b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de

Analysis

user interaction
yes
max time kernel
329s
max time network
358s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ネトカノ！/Game.exe
Size 2.0MB
Sample260603-e8vq4aay7p
SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
MD5 f760c2f862cf7d98b570bae41364e05d
SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
TLSH
T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{CEA8D0E2-2B84-446D-BEC7-3027C67240C8}	Game.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{C038159F-992F-4883-BD88-A1653692EECE}	Game.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
796	Game.exe
796	Game.exe
2372	Game.exe
2372	Game.exe
700	Game.exe
700	Game.exe
1092	Game.exe
1092	Game.exe
4184	Game.exe
4184	Game.exe
3924	Game.exe
3924	Game.exe
3640	Game.exe
3640	Game.exe
4916	Game.exe
4916	Game.exe
4520	Game.exe
4520	Game.exe
1168	Game.exe
1168	Game.exe
2096	Game.exe
2096	Game.exe
4836	Game.exe
4836	Game.exe
3584	Game.exe
3584	Game.exe
2372	Game.exe
2372	Game.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2372	Game.exe
2372	Game.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 380	2372	Game.exe	80
PID 2372 wrote to memory of 796	2372	Game.exe	81
PID 2372 wrote to memory of 700	2372	Game.exe	82
PID 2372 wrote to memory of 1092	2372	Game.exe	83
PID 2372 wrote to memory of 4184	2372	Game.exe	84
PID 2372 wrote to memory of 3924	2372	Game.exe	85
PID 2372 wrote to memory of 3640	2372	Game.exe	87
PID 2372 wrote to memory of 4916	2372	Game.exe	89
PID 2372 wrote to memory of 4520	2372	Game.exe	91
PID 2372 wrote to memory of 1168	2372	Game.exe	92
PID 2372 wrote to memory of 2096	2372	Game.exe	93
PID 2372 wrote to memory of 4836	2372	Game.exe	94
PID 2372 wrote to memory of 3584	2372	Game.exe	95

C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
"C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ffd36686ec8,0x7ffd36686ed8,0x7ffd36686ee8
  2⤵
  PID:380
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=gpu-process --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1596 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:796
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=1900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\ネトカノ！\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\ネトカノ！\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2608 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=gpu-process --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\ネトカノ！\Game.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1572,6799260343787230960,5278938275570645015,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\ネトカノ！" --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad\settings.dat
Size 40B
SHA256 2a360b5bfe7c9d31898d56b1770d51ade753273fb248110170d63351fe720506
MD5 a044a31652fba63cf3ab2daeaeb3045c
SHA1 416eb473be02b0a39e14070b99fec63a1d6cd530
SHA512 b44ae555ce8747e0397362d2728eee7c7160d38189d8d8f0b2ddf7bdea3d37263ba75ee2a83823772c8febce6e7697a961dd292cdb095637f062d22c172ef4e9
MD5 SHA1 SHA512

Submit Download

44b2f679-1089-4121-91f6-4d3471abbb01.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\44b2f679-1089-4121-91f6-4d3471abbb01.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59fd90.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State~RFe59fd90.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 905559b01d0ad7b435dae75a8cf5e7ca5be7072c8e52b44739016ec6a0181db3
MD5 13548068062ef6f5198a7a4ca53f7599
SHA1 c64ea68a973a5ed6cb12421f15359fdc18f9437e
SHA512 ffc01485a410831d0b721bac9648ce4121a7ce96208705e352c2c71a329a19b69a345da885a9b5ef0c51c53aa7170482326669a6a3226a4bfdae4242575e64f3
TLSH
T1CE61A7465B189C774DDEC13DBD463A93D2FA04A18ED11D44ABFCAA1C0CDEADE2217827
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 2KB
SHA256 0339efe7f0b1e2733686964f6db1714155b2a8bac9691800c323dfb70a3687ef
MD5 ef3f3d7fdefd9fc4f1ba9e64b9321104
SHA1 66c7d42132774bda27cf10e920e514795079563a
SHA512 0e63fe63aa4e3891b80038682f096f670901ea93c5992963fd8bf4d097cab3e324d27b32b4a71b72f267b267f9034f911765e15e32abc31d6b001571be33f136
TLSH
T14B51A5466A189DB34DDEC139BD453993D1FA00A18AD11D44ABFC6A1C0C9A9DE2217827
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe594b67.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences~RFe594b67.TMP
Size 2KB
SHA256 cdd57e17810a1d79e30b1c4cc0be6b2a2a93f6cbf779403d52601fd0538d3dc5
MD5 de5546220a26596013f6eaebecf71631
SHA1 9d66aae168c31472cf46f7dc0330b3e1d4d79a58
SHA512 30b8b704eaaafba6fcb67fbf66773a177e0dffe39af08f646d84deff1ea3ae63b3c0cb5ae44186cf087238d85bafbca6ab79d13721e0fe8cc877eb60937b7e3b
TLSH
T18251B6466B18DDB30DDEC13DBD463993D1FA00A18AD11D44ABFC6A1C0CDEADE2217827
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 203B
SHA256 1447e598c758019afcd2185f4f5395b07cd0f85ed638f7f5633308d7da390d9d
MD5 38c321328c356b4ccc71d787a28897df
SHA1 1ee1e574dbfc6c1784d319572a48c4d7e98e1c77
SHA512 0d092491578f244b268d0cabc907990fbe4b97b86962f5977633da82a88641cac2b3b5ce307e4dbe6f48d58214f458fb67b484b2338e2fb3670109b2885b652d
TLSH
T140D022E6007EE873203C09360A84BE015E7AA034118368E8D993C16C909407B4623803
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 203B
SHA256 cbf0d84a21db0c1c58ca64d82f52a617ab90fef0f566f790dc6fcf922dc4c610
MD5 b26a62d73df9fdfc06508fc52ae9863f
SHA1 8c0993357cc74f42d8f3ef86efb25076e553d9f6
SHA512 011e9147988d1efe4fac2e254fd47d30cc23e57e791fa4216b9dc1378863483912abc746b1e9c11d35db12434b004280786d74ecfa1197658d47d2b026de1d59
TLSH
T159D022B2003DE8B360280A350A80AE055EFAA8340181A8ECA5E3C1ACB1E40F75B03403
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59e891.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity~RFe59e891.TMP
Size 201B
SHA256 9fa4aaf8e75aacdd7b01c032d6ffb3c0b167c47203649a6fa739e402d2d39bb8
MD5 ebe567d313037383f402a48135bf16aa
SHA1 49e8398f083ce4c566c92070df6837955c327bdf
SHA512 e8765f4dac32bc1e5f813dd9d4eadf65a49e370f4f3542f4bd8f9cdeefda85b363b792b183ab28b55c3447a4b427d5cea7990c694f087c433aeee4341be7c9f8
TLSH
T15ED022E2803EEC77202809358A80AED95E76A47441825CE896A3816FA2940B74D03043
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 fb2ed88f1b5f3abe9c77c19bd007972ae822ff4e30d501c99d03bf9451686685
MD5 705c3b6b338f8210e0a2c81d0272c723
SHA1 03b661553cab5ea172fc6929ed61541e397c766b
SHA512 a386b033152479f4a22ab29881c7895867b961480b1ce53a43fbcbc8361e57323035e1e1c2bdec1fa83112b4d39b3ec1dd680847c9c4f21d56ba1e7875962c5d
TLSH
T1CD61A47A758D5837AFA7E555F8832A13DEAD009B7A142B80C3F90B2C51A6BC81316523
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 a557a227d7a0c6bf3c4698245056b2ed36eded2fc5a4c0a768aacd225ef9ae92
MD5 f96c341c627c3f193e60616e37052238
SHA1 edd988cff66378e4dc17c394cecf38b599d0a383
SHA512 da9ae424fee00deafa8212c20098e7714fb4b8caf30a7abec5d1de696034db05c74b738c435a9eb1c73d52d02364715feaedfb499d9e499fb29adebb478507d7
TLSH
T1FB61967A758D5827AEE7E455F8433A13DEAD00977E142F40C3F90F2C61A6BC91316523
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 4KB
SHA256 b63c1117fd587b0a997dcad916a4a8a0412258c52bc9f914ff72e83c44695de3
MD5 343f2cd515ce93443883e6b8b59b726d
SHA1 d9cbc6ab29ff93cd89faadf0588b4de7788d3389
SHA512 ca80645c5383030478887650e7404b2d363672ccbfd43cbb56e21abbf6d400bd143a23fcf3798a3c6f1a9b4deb81ff3e38b6bdd24e6d84967f23bc74eb7a35d9
SSDEEP 96:OMfDJdWVhLrRbbmpiZoKzotol5dCek8mCG3ge4FaA9RyEF2Tka:OQTWVhLFbbmpOzU0HcCnaAnyEF27
TLSH
T17CA1C76AB989953B5FE7C255F94B2B43BFE9005366446F4083EA0B2D016AF8D0316212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59388b.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State~RFe59388b.TMP
Size 3KB
SHA256 dbf63fa9efd5831dd8fdac81392cd7340adc61ff39763152bf915f42973894a1
MD5 17e6cb6e8dce2177b4b22f7df17c3234
SHA1 ecda4373cdf80b497ca8d5912806ab98711d9f76
SHA512 11b3c57ec72c55a0669f4fc7262eba7d5d0e09d369756bff9df1aee589a579e50eb2144f385dbf72183fb066a6e3a5071d1c4c42745bea6fbd7c942adfd6a2e3
TLSH
T13961957A759D5837AFA7E555F8832A13DE6D009B7A142B80C3F90F2C51A6BC81316523
MD5 SHA1 SHA512 TLSH

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache
Size 89KB
SHA256 0f9a03b26f7dbc80ced0fd6c21902ca14d1b79ab5b69514c03ce1bd5aa4666b7
MD5 776d6f7eb4e6e02010759d5f90c1bed6
SHA1 7ead33988df16e43e251477841e578ede68b96c4
SHA512 f2dda2cf23088053f2cb9a56d61bcb043448a446232fc89c0457a2c2c1552f63aef1f4bd3be01fc901aadc01d2790c20e242e9afbd68808bcb6a6b230aa9edf9
SSDEEP 384:y5mSoFSo7XpXD9o2h0WUmb8w3soDYHuZEQ+5wLx+1uqLfsvNrGqKdBRJB8/kN/u2:d1fHHkfmSWAUrhmEoKK/R
TLSH
T1D093131813F81366F2B78FBA6DF4D9179536F8269C12CE9C0251A38D0855A25E872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Module Info Cache~RFe599996.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache~RFe599996.TMP
Size 87KB
SHA256 47a8c7209ee7fca8027c9ef76049ad9b37abd6df0c160d7f2fc0cefa22aa3e2f
MD5 18ade5ed6134eb6e4c565651cfe843fc
SHA1 6b16b767ffcc8d85685f04e1daf082694aa3027d
SHA512 edd241e40e340dc80c735e69af5869f3aac399f9ef415d5d7c23995b7551e532c8f577fdd845fb9990d44433fad73bc1701df0fda5b0bf5518294da7af995a4b
SSDEEP 384:35mSoFGDD9o2h0WUmb8w3soDYHuZEQ+5wLx+1uqLfsvNrGqKdBRJB8/kN/uYU7Qw:UWHHkfmSWAUrhmEoKK/k
TLSH
T1D593131813F81366F2B78FBA6DF4D9179536F8269C12CE9C0251A38D0855A25E872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/796-87-0x000001F496820000-0x000001F496B13000-memory.dmp

Download

memory/3640-99-0x000001BF17A10000-0x000001BF17D03000-memory.dmp

Download