Analysis
- user interaction
yes - max time kernel
18s - max time network
19s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 04:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://veryfujii.itch.io/be-my-lover-4-a-day
Resource
win10v2004-20260911-en
10 signatures
150 seconds
General
- Target https://veryfujii.itch.io/be-my-lover-4-a-day
- Sample261027-e59qva1wby
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3508 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2108 chrome.exe 2108 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe Token: SeShutdownPrivilege 2108 chrome.exe Token: SeCreatePagefilePrivilege 2108 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe 2108 chrome.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2108 wrote to memory of 4296 2108 chrome.exe 87 PID 2108 wrote to memory of 4548 2108 chrome.exe 88 PID 2108 wrote to memory of 4548 2108 chrome.exe 88 PID 2108 wrote to memory of 3508 2108 chrome.exe 89 PID 2108 wrote to memory of 4972 2108 chrome.exe 90 PID 2108 wrote to memory of 4972 2108 chrome.exe 90 PID 2108 wrote to memory of 6016 2108 chrome.exe 92 PID 2108 wrote to memory of 2228 2108 chrome.exe 93 PID 2108 wrote to memory of 6016 2108 chrome.exe 92 PID 2108 wrote to memory of 2228 2108 chrome.exe 93 PID 2108 wrote to memory of 2144 2108 chrome.exe 94 PID 2108 wrote to memory of 2144 2108 chrome.exe 94 PID 2108 wrote to memory of 4892 2108 chrome.exe 95 PID 2108 wrote to memory of 4892 2108 chrome.exe 95 PID 2108 wrote to memory of 2384 2108 chrome.exe 100 PID 2108 wrote to memory of 4852 2108 chrome.exe 106 PID 2108 wrote to memory of 4852 2108 chrome.exe 106 PID 2108 wrote to memory of 4992 2108 chrome.exe 107 PID 2108 wrote to memory of 4992 2108 chrome.exe 107 PID 2108 wrote to memory of 6024 2108 chrome.exe 108 PID 2108 wrote to memory of 6024 2108 chrome.exe 108
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://veryfujii.itch.io/be-my-lover-4-a-day1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff15a6c728,0x7fff15a6c734,0x7fff15a6c7402⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,7221011289366049358,4420041709558961026,262144 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:22⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,9783385178714668940,8316533556816590180,524288 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2276 /prefetch:32⤵
- System Time Discovery
PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,17310355034479078632,16487057967398593163,524288 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2560 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,13752500962071502876,12242568896013454214,2097152 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:6016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,14107549960980434662,13136003631806418135,2097152 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4356,i,13449612240066946384,8638678622072748741,2097152 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4364 /prefetch:22⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4064,i,11283328377012769537,6091486070406708299,2097152 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4596 /prefetch:12⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,1058606384795638978,3235159109761351790,524288 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5504 /prefetch:82⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5768,i,8932395223417528581,11161913436199622458,2097152 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5844 /prefetch:12⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4880,i,13171569807931220601,3443197899410944354,2097152 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4596,i,13273216112566556943,15846758286336823067,2097152 --field-trial-handle=2020,i,5347327450434399152,625680063920404158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6044 /prefetch:12⤵PID:6024
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1164
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\122adca5-d2db-43ec-afda-a5676b5b5ae1.tmp
- Size 131KB
- SHA256 adf38e4931e8dd83ee14852c52d10841fa5bfd3da545b905ed1c462bea5714d6
- MD5 00075c71a73b91da66692eb5bd2ee60f
- SHA1 aa8853cfc7c2164c5eb1c636601094d18666e902
- SHA512 a3c5e75c826ec9a1b5712c04f5fe9e0a4942f3fb05e9f367f5b5b00e90d1ada0436fea0c577713884e6c0d602ffe11278d98a08d2e1fee917e9ccdfed65dc96e
- SSDEEP 3072:B+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:B+hFD+7t56OD9ZfSAppry
- TLSH T1BFD31232AA95D8BB89FC6541B187A300DE76ACED41DE3A09444A5F8ED09FD4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\649422a2-5638-4beb-a16f-c2cd132f4b46.tmp
- Size 130KB
- SHA256 9bfff091226fe98e6f532f7437e75b62f5b3e687e43dbe8cb26b647c56149089
- MD5 cc13aa77dde891b122473289afe800f4
- SHA1 a7790559d206838cfebfbe21ed2d1eea2455ceb2
- SHA512 cbf5114ba38cd912c533a3c9432d2f9472ca008df7736527f35328724aad5d10bea3b8ea57ce64ebdd61437d1861669e8392c555d5c65e213011ad072871ed73
- SSDEEP 3072:Z+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:Z+hFD+7t56OD9ZfSAppry
- TLSH T166D31232AA91C8BBC9BC6541B197A304DE76ACED41DE3A09444A5F8ED05FD4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\241ca3a3-707c-45a3-baa3-ddef46aa7a5e.tmp
- Size 414B
- SHA256 571b2332681a593937863c9cd38f5f34da4fcc67ee2b9708c82b8dcf5aee03eb
- MD5 61a614688e7a623e82fa46a4b719e308
- SHA1 5e68873f726c5d202356b8f3e2bfa492e7da8a51
- SHA512 2cc21c030bcd8ce8d9b5a69d9c8e14469111a9b4f88a1f9d6286517cd6e2d8062273169da187291414119d8eb49372524c926262109f7915e9e0b370fca91b2d
- TLSH T1A4E02BEAD811BC275EFE471921568649EB60236B2B404D4B3A3C805C8F715364ADDD9D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3e9153ff-dd94-4ddf-8e8a-8c8cd4d50074.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c3da6b4-b480-4a12-9c70-c22cfbfd72d0.tmp
- Size 12KB
- SHA256 7c475003c090c572f89db789536b815f41f8ccb0ab6eb4ba7892db4a8d1d3e66
- MD5 9557e954769157bc3b46f0ab5e98c750
- SHA1 08be7e0a60b14bee1256f20796580ae229b955af
- SHA512 f80bea11cad86c7b356bbec64e1f0c57e3eff16cacde15145961506192af12cf92e6e3f10f85ac3634245e2f79e11d057355b01f951a775a2e1ccab8a1c05080
- SSDEEP 192:kRNXz49HFg/v78pAPRp2Tl+9THsb+WNnxBDqB2eG62eSge1YVyIsnAUge:kRNXEsX4UXbJw7o2eZ2eS78e
- TLSH T15A42C42DAD50753B5CEBC22AF9627B63D7F6002260D42E84EAFC897C24E75CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d5de2008-cdf9-462c-bc64-d8a979d34426.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cd9ad56a-1d0c-41dc-a786-8749fcf5e7bd.tmp
- Size 17KB
- SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
- MD5 c8926c13ed1e541a9ebca052800d518d
- SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
- SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
- SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
- TLSH T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
- MD5 SHA1 SHA512 SSDEEP TLSH