b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de

Analysis

max time kernel
118s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HermioneShop/Game.exe
Size 2.0MB
Sample260628-kkpg3ags2z
SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
MD5 f760c2f862cf7d98b570bae41364e05d
SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
TLSH
T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{E2D29D68-90CF-4710-B802-A021BADCDEDC}	Game.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1984	Game.exe
1984	Game.exe
5868	Game.exe
5868	Game.exe
6064	Game.exe
6064	Game.exe
1460	Game.exe
1460	Game.exe
4932	Game.exe
4932	Game.exe
4752	Game.exe
4752	Game.exe
1208	Game.exe
1208	Game.exe
4248	Game.exe
4248	Game.exe
5380	Game.exe
5380	Game.exe
1480	Game.exe
1480	Game.exe
3360	Game.exe
3360	Game.exe
1868	Game.exe
1868	Game.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5868	Game.exe
5868	Game.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 3788	5868	Game.exe	89
PID 3788 wrote to memory of 796	3788	Game.exe	90
PID 5868 wrote to memory of 1984	5868	Game.exe	91
PID 5868 wrote to memory of 6064	5868	Game.exe	92
PID 5868 wrote to memory of 4932	5868	Game.exe	93
PID 5868 wrote to memory of 1460	5868	Game.exe	94
PID 5868 wrote to memory of 4752	5868	Game.exe	95
PID 5868 wrote to memory of 1208	5868	Game.exe	98
PID 5868 wrote to memory of 4248	5868	Game.exe	100
PID 5868 wrote to memory of 5380	5868	Game.exe	102
PID 5868 wrote to memory of 1480	5868	Game.exe	103
PID 5868 wrote to memory of 3360	5868	Game.exe	104
PID 5868 wrote to memory of 1868	5868	Game.exe	105

C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
"C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ffbcdae6ec8,0x7ffbcdae6ed8,0x7ffbcdae6ee8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
    C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b8,0x1e8,0x7ff7ed691f30,0x7ff7ed691f40,0x7ff7ed691f50
    3⤵
    PID:796
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=gpu-process --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1640 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=1936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\HermioneShop\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2536 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\HermioneShop\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2756 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=3840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=3904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5380
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=1544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HermioneShop\Game.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,511364059953383084,13255555099196096734,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HermioneShop" --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

3fd37cbc-2936-486c-93a7-c3d0029407d8.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\3fd37cbc-2936-486c-93a7-c3d0029407d8.tmp
Size 4KB
SHA256 5b0fa624bb414a75fb01f563a5f86922763902c2f2ad51827dca0460e443ab12
MD5 d63fdab2402fea854e3611d7cfc3bb65
SHA1 91bf5fe782f6723adffaf74647b43bde47f183d7
SHA512 981d11c503cafb77aaf55e69a326ab4d763bf0eadbd5fca79e192eeb6206c5d6cc11da84d89458e056e5eb9a326b50ba9fe2a40b258cc3f3973603c62f6a1033
SSDEEP 96:OMfuBrwTt4K6hLrRbbmptJXKzotol5ECCvnkVr1r3ge4I+KtA9Ry6tZka:OXweK6hLFbbmptEzU0EhnA1H+AAny6b
TLSH
T17DA1B87AB549943B5EE7C155F98F2743BFAA0053A298AF40C2EA0B2D066EF8C0316517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad\settings.dat
Size 40B
SHA256 fd1940f310d9c8c14ace7c2cabbbc40fca02ad69cf09f5fafd4ce49c9c81f070
MD5 1b74812916f928c4d0b39770a51b7692
SHA1 d55547f416a341e841d95434f4621ea88d0ed602
SHA512 fb28b8b8d14efc4d1da6fe21d41afe01aeac7a0a399aa82ec65974d955c31efb2ba34952f6866d0cfea16c3b5bffe86904c8c3da11c8f0f347280d7d44016c98
MD5 SHA1 SHA512

Submit Download

404e7aff-8875-4352-9a68-7001ab2c4c46.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\404e7aff-8875-4352-9a68-7001ab2c4c46.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ab288.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State~RFe5ab288.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 14701290f49de538d0c32c5f910317edea8f8163a7228142a1566024f6dbf4fd
MD5 4a2a02b0af29af23eaa16c069c9ee5a1
SHA1 6074f2cea7d835edec93acc09d84f3877d9971bd
SHA512 697c3ff352ba1d4fbbff70fca8a8be01a1e7d6e9b33fae49851a81f16fea443fe7b08c680447a8aaee25c2bef31d531715c672bb14b7034a7fb378b3aaf25a37
TLSH
T1F551D9469A18DCB34DEED229BD453A53D1FA40A089D10D449BFC5A6C0D9EADE231B827
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 29318668c10e4d9dce459bd1ed4082d7ba4d1048440583860314dc180c111bef
MD5 1b56fb38edc8a3d388c10e7ad63542aa
SHA1 ea2efbe6f05872253e7d983e23b30fc630445a2a
SHA512 dd98b616c925cd2c9608d0b81a9ed60fc48f302772ff56182de0e31fafe257acf476f81a77da4c3eaaa404751cbe9e87bc40b2e987b4ff043bc0c0e7f7760bfa
TLSH
T18E61DB465A149C734DEED219FD493A53D1F640A089E11D449BFC5A3C099EADE221B427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe5a00ec.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences~RFe5a00ec.TMP
Size 3KB
SHA256 321abbcecccf2884ac19a7635666acf75f99898cc3e09e6c944c42e0eb63897f
MD5 f600d2446ba54a94742635dd56d2cdbd
SHA1 2b63253e7f30901f99e8c746681b0d8c2394454e
SHA512 1c11d4aa4b1720e139f826c1c083506d60b5e938e43c9a9e0d6b4fc0a71f8e17d0de1e949dc174696f08346ffb51c0149071bd8bae4f10a3614b110cfd2f1e9a
TLSH
T12051E9469A14DCB34DEED219BD463E53D1FA40E089E10D489BFC5A6C0D9EADE2317827
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 203B
SHA256 290e19ff42c7152c7fba19d42a9e4ffe6605b8ad5db2cedf9007b9193ac34133
MD5 52c5874018af1682fd5fad4b219591a6
SHA1 5c231f6915d610bc49fd8d759e083b1b13ca54be
SHA512 f28325bf0a5457d4ef9e479aa9e381b6f42c90005c8f64b08186604cd5015cc4f0da5b5933c71e56956dad7b63a8d8d4544b3d47ccaaa543f26c4ed2b2f420cd
TLSH
T152D0226200AEF43710380A614EC4AE05DF7BA134068258FAADD3452CA0882BB6703007
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a9da9.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity~RFe5a9da9.TMP
Size 203B
SHA256 fe5e926cf559520034d476670b8f2fdc47e673d2d35fd27ffbdeb77f93c21ebd
MD5 5af8e607c6547b4a689b162bb6b9fe47
SHA1 86c60595668c6441099cb22d36004d43680ea95c
SHA512 96354f86dcc349f3ca5da45d1baeb68ee4df16b0706dc7d6d3f81330ef287843350c539460666b3c8cb0b26e9273836b21a57bfe81b32dd7696030d3fb157e3d
TLSH
T192D022A2007DF83720280AB109D4AE0D9F76A0350383D4ECBAE3472CE0940675A03203
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 c4b869b224ed0a3a14eb2110724461e9033caf2003622463f1cc54ebeea9c7a3
MD5 0381245eb12c0cd149ce79bb7a3bcb15
SHA1 495b520b0e0b8321b30a9b3929cce204fe2faaf4
SHA512 c3d635aece7d5f54c8132d4fe2b15b772edfdee100e62732f8e908a464726bc06657611c8ebfe546d51012ae96f4dd73c0d8d3b9b981bf656e5f77789772a7ed
TLSH
T19F61857AB59D8827AEA3E055F8972B13DE1D1057BA586F40C3F50F2C42AAACC131752B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 133525f097a122c77bb6ff8822804cf33f7603af5b478c1e972c02729f56fe4a
MD5 a5a9fe31a2b7222eae1230b0162ccd44
SHA1 8d8adac3686e2dc4450e15b65f4abd145a2034ef
SHA512 721cefaceaa2deaf3ad7aa6ce4d486b776dcdf22efb6a722859674ce54251c51930179017ee1fc3af9d474f5f97ffb428c8b816a0feed1b66a8f4cb9ac35a68a
TLSH
T1AB61957AB5998827AEA3E041F8872B139E5D1057BA582F40C3F50F2D42ABAC8131752B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59ee7d.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State~RFe59ee7d.TMP
Size 3KB
SHA256 c9fead3450b127f015cd1eeed726b08e92e59df4bd1232b9d4259ff62c3b893e
MD5 10e4a107834cdf746824b81bf16ac416
SHA1 d8474e8d2fa4dcb993d6015ea2ade7aeab69b440
SHA512 1d5feee190e7c1a29b931338b92561feb95795e177746a8809c1aa1b440c9155490dd5ec11d57f37c83f0c6a2b16e7dfc2ae865eefb01a817b7ae0f93d4eddc3
TLSH
T18761867AB59D8827AEA3E055F8972B13DE1D1057BA582F40C3F50F2C42ABACC135752B
MD5 SHA1 SHA512 TLSH

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache
Size 91KB
SHA256 fee1ac5566c66b2ad5c312987c9530596844da426c1abd410ead29db30e9e1cb
MD5 5395015d049852552e85fb19f877a5d4
SHA1 bf5dacffb3ede182cdb9a1f03d615c0658ef6a99
SHA512 8c2df1342a5c38b7735ecf8c6b550cf6cc3d6f73e5ec5a047ee95b4a0ed599576b1b9e6c6b8374846b6b5a90165fb0c24d1e52ee213102c3bb1f11e5b9cdf123
SSDEEP 768:7SuxzKY7/aqKVzZbr9ONWsAK583nW5qCdTUET3rabOKCo0b:hh2qONdKqMX19
TLSH
T16493151513F80766F2B78F7A68F4D947A436F8269D16CE9C025263890865B21E872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Module Info Cache~RFe5a4f89.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache~RFe5a4f89.TMP
Size 89KB
SHA256 83f410d0f17784ea37832b2f7f516ad73ffd899510fdf1c2a739bb03ecd42a95
MD5 9e9eb526c76f7be48559b15ee2f80274
SHA1 b7c03d4e70de8ca200b000d08608c5faf0be5bf5
SHA512 01ec20b5dae6cb19c7ef843c63d3e0e020817a04aad58ee0ca3787a0392137ca0125d31908589d5730c6ce33352d360e30a0e4fb40a72447d2692977034c8bd5
SSDEEP 768:oSuxvGaqKVzZbr9ONWsAK583nW5qCdTUET3rabOKCo0/:g1qONdKqMX1p
TLSH
T19393151513F80766F2B78FBA68F4D947A436F8269D16CE9C0252638D0855B21E872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download