b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de

Analysis

max time kernel
152s
max time network
220s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nagasagi Yokai Tales/Game.exe
Size 2.0MB
Sample260827-ef52cszajb
SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
MD5 f760c2f862cf7d98b570bae41364e05d
SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
TLSH
T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{10E95E00-6F30-4FAB-89CC-B1DB871856C6}	Game.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5204	Game.exe
5204	Game.exe
3496	Game.exe
3496	Game.exe
2340	Game.exe
2340	Game.exe
3696	Game.exe
3696	Game.exe
3116	Game.exe
3116	Game.exe
608	Game.exe
608	Game.exe
4768	Game.exe
4768	Game.exe
3412	Game.exe
3412	Game.exe
5548	Game.exe
5548	Game.exe
2264	Game.exe
2264	Game.exe
1352	Game.exe
1352	Game.exe
2224	Game.exe
2224	Game.exe
956	Game.exe
956	Game.exe
956	Game.exe
956	Game.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3496	Game.exe
3496	Game.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1228	3496	Game.exe	88
PID 3496 wrote to memory of 5204	3496	Game.exe	89
PID 3496 wrote to memory of 2340	3496	Game.exe	90
PID 3496 wrote to memory of 3696	3496	Game.exe	91
PID 3496 wrote to memory of 3116	3496	Game.exe	92
PID 3496 wrote to memory of 608	3496	Game.exe	93
PID 3496 wrote to memory of 4768	3496	Game.exe	97
PID 3496 wrote to memory of 3412	3496	Game.exe	98
PID 3496 wrote to memory of 5548	3496	Game.exe	100
PID 3496 wrote to memory of 2264	3496	Game.exe	101
PID 3496 wrote to memory of 1352	3496	Game.exe	102
PID 3496 wrote to memory of 2224	3496	Game.exe	103
PID 3496 wrote to memory of 956	3496	Game.exe	104

C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\rmmz-game\User Data" --annotation=plat=Win64 --annotation=prod=rmmz-game --annotation=ver= --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ffb3fc46ec8,0x7ffb3fc46ed8,0x7ffb3fc46ee8
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=gpu-process --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1632 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=1964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2672 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\gen" --force-color-profile=srgb --no-zygote --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --nwjs --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2708 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:608
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=3788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=4048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5548
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales\Game.exe" --type=gpu-process --field-trial-handle=1576,8896988420096524211,13516225879631151699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\rmmz-game\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Nagasagi Yokai Tales" --start-stack-profiler --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Crashpad\settings.dat
Size 40B
SHA256 a153103c5c7b596be56287de3a57f45d9dbf70857c4b2d32773b897c23b7a9b7
MD5 b68873eacebbef54ac6f445a029493c8
SHA1 9cfd012aa87cff34fd3b4e003451d089ce54c095
SHA512 4d5b14348a4c88867dec0771ab37bb4a45434d6472a8f22cc72d6f2c14bc8d6dce41663a623eb5ca9a877669594e1fa9957dcb8dea3e03cb6909da80e4badde9
MD5 SHA1 SHA512

Submit Download

5f449232-63a2-4450-b2e4-03cc08e4d454.tmp

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\5f449232-63a2-4450-b2e4-03cc08e4d454.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b6adc.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Network Persistent State~RFe5b6adc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 e53cf449ef5f9d3072f1b9dd4e22b6b623c0e25da5c11aa9e716922b9d49d987
MD5 b5698d991352424be8ee655b4bbe7628
SHA1 a47d47a1ff116cd9a1c00700f89abca477d440d0
SHA512 c921ae9bf41cd424b85f8b9a6ac629aa1839bfaf50149826e7f0c5a60261825c54a5556ac035e7731efa8ea9a2be8f4223e71397ab83f1676b2e3d0b488e3682
TLSH
T1C261C8465A549CB30CDFD22DFD453E93D5FA04604AD11D44ABFCA92C0C9DADE2217837
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences
Size 3KB
SHA256 a2bec2e2b7c2e5922e7ab53d6dca24c503d2d37d0d8150ca998034a5cbd23946
MD5 ba1fa86b74a34e1b47903c4351855b5f
SHA1 18b1c01fab645ee79e1d6fbade4f11a4aa5b0898
SHA512 9d832f052cff73e8be335e55c51162c8eab42e8c94458f52b811fd92ecd54c18ba789373da276a52c87a59294c0091eaedc0af5bafc589509ee9707a96f16b68
TLSH
T12551C6465E18DDB74CDED22DFD453E93D6FA006049D10D44ABF8A92C0C9EADE235B82B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe5ab8e1.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Preferences~RFe5ab8e1.TMP
Size 3KB
SHA256 d60eb8a95db9bb127d17ca981a148dae9ec6788fc84681722994e260e38069c9
MD5 a0dafa3d03042d2df1a7a1b3220a993e
SHA1 bb7bdeca8cf2f4a9251f79b85f1fd2a344809ddd
SHA512 b837075214a2adc8d841f8a4c522dca062a493b45b45e92a0704bf01775a9b90fdb2c70efbf92c75b63a3d740090d1d18712f27ecffad2079b92e110bc9e6131
TLSH
T1F951B6465A58DDB70CDED22CFD453E93D5FA006049D10D44ABF8A92C0D9DADE335782B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity
Size 203B
SHA256 3f92a8d0813810be482e72b4a4b8b76bcd720b669ed9baadc57006f74099a625
MD5 ad3398c3436b56ecd93cd3b53b18b969
SHA1 8bd11f327536368419e5bc3a6876c60483126033
SHA512 b9a072076db7d6822cba1d905cd110698264c65be9f9c5482893d139c521a32e17aaf9c0d0d913d3cc49e94b984f9f03afe8ed0d59afd26675e41a054464e356
TLSH
T121D02272407DF4B350F80ABB4980EE0A6EB6B234028169E8D592813C908426B6907123
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5b55be.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\TransportSecurity~RFe5b55be.TMP
Size 203B
SHA256 38d8f3cd279762670e43e9bc7b402eb7150b9710398a8646a8beeb545b21299c
MD5 db878cd9460f536a2002011958df9a2b
SHA1 448114c97a7694a0052712ac81192b3443d533cd
SHA512 2e9af6bf4df9901b7e926f6a81247690ec5c2ea47735c5be064588f37d36657e673c3e2f2e5d2cf30328223f5d7dddf6913ead3e1d6ad2bb9b423f82b8f553ce
TLSH
T103D02272407DE8B310A80D220AC4AE855EBAE035028178E8D9F3C13CA0842BB5B07803
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 6de614ef16011059a53288fe908c31f2b5b62009444acdd0cddc3c8ebb876265
MD5 06d963326ef7eb0d59817e9bf3aeca7b
SHA1 83f98ce954bb6cfff3a762f6102e93f0915b3020
SHA512 0be2ae3dfc819cbed3505699f58efe4298c75a19b27e11cb8bc37d70a87a8dfb7ac49a26d588ff0ebb93943ead6ca4c0a18e92ddc8fd8f208f320bed17834a7c
TLSH
T185618635B6D98C36AEA7E449F4873E13DE5D10576E542F40C3F80B2C52ABBC81396523
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 4KB
SHA256 fafabfabb90c3346495375bf0f0db7aa38c62ca4e3e04399bbfb91babb6b53e2
MD5 72698913d1e84f96d5dae97c47f5e510
SHA1 096457240542bd347fdd9008b1bb200f0d54c666
SHA512 739cc01993efc0a1daf21d7889d02e02680fce1e921d121dad3389ad8be2641afbe8610a2a1afac338b108d5fdea41dd316f95f196c03f4eaa4d5e7e320e991c
SSDEEP 96:OMfKiRahLrRbbmpFIKzotol5bCakr/Ug3ge4I3A9Ry4hb0ka:OLiRahLFbbmpVzU0JBw3AnyaO
TLSH
T178A1B866B589D93B5EE7C145F94B3B43FFED00536648AF4083EA0B2C066EB8C0316512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State
Size 3KB
SHA256 09e2ca681eb2b52c6d3bcf556c5e169f32ab6fc19230e02e4b003025d66295c6
MD5 ac8ef6a309bbaf40907fd6375093df64
SHA1 f7a5708d5442bb6b79f4fbbde8a510de94acb1fa
SHA512 ac7c11295deaa0e147e9d3e395b22515a0b8fa798086c5fe4b9cef061c789dcd462c30a8df812b655674401b4fca78127b49f72b67726acef230bf01a1adb796
TLSH
T1C8618539B6D98C36AEA7E449F4873A13DE5D10576A141F40C3F80B2C92AABC813A7522
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5aa615.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Local State~RFe5aa615.TMP
Size 3KB
SHA256 cfa71e616ee68cf623d47e6d11cd74152c086fa71e7091ec0dbbc024c67ee8e7
MD5 ce8642c5ac9a376cdbc1d117dca304e0
SHA1 61ee33b2a62a7a1bca7413e626f69245021af5f9
SHA512 2393aac9f913874065b4343d1b047ef398f9a05c4f0d0af4786b833be445c829bb2ac13a8d8921aee608a1bd16f60cf1537ef525de0b6afb5804048e97d356e9
TLSH
T12161A739B6D98C36AEA7E449F4833E13DE6C10576A141F40C3F80F2C52AABCC1397522
MD5 SHA1 SHA512 TLSH

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache
Size 91KB
SHA256 1ce07b85df28067ce4f8e644941c7c6a4c87ebb7eaeb79d7e7af39c318ec113c
MD5 100e74d7e5ce3a12f8daa6ee44cd7cce
SHA1 921fc68ff88aaa72f4737ce8bd370c204bad13a1
SHA512 f36969386947cee9d87b63f1834535d2c658f554f63104d070b01d0f5368ca2d52e9c11399d5ecc2078b76ab744321a700bdd6a57632352a63b5d8d2d4153c33
SSDEEP 384:MM8f+ICzDLvXsaaYoJbsrKtkCSpzL9PMbMR99cPvf93z14vxHDJ4D2K2QpjF9DG+:1JEazlqStGsj1K7+FFWLzKGZkS
TLSH
T1D493151513F80766F2B78F7A6CF4D947A436F8269D12CE9C025263890865B21E876F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Module Info Cache~RFe5b0711.TMP

Path C:\Users\Admin\AppData\Local\rmmz-game\User Data\Module Info Cache~RFe5b0711.TMP
Size 89KB
SHA256 5924eeaafef2b5575c3447df38cb10426234eb9045a342fec266b20834e98353
MD5 0dcf0adeecc7c9ffe0f870ff58e25886
SHA1 4639da89b62c6b3271ceba647466a060b5758e1b
SHA512 6f042c4d6ad821bf0f619971957b00f2afef5f4b7808c9afc3e7a904ab5c3901ef7d813eedd2573a4e3c47f78a38bed11caa8ad24a629b201b22206d38c9139e
SSDEEP 384:VM8f+I1DYXsaaYoJbsrKtkCSpzL9PMbMR99cPvf93z14vxHDJ4D2K2QpjF9DGgxO:MCazlqStGsj1K7+FFWLzKGZkH
TLSH
T16693151513F80766F2B78FB66CF4D947A436F8269D12CE9C025263890865B21E876F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download