File scan report
Verdict Safe
Is torawase.
Only 2 of the 67 antivirus engines that checked it flag this widely seen Windows program, with a single potentially-unwanted 'patched' label and no hostile behaviour across seven…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The file appears benign; obtain games from official or trusted sources where possible and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 67 flagged
- Flagged 2
- No detection 65
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only Ikarus (a potentially unwanted, patched-program label) and one less reliable machine-learning engine flag this file out of 75. It has been seen by 143 submitters since 2023, and seven sandbox runs showed game-engine style activity with no injection, persistence or hostile network contacts.
Two of the 67 antivirus engines that checked it flagged the file: Ikarus with a generic potentially unwanted 'patched' label and Trapmine with a machine-learning score; neither names a malware family. Fourteen other major antivirus engines reported it clean. The file has a long history, first seen in 2023 and submitted by 143 different sources. Seven sandbox runs recorded no high-risk techniques, no injection target and no persistence; the activity, including a YU-RIS engine program markers and Direct3D settings, looks like a visual-novel game. The contacted addresses match analysis background or content-delivery traffic, and none of the 20 checked hosts has a bad reputation.
What We Detected
2 of the 67 antivirus engines that checked it flagged this unsigned Windows executable: Ikarus labels it a potentially unwanted patched program, and Trapmine gives a moderate machine-learning score. No malware family is named, and 14 other major antivirus engines reported it clean. No public malware database or rule set lists it.
Threat Behavior
Seven sandbox runs showed behaviour typical of a game built on the YU-RIS visual-novel engine (its own program markers and Direct3D settings). No process injection target, dropped files or persistence was recorded, and none of the 20 contacted hosts checked has a malicious or suspicious reputation. The 'patched' label suggests the executable may have been modified from its original release, such as a fan translation or crack.
What To Do Now
The file appears benign. If you did not obtain it from the game's official source or a trusted translation project, prefer an official copy, and keep your antivirus enabled.
Where this verdict could be wrong1 caveat
- Ikarus labels the file as a patched program, so it may be a modified or cracked game executable rather than the original publisher's release, and it is unsigned.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 2 of the 67 antivirus engines that checked it flagged it, with no malware family named.
- Seen by 143 different submitters over roughly three years.
- Seven sandbox runs showed no high-risk techniques, injection or persistence.
- None of the 20 contacted hosts checked has a bad reputation.
- No listing in public malware databases or malware-specific rule sets.
- The file is not digitally signed.
- One engine labels it a patched program, suggesting it may be a modified version of the original executable.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 16sandbox rule tags
- 2spawned processes
- 5network contacts
- 25filesystem & mutex artifacts
What this file did when executed
This file was detonated in 7 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1027.005· Obfuscated code
- T1055· Process injection
- T1056.001· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1071.001· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1115
- T1129· Loads modules
- T1497.002· Sandbox evasion
- T1564.003· Hides artifacts
- T1614.001
Observed activity
Processes started
2Programs the file ran, with their command lines.
torawase.exe%SAMPLEPATH%\torawase.exe9bb55dac98d08fa0548c5b63c2725910fbc2433dd34a614a2e8e6788440fe373.exe%SAMPLEPATH%\9bb55dac98d08fa0548c5b63c2725910fbc2433dd34a614a2e8e6788440fe373.exe
Network contacts
55 hosts, listed as 5 addresses. Links show the host and path only.
- IP address
23.198.146.35 - IP address
23.219.78.71 - IP address
96.7.128.144 - IP address
23.34.165.217 - IP address
23.32.75.29
Files
15Files the file created, changed or deleted.
- Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE\KLT1I0ZU\update50[1].xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER176B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1846.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1885.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER341B.tmp.WERInternalMetadata.xml
Show all 15 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER342C.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER343D.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF7E.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER87.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7BC.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7BD.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7CE.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2100.tmp.WERInternalMetadata.xml
Registry and auto-start
2Settings the file changed, including ways to start again after a restart.
- Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name - Set
HKCU\Software\Microsoft\Direct3D\MostRecentApplication\Name
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\DirectSound DllMain mutex (0x00000810)yu-ris1c::users:louise:appdata:local:temp:tmpn1p9fib8.exec::users:louise:appdata:local:temp:c::users:azure:downloads:torawase.exec::users:azure:downloads:
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00001DF0)\Sessions\1\BaseNamedObjects\yu-ris1\Sessions\1\BaseNamedObjects\c::users:user:desktop:torawase.exe\Sessions\1\BaseNamedObjects\c::users:user:desktop:
Sandbox background — not the file
28The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google348_1074597189\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2020_2121310904\bin\updater.exe - VM process
updater.exeC:\Program Files\Google4000_1501224120\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
Show all 28 entries for sandbox background — not the file
- VM injection target
C:\Program Files\Google348_1074597189\bin\updater.exe - VM injection target
C:\Program Files\Google2020_2121310904\bin\updater.exe - VM injection target
C:\Program Files\Google4000_1501224120\bin\updater.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
time.windows.com - VM host
20.99.186.246 - VM host
192.229.211.108 - VM host
23.216.147.64 - VM host
20.99.184.37 - VM host
20.99.133.109 - VM host
23.216.147.76 - VM host
20.99.185.48 - VM host
192.168.0.14 - VM host
184.27.218.92 - VM host
a83f:8110:0:0:1400:1400:2800:3800 - VM host
192.168.0.26 - VM host
20.69.140.28 - VM host
23.196.145.221 - VM host
131.253.33.203 - VM host
a83f:8110:106:0:0:5:5000:0
Chapter 04
Technical details
2 of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- Ikarus (major engine)PUA.Patched
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 23, 2026, 1:35 AM UTC
- SHA-256
9bb55dac98d08fa0548c5b63c2725910fbc2433dd34a614a2e8e6788440fe373- SHA-1
3ace1083c0e1243e82e719ce82aa6e05f2456d0d- MD5
15c79341b12e13b0de70da236b9a72fa
About this file
torawase.exe says it is YU-RIS Script Engine, 2.2 MB.
- Claims to be
- YU-RIS Script EngineFrom the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 2.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 25, 2023On VirusTotal.
- Submitted by
- 143 distinct sources
- Packer
- None detected
- Entropy
- 6.49 of 8
First scanned
Antivirus consensus
2 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-115 engines1flagged
- Tier-236 engines0flagged
- Low-trust16 engines1flagged
View all 75 engine results
- IkarusMalicious: PUA.Patched
- TrapmineMalicious: malicious.moderate.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingNo result
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is torawase.exe safe?
What is torawase.exe?
How many antivirus engines detected torawase.exe?
What is the SHA-256 hash of torawase.exe?
Is it safe to run torawase.exe?
How up to date is this analysis of torawase.exe?
Community
Member reviews and reports for this exact file hash.