ac1e536b41ce8330
SHA512 9c39ee0756fadf45d336e5368bcd1e4910c10dbe94bf279fec8a987560e9d0e6fd1bc459da11bbec6979702a1f2cc0f3e2c899680a7a3da3b91660ac9ecc734c
MD5 SHA1 SHA512

Submit Download