b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de

Analysis

max time kernel
118s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HermioneShop/Game.exe
Size 2.0MB
Sample260628-kkpg3ags2z
SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
MD5 f760c2f862cf7d98b570bae41364e05d
SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
TLSH
T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Game.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{2D9A110B-BDC3-44F6-8201-E045D8E0F12B}	Game.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1352	Game.exe
1352	Game.exe
4492	Game.exe
4492	Game.exe
2480	Game.exe
2480	Game.exe
2480	Game.exe
1432	Game.exe
1432	Game.exe
736	Game.exe
736	Game.exe
3544	Game.exe
3544	Game.exe
4168	Game.exe
4168	Game.exe
3248	Game.exe
3248	Game.exe
2000	Game.exe
2000	Game.exe
696	Game.exe
696	Game.exe
5100	Game.exe
5100	Game.exe
3612	Game.exe
3612	Game.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2480	Game.exe
2480	Game.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3280	2480	Game.exe	89
PID 3280 wrote to memory of 2948	3280	Game.exe	90
PID 2480 wrote to memory of 1352	2480	Game.exe	91
PID 2480 wrote to memory of 4492	2480	Game.exe	92
PID 2480 wrote to memory of 1432	2480	Game.exe	93
PID 2480 wrote to memory of 736	2480	Game.exe	94
PID 2480 wrote to memory of 3544	2480	Game.exe	95
PID 2480 wrote to memory of 4168	2480	Game.exe	98
PID 2480 wrote to memory of 3248	2480	Game.exe	101
PID 2480 wrote to memory of 2000	2480	Game.exe	103
PID 2480 wrote to memory of 696	2480	Game.exe	104
PID 2480 wrote to memory of 5100	2480	Game.exe	105
PID 2480 wrote to memory of 3612	2480	Game.exe	107

C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
"C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ffe7da26ec8,0x7ffe7da26ed8,0x7ffe7da26ee8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
    C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x154,0x158,0x15c,0x130,0x168,0x7ff604581f30,0x7ff604581f40,0x7ff604581f50
    3⤵
    PID:2948
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=gpu-process --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1668 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=1972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\HermioneShop\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\HermioneShop\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2740 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=3868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=2268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,10762234647472261602,804430089453930057,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=2040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad\settings.dat
Size 40B
SHA256 778c8f937c1bb1618a23376cabf8dd606e28f6e9baa68faf7fc643dea7d89ecc
MD5 eaff2a7021445d8a550c9915156f6031
SHA1 d219e215a5d0fc8258f3c491b98f22b4ebb43ace
SHA512 bc4e96039b82a343b9d745030662f6a00cdb98d4e0ec6cd3f5085d05ce6ba35fdbafc20f7676de32548893abd11d2764fa68e4078897944ec149c3a0dd88d1f1
MD5 SHA1 SHA512

Submit Download

160e7187-e057-4119-b572-0b74d447e985.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\160e7187-e057-4119-b572-0b74d447e985.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e13e.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State~RFe59e13e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 2KB
SHA256 6cb85b7590d411adee7d80289cc706c2a0d8e732d02c86a190ea3b86fd61847b
MD5 7ddff26f9976ccdfc9c96d219fc93e05
SHA1 220134815f7bb8ff03eb012479b198138497b688
SHA512 befc9a5d8c6db5f135d01e9d18c91a17f5fdbaaeb4bf69df11d5a05e52fb7e33466d361e9d2429642cc496d23e48a6052961f180c01572868de283f6cbc0ca1d
TLSH
T1C951C8465B149C778CDEC22CBD463B93D6F640618ED11D485BF89E5C0A9EADE2107826
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 2KB
SHA256 5945efdcd8a1f47008dba833340ebb29d8b2d3df2e6707c8080585645863aa0a
MD5 a8ca81c09e6351038eabca1d0a39059e
SHA1 bd5a1b996e141ca1e2a0c01e7679a8efbcffadc3
SHA512 5b5b782649fd10f89a61ab1a617d351f957bd45947c055569d3e27e8932ee4f9acffdd4efb27016338f6a025c79c64f8b80f74ef76318b88e1cdc080df380d8e
TLSH
T14D51B7469B14ECB78CDEC22CB9563E93D6F640A08DD10D085BF85F5C0E9EADE3217826
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 2KB
SHA256 217b1438082a408ea7b7c59b8b3025b7f0336e119ed7721310b755df38953410
MD5 a6d42405d9a9eb35eb6e19067ddd8db9
SHA1 c1bd2859e1cae3643b23c5df8f07f22257acfdce
SHA512 4d01210e599ee632212cea481dca6061435b00013fe19dabf9004334f7583c9c515a6a2eca7ce68d9ac77758289a947be2b1201061dfc269669f3fc706cbf009
TLSH
T1BB51B7465B14ECB78CDEC22CBA453A53D6F640A14DD10D085BF85F5C0E9FADE2217826
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 203B
SHA256 c095525103d6a235a7d8b48f5dad8c9b191c28a249c97340188e29d47b87bd46
MD5 ed00e1f25d7dc72df4a96037a8cad5fe
SHA1 f3ef317ba6a02e96ff28a24e78aa393d8d2c4043
SHA512 4ecf5a27d6b6f884ee93204153ed7c3b8508a98edc062a3c82a68ee8e3fd8f2621a1bbdabfd337e4ac47f9a2446451878474d8ad7a6e65415765f5c858fe394e
TLSH
T107D022E200EEE43710384A611EC4AE0DDFF7A13A0282A4EC9992892CF0A40FB450B813
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59cdb6.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity~RFe59cdb6.TMP
Size 203B
SHA256 a2dbd207843b2d3d76decbdff6a69d97f2f8fdee9185e445176116949a957557
MD5 6da1f768968ba8bb311c18b4bffefe8a
SHA1 6e6b7d1b4e48e74b301a6769d784f8c17aa28ffd
SHA512 55916bccb3cfd537a59f4469394b5d46f7fe4ddf18978ff6b5772f8ee90f9c39d1b7e76814a14cd42b12cb96187bfeeb14860c5ffb2c5ec2c7a4deed51e9dba6
TLSH
T1A5D022B200AEE43B10280AAE09C4AE059E7AE036838254ECBED6492CB0480F75603007
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 4KB
SHA256 a52d75bb00e613cfa09d93e2b15b7c0400e94834f12eb4c45a693eb9c86a6a41
MD5 423d6c8234128781c2eec80fc0f5e286
SHA1 22d179025d4114b2cb432cf8c411ff67bb3b194b
SHA512 debbe7e2b878e61e71aaca26c32520092967fd6be874e15ffac14fb3e1d539665147e28bdf27953ba2bc0808b5f0bca7a13250f36c75eb35ebe77de11e899d62
SSDEEP 96:OMfLehLrRbbmppdgpXWsKzotol5ENCvnkXYr71BG3ge4IAA9Rymcka:O0ehLFbbmppdgyzU0ESnB718AAnymi
TLSH
T1BCA1A77BB984D93B9EE7C141F94B3B03FFEA00536654AF4092EA0B2D056AF8D0316617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 1e2415226d10a98a7316dc0d80e01466ecb6be22f3aee379451ac83ca633f4ba
MD5 dd1a65a119c34c2600a1a64ddbe01ad3
SHA1 283b7baa88029f1edcf1934d221722a407a0895e
SHA512 4b0439a96ce047f3e52eb433e805c1388035e80d533dee8d0a9b1d6715456e1eb943d9e7f4833cd69159750ac83630adb0e7477cfe319fefdbc0bfa094a65814
TLSH
T18561853AB6998926EEA7E041F8473B03DE9D105B6A242B80C3F80B6C4196ACD135B527
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 c46f8eb26b4ca0a0eff6c0b48962b55f90969ed3429fcc3a61fc13231189c0ba
MD5 1f5b1b72e0825c431803596303cb9b71
SHA1 764d33f08215f560e529c569fe948bd4b33e5e44
SHA512 dff1cc43f3b5e4843d277dfaa467e7046bbaf2b7b30b4975eb7beb9fbbc0630187ac501a56c4c07de8848d19e2ed6f1d95cce370999dcac41282972b7d812900
TLSH
T1E161943AB6998D27EEA7E041F8473B03DE9D00576A252B40C3F80F6C41A7ACD135B927
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591da0.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State~RFe591da0.TMP
Size 3KB
SHA256 36c7d4d4045bdf5dd9eb6d1657a4c181ba4c4f1e0c3b371ea2190083fc52e060
MD5 37463c2643a2c15290a42e8783962745
SHA1 cbdac384046bea9bfeda0ea1243758995d9d6a38
SHA512 96ca82564c8d1107295a5ea61094780afffe7c2d07a79fb05be5a891622b76fae40fb2526ed58acc8662d8b5c11c94752081ec8f65879d2bcf3e7f19a0978270
TLSH
T1EE61863AB6999D26FEA7E041F8573B03DE6D10576A242F80C3F80F6C4196ACD1357527
MD5 SHA1 SHA512 TLSH

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache
Size 94KB
SHA256 f3b812abf0aa5b9cfbdbd1a7ab2341639721b0e34a72077b8f58af7b2d8cd1d6
MD5 c25eefc2d1bd5fa791baba2483cf674d
SHA1 65f88758bb2be73cb734496c5f9593dff77403fa
SHA512 e8eb8e0a4cc4070a651bac8c1e22797d1bf261d990e620af0c6e2e2a4808b86d95f4d4b73bb94aee0c5d5483ef4ab3754dbb883f5e3931efab38be511471558f
SSDEEP 768:fbpyYMaem+gUKVPsy50/Q15pM5HXzPlHlkov2jKD2GpT:fJeFk0/LNpfZ
TLSH
T1E193081413F8176AF2F74FBA69F4D9569432F8629D16CF9C0211A28D0856A22D872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Module Info Cache~RFe597f29.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache~RFe597f29.TMP
Size 92KB
SHA256 2457b4dc984aad35821c0094c57c892da9659944e414c9d0d2598c491b3a4945
MD5 0940e3b60efc8a86822e9053abdb412a
SHA1 e166bcd8e2975444c1c86f2cdf29a0d7b62986a0
SHA512 b3af026ffb64872867a2524a165447b69f2c312dfc15e181358125f5c16850b5399057f380fb542a30619d990c4ae9db10e090000c3604d99686c66f331e2772
SSDEEP 768:kbJLem+gUKVPsy50/Q15pM5HXzPlHlkov2jKD2GpC:ueFk0/LNpfU
TLSH
T1C893081413F8176AF2F74FBA69F4D9569432F8629D16CF9C0211628D0856E22E872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2480-152-0x0000027105D20000-0x0000027105F5C000-memory.dmp

Download

memory/2480-172-0x0000027105D20000-0x0000027105F5C000-memory.dmp

Download

memory/2480-139-0x0000027105D20000-0x0000027105F5C000-memory.dmp

Download

memory/2480-161-0x0000027105D20000-0x0000027105F5C000-memory.dmp

Download

memory/2480-233-0x0000027105D20000-0x0000027105F5C000-memory.dmp

Download