b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de

Analysis

max time kernel
149s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B.Z.M -ϐ_W𓥔jI-/GameFile/Game.exe
Size 2.0MB
Sample260810-ba41bsssf1
SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
MD5 f760c2f862cf7d98b570bae41364e05d
SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
TLSH
T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{4358EB6D-39FE-4047-B45B-310E5E7D734E}	Game.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{9B03CA93-6F1E-4558-A1E8-E20ABE6FD35B}	Game.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2740	Game.exe
2740	Game.exe
4712	Game.exe
4712	Game.exe
1524	Game.exe
1524	Game.exe
4104	Game.exe
4104	Game.exe
4428	Game.exe
4428	Game.exe
2808	Game.exe
2808	Game.exe
2972	Game.exe
2972	Game.exe
4256	Game.exe
4256	Game.exe
1304	Game.exe
1304	Game.exe
3292	Game.exe
3292	Game.exe
5852	Game.exe
5852	Game.exe
1776	Game.exe
1776	Game.exe
2856	Game.exe
2856	Game.exe
2740	Game.exe
2740	Game.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2740	Game.exe
2740	Game.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2388	2740	Game.exe	89
PID 2388 wrote to memory of 1836	2388	Game.exe	90
PID 2740 wrote to memory of 2808	2740	Game.exe	91
PID 2740 wrote to memory of 4712	2740	Game.exe	92
PID 2740 wrote to memory of 1524	2740	Game.exe	93
PID 2740 wrote to memory of 4428	2740	Game.exe	94
PID 2740 wrote to memory of 4104	2740	Game.exe	95
PID 2740 wrote to memory of 2972	2740	Game.exe	98
PID 2740 wrote to memory of 4256	2740	Game.exe	99
PID 2740 wrote to memory of 1304	2740	Game.exe	100
PID 2740 wrote to memory of 3292	2740	Game.exe	102
PID 2740 wrote to memory of 5852	2740	Game.exe	103
PID 2740 wrote to memory of 1776	2740	Game.exe	104
PID 2740 wrote to memory of 2856	2740	Game.exe	105

C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
"C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff8aa586ec8,0x7ff8aa586ed8,0x7ff8aa586ee8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x1dc,0x1e0,0x1e4,0x164,0x1e8,0x7ff7acc81f30,0x7ff7acc81f40,0x7ff7acc81f50
    3⤵
    PID:1836
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=gpu-process --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1672 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=1912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2472 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2576 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=gpu-process --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5852
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\Game.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,7391653400046635116,9822865482583654905,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile" --mojo-platform-channel-handle=2140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad\settings.dat
Size 40B
SHA256 f569e0c3d6a187b02962a2695172091f81890795f1e4a308fc33ff596b789ed1
MD5 8660eba2d1f69eb670ea821d9880131a
SHA1 5aafb9fcba29e0e707544f76fcc609325686b274
SHA512 bbf0554f1c9c4cbdb8bf9fa203c930f71c9665a14d1b3d47e56387c04f83e0359c24b7d187368716f0f4aa70e427cee8875e52a38b4a056d53f80f9072362501
MD5 SHA1 SHA512

Submit Download

54817c65-c92e-4ade-8383-b92146cfdb55.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\54817c65-c92e-4ade-8383-b92146cfdb55.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a5e5d.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State~RFe5a5e5d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 2KB
SHA256 4505015c92ae122b0071db850bf0b56e8fbfc7896d22e948ffc04617c9b6f59c
MD5 a8e74e91f71e32cbbbd001b63afa19b4
SHA1 cf50f6506439b3a1ec3514a7810483202d8da1e8
SHA512 ed3373a34e8965918caf7a00ab81e370f47d03585f541c5977fe8d8deb5d67d305413fdf1ec5b45cbac3043c53a7a57c20d9746a99815080f36ca05a5d02fa64
TLSH
T14951C6495A14DCB74CDED228BE063EA3D1FA016149D11C44DBFC6E6C089AAEE2217827
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 faafd74a5f9887a364582a5b46bb7365e8dedfd26e390a3f1bd92a0a1e50c04a
MD5 1b142feef565aa57e981fccefd8ed87d
SHA1 afddbf9a05eb2f60a58bce2317116b3ab7e56024
SHA512 e2e79376b9bfc7b89bbe9e644cbe889e40cf2d3ebd3c979364530f86e309dc53ea3387abe358472bf92475e7365d0f32e249ed7ddf9692cdbe22341289acda16
TLSH
T17561B6455B149CB30CDED229BD463EA3D2FA11614AD11D44DBFC6E6C08DAAEE2217827
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe59abe6.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences~RFe59abe6.TMP
Size 2KB
SHA256 00a9b27339123d3cfacb43694db5ed57cb5653019cc630a40e42b6fb438eec3c
MD5 2106d654b19e0f58904c01a0d75fca9d
SHA1 112239eebeec39cc79062f8f0818ae2c9231d0c7
SHA512 1f5d227cd5f1e9e3e92a0c3b80f239fa4e1758e02a1c406850e81b63510b4c9c747e1bb90f068a050aa52af9feddda53e07fda77bcde8d5b7632f782329f0199
TLSH
T1A151A8455A14DCB70CDEC228BD463E93D1FA116149D11D44DBFC6E6C089EAEE3217827
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 201B
SHA256 71a2e852fd24031c66218eb08aa96498b04f3ba30e8a7672b3ea2804f2c0ba50
MD5 372f504e867cd85e0f39fc61cc335426
SHA1 d47cb7600b110536b7e663e5dd0f2dcc3d174661
SHA512 94b8ecd6625a555e30d31d89984056d5cf7f69f1ca08cbaf30fb6eecbadea1bd8bc28f1b737085f3a44b066db7738c5e7082b584777ee5e56faac04095aa2ab2
TLSH
T10AD02262006EE47B20280A651B80AE016FB7A234428194E8E6E68A2DA1840678523403
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 203B
SHA256 4281cc6487f3e17289e6ed4a391d2419e3ca34ce2266ace809af470bf01b39a3
MD5 63ab159ac929d831990b36f4e6b05eea
SHA1 ca591e310bdabe96ff3f58564aefab2f858f51d6
SHA512 33173522624b9915c87780f4f0dd48dec99e640c7876e2eda21822ca1a87bde7edb9541d0f46e64edaacaf394688f9d227b282e542b7f8ac496e10e16b5e0b13
TLSH
T115D022A2402EE43720380B220B80BE01AE7AA038028168FC9AD2456DA2A40779503023
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a48b3.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity~RFe5a48b3.TMP
Size 203B
SHA256 2216715c6db9cc85bb2f28bd58ed95c5c4eb50838ed37c0018e4a23d36ac3f54
MD5 0df8d825ef06f6c205f22a6c7edcd8cf
SHA1 87e4d3dd480b2a40f6e3696e0374dcc3188d11df
SHA512 44794377e57170da6d76fbcf55b04bc8d5a49b3404535ffe62b65ff52c2d78a452dc02ad4edfc42a30655f93e39bde975a4f36c8b99fe3ac118caef5d8777e59
TLSH
T165D022E2002DE83320280AA10DE0AE01AEBAB6390282E4FC97D2422CD0D45AF5603403
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 0e5f70203006eaf639c030e2578cd54f979edc396d4f83af0758b13583505dd5
MD5 aba131411f082f88768ee89fb2e980a3
SHA1 d5d81512a98b7fe379cb65bc792b217840ba8fd5
SHA512 8b0796aa02203cd670697e5d6428bb63a18545e5d2587fda38941eb41db7c73c6a50e7db379cd2402eeea995521b598d0ed368af0afdab6e5c5ad0db519fa506
TLSH
T13B61843A76599837BE97E144F8833F13DE6D109766146F80C3E90E2C4196ADC2357117
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 8a5758091c59e63d4e61a157805562272e5287fd4ab3ffd834c5277565204ff7
MD5 93be3a00adccdfdd80323f8c732b96ed
SHA1 4c271ca0aa0ef5669c2d4eb6d855ce9696d45e40
SHA512 70cc4e33cb7db251917a1164d5d965d57c3a73b39a58291338b8593842b8f707989938f702c7198ff8b71aaa97e075f106af4c31bd6a097a5b31a6a153fcc2be
TLSH
T1EA61723A66599837BE97E044F8833F13DE6E10976A542F80C3F90E2C41A6ADC2357517
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 4KB
SHA256 fdd1d341c8f06d9ef1d575cd6f65f3b3d986118dc7a21943c006472935da4798
MD5 878198535ca9c686be5b3cf92883aa13
SHA1 1d1b55719f839a3f86b2b066a17dc42bf3575b38
SHA512 0db71c60b1f3799f14054ee0c44c9041ace1447e609ff462434ed348d600dcc4de1db5af7066ec7260430045fa428b902e39b9cb6871ced5e2b414c7e19037e2
SSDEEP 96:OMfgrB5ahLrRbbmp1VKzotol5AC4k0hsJnG3ge4FOA9RyxXka:OVrPahLFbbmpmzU0MDonnOAnyh
TLSH
T1A4A1976AB645953B6EE7C245F94B3B43FFAA00535244BF80C3EE0A2D056AF9D1317216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe599977.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State~RFe599977.TMP
Size 3KB
SHA256 369396e89f0a5a950b1840a9d5c3e7af0dc897b7009a4010ed20460649267690
MD5 97d6124936f4fe20104d97f091c4be23
SHA1 a5d3af81b6b43f425ecbd169c4756cf3e38477b7
SHA512 24d2f5121ce161866224008c6b5fc528ab1fc4235d9e7f6e2a59f87e3db4a1b910b8cb6d3258c168aa6a667a3b9106bd82de7895a59b7642db133e578057154e
TLSH
T1AA61733A76599837BE97E145F8833F13DE6D10A766146F80C3E90E2C41A6ADC2397217
MD5 SHA1 SHA512 TLSH

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache
Size 93KB
SHA256 c22594dc208e7f346ea7bc77ef9142fbdb17e8818a50a49c201cebb33335cb5b
MD5 d1251db0649d16fec1718bd95742d2c5
SHA1 493cd8fa7d2f38196a5d1378a1b5d643cd6cc14b
SHA512 7ae818a0db3926cffa58f242d289a4ad336149cce3427886ca31e593907b47c614b3356bcdb9b291fd255e4c2efff3be6d6148c664de353e51d962abb6e6fc9d
SSDEEP 384:710PiLIan7fTD0aykoZTgvKFU6GctazXZnMLMh9h0nDL9Lzpk/9H/JgryK2MRnF7:BLFka/x2GctwmIfNKrW55uDTKWF0U
TLSH
T14493151513F8076AF2B78FB66CF4D957A436F826AD12CE9C025163890855B21E872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Module Info Cache~RFe59fa16.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache~RFe59fa16.TMP
Size 91KB
SHA256 c4caec376254520173ea4369a492abd57ccd1fb51d300bf1632e9ef19721cc3a
MD5 c9c59acca611845d5ad11e4518ef68c4
SHA1 4a6cde58d10fce081a9098e5daf2b74fd233f220
SHA512 875548f30105721c41b8bcde76392c1e8dd1f881f96ee882bc32fbd9498b3cec030c7fa95ba45c623b8b41146b7a837bb01e8ab9e01b0d8abfc75e29e4ff913a
SSDEEP 384:O10PiLIN7MD0aykoZTgvKFU6GctazXZnMLMh9h0nDL9Lzpk/9H/JgryK2MRnF9DS:eL+a/x2GctwmIfNKrW55uDTKWF0b
TLSH
T19893151513F8076AF2B78FB66CF4D957A436F826AD12CE9C025163890855B21E872F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\ShaderCache\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download