meduza | 47310c56561c49371d9365b765792aacb7613c8ad566e3f6aec43aa8517e041f

Resubmissions

20/02/2025, 10:26

250220-mgk2kssrbl 9

20/02/2025, 10:13

250220-l868fssmds 8

20/02/2025, 09:48

250220-ls8rcasjaw 10

20/02/2025, 09:41

250220-lnzymsskgn 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20/02/2025, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qr-code.png
Size

21KB
MD5

48405ae35cd148c57494edc4bac3d387
SHA1

8032d3501fcecd4cd50259d24835ca6bc2996164
SHA256

47310c56561c49371d9365b765792aacb7613c8ad566e3f6aec43aa8517e041f
SHA512

928ff81abf044e238cfc21b06b543673baa2198ef852bc20a7fbf58aacfa3df16c4458632714f308a4841070a6478f20f737cb65c1cef423d83ef287c657e670
SSDEEP

48:sQGcxn8CTL6QT0KNHcRtWSt5SmVjCuqJXkYQEB11ov5N:HLnFL6QTZNHQWRmVjck/21S5N

Score

10^/10

meduza defense_evasion discovery stealer trojan

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000028393-2672.dat	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1095212214-1383118828-1037266802-1000\Control Panel\International\Geo\Nation	Ronix.exe

Executes dropped EXE 3 IoCs

pid	Process
5584	Injector.exe
5724	Ronix.exe
5880	Injector.exe

Loads dropped DLL 14 IoCs

pid	Process
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe
5724	Ronix.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
352	discord.com
351	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ronix.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133845186545241734"	msedgewebview2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1095212214-1383118828-1037266802-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1095212214-1383118828-1037266802-1000\{84F21A3F-F27A-4605-9BBB-CA23A4AABA01}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\RonixBuild.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
712	mspaint.exe
712	mspaint.exe
4912	msedge.exe
4912	msedge.exe
5860	msedge.exe
5860	msedge.exe
5768	msedge.exe
5768	msedge.exe
5724	Ronix.exe
5724	Ronix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5860	msedge.exe
5860	msedge.exe
2040	msedgewebview2.exe
5860	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeRestorePrivilege	5860	7zG.exe
Token: 35	5860	7zG.exe
Token: SeSecurityPrivilege	5860	7zG.exe
Token: SeSecurityPrivilege	5860	7zG.exe
Token: SeRestorePrivilege	5284	7zG.exe
Token: 35	5284	7zG.exe
Token: SeSecurityPrivilege	5284	7zG.exe
Token: SeSecurityPrivilege	5284	7zG.exe
Token: SeDebugPrivilege	5724	Ronix.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
712	mspaint.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
5860	7zG.exe
5284	7zG.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
712	mspaint.exe
712	mspaint.exe
712	mspaint.exe
712	mspaint.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 1768 wrote to memory of 4136	1768	firefox.exe	89
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 1580	4136	firefox.exe	90
PID 4136 wrote to memory of 5088	4136	firefox.exe	91
PID 4136 wrote to memory of 5088	4136	firefox.exe	91
PID 4136 wrote to memory of 5088	4136	firefox.exe	91
PID 4136 wrote to memory of 5088	4136	firefox.exe	91
PID 4136 wrote to memory of 5088	4136	firefox.exe	91
PID 4136 wrote to memory of 5088	4136	firefox.exe	91
PID 4136 wrote to memory of 5088	4136	firefox.exe	91
PID 4136 wrote to memory of 5088	4136	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\qr-code.png"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4352

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1880 -prefsLen 27351 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb96425b-1a97-4773-bc73-6e8fca3a0221} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" gpu
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 27229 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a87bd6a2-1aec-4bc1-ae0a-a299156135f4} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" socket
    3⤵
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 3144 -prefsLen 22636 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb19ad07-d845-4624-93e3-aae2ad20a8f5} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4040 -childID 2 -isForBrowser -prefsHandle 4032 -prefMapHandle 4028 -prefsLen 32603 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {298a1e6a-4702-410c-be1f-b2bbfca471b1} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:1876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4832 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4824 -prefMapHandle 4792 -prefsLen 32603 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2406df7e-0702-43de-8b15-55256fc56d5f} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" utility
    3⤵
    - Checks processor information in registry
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 3 -isForBrowser -prefsHandle 5260 -prefMapHandle 5236 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d4dec7d-756e-4ac6-92cc-8a96787a288f} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 4 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5aa69a82-7229-46cd-b856-41956f9fdd3e} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:4868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae2989b2-85b3-4265-b113-74cac14daf9a} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:1616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1620 -childID 6 -isForBrowser -prefsHandle 4756 -prefMapHandle 3172 -prefsLen 27257 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b1f5aa5-33da-44e7-809e-53a160c48975} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5928 -childID 7 -isForBrowser -prefsHandle 5564 -prefMapHandle 2740 -prefsLen 28044 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d098c67-5cf7-4972-bb38-9f866297008d} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:3760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6808 -childID 8 -isForBrowser -prefsHandle 6212 -prefMapHandle 6232 -prefsLen 28044 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f1d264c-f9ef-4084-b52c-55754255650d} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6848 -childID 9 -isForBrowser -prefsHandle 6976 -prefMapHandle 6980 -prefsLen 28044 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78752c00-4264-4ae9-9a2f-a7efd47dd6f6} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:2816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 10 -isForBrowser -prefsHandle 6668 -prefMapHandle 5044 -prefsLen 28044 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {564d9c17-4519-402c-a67a-19a31e6b84ae} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7444 -childID 11 -isForBrowser -prefsHandle 7428 -prefMapHandle 7412 -prefsLen 28084 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c062347-4f93-45bf-a2b3-dae60cabde3a} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:2580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7452 -childID 12 -isForBrowser -prefsHandle 7432 -prefMapHandle 7436 -prefsLen 28084 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c8a67f9-aadf-4194-b3ab-73139c7c3626} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:2840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7888 -childID 13 -isForBrowser -prefsHandle 7884 -prefMapHandle 7896 -prefsLen 28084 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb79add5-5781-41f9-bf9e-e3fdd2732082} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:5420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5712

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap18665:82:7zEvent20342
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5860

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RonixBuild\" -ad -an -ai#7zMap16257:82:7zEvent5877
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5284

C:\Users\Admin\Downloads\RonixBuild\Injector.exe
"C:\Users\Admin\Downloads\RonixBuild\Injector.exe"
1⤵
- Executes dropped EXE
PID:5584

C:\Users\Admin\Downloads\RonixBuild\Ronix.exe
"C:\Users\Admin\Downloads\RonixBuild\Ronix.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/y2sbTNt86y
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ff9538f46f8,0x7ff9538f4708,0x7ff9538f4718
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3100 /prefetch:8
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2232,9632984065735697760,14907751760720644370,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5768
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5724.5216.1012176714991245344
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1bc,0x7ff937bcb078,0x7ff937bcb084,0x7ff937bcb090
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1780,i,14901052017980049648,13888882622647377962,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1948,i,14901052017980049648,13888882622647377962,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1984,i,14901052017980049648,13888882622647377962,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3568,i,14901052017980049648,13888882622647377962,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:6316
- C:\Users\Admin\Downloads\RonixBuild\Injector.exe
  "C:\Users\Admin\Downloads\RonixBuild\Injector.exe"
  2⤵
  - Executes dropped EXE
  PID:5880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0dfbdad47d1a5d0e150f7ce1c87a2c8

SHA1
7163d90657a956bec90a73af78c3393168a2c114

SHA256
d29eb9e2fceb8cf4bb4ed7b032efaf38d893586e0bc2cb672d7d5550603328f8

SHA512
aa60297fa8652377bf3e36f6caf10cef8e8be1986565e99c369fe92625059d36d1f4b23b8ec8cd4b9fc4133702d9b7fda189b21821d2019d4eb7fed4f997010d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7a165fe3297a301b7fd246d013fcf014

SHA1
7a42d6c24aad6b2dfcdf7c440baeeaed3e5efc29

SHA256
24b0a4d0fce5b409ba38eaf43a593df70005683abc45f9a2b43af5f369962b3a

SHA512
7339bb1a407088be237236109a92def2a949b7842fca2c3d7d99d46c77b71ed8bd7f3cf2e7dfb5976bc1dec484f18e916cafa3fdffd2954a9c524cf4884436de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6e1af0ee3a0e430470bba3d7bb2fed3

SHA1
2616daf37d6d8cd5b866d126f8e1adaa59ca48ea

SHA256
7285b3df97fe5eb84059692f215026055905a921cb4693050b3cb4036c7d630a

SHA512
b8377056526732b2570959be2326b9a1b56c988ad3a8b24eac86f23137d353b3140048340f0f4fd072d8b7be19eec9a3d6eb08493c2211f05f04bac38be2f2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f94e8b4a287e3e2a077973a8fdb62902

SHA1
48f7773f59099cf304e581a18608e2a126b62395

SHA256
1c87c4b3d135d3fdc3b2a06f3f95bc9001119a1538cefc2312bf7a271e38e1ca

SHA512
d042cc62a861ac26196ba05feb34c5b570308f1a3499817ab5b47065a5e97ef3f47c7df0c85a1a8b3010938747aa19794ce4828a97ad357379f9219421c0e0db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2c43c077cacae2bcb9a9497f95b9f46b

SHA1
f8e52255e3ed0c064f9614e260d5de6c61b785cf

SHA256
6dd9379236e432876872e4bcec3bad0ff81fc8cca5a8801addcf64fea3380a97

SHA512
b02cf50d2a1ed8876511e9420ca17f525a9e31bfeb8038f665c5cbcb9d7c6a4d7801cd5a04321bc93ba1ee5d61d564b0ab903f126eadff90bf5f895b89639db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
75857e627be8c5f990c3e9e1e6637c94

SHA1
0d404dec62c53538729121e421a460a063d2afe7

SHA256
627303f1670f740b7a58af3429787745b462da142556298092d11ba4b84c85fd

SHA512
c9fdd3ab54d1aa6cdaf78b73e01427746465dbf364ff6f062c0e0f9b541fb16b30f847c2c0edf05bf8b27bc1cebc694839a09b02c6861b65cd1786c9f313402a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
94219b4ca7daf849046bd2a005022d23

SHA1
f2db64a92513bbc7860931d962539f3cdece6fe3

SHA256
53700622b16bd50a32ec7d19c04bd5e0bb5b0f42b2c22d05e0c33686c77b34ae

SHA512
9d927d1f54b1d712989b36346da7912edbb095e8652cd3b338d1d4b5a6a6af7786c15f6cac496ba5eddd66405a8fc53831ad7869bf130690d5220bee73e94bcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
78822c76d607d6d01a2fcdfa4a826e30

SHA1
af7d0704ff6f435b4ae112d006db7b9c46a364e0

SHA256
8e7ba3e2acad114b4224c1657a8a2315ea0f1dfc9bc33cd2dc655e1680557ae6

SHA512
b9a02d675a86b2cbe9f8dfdbda82f4e2a98bce1d4119db327aa7fdbb797467fcac750be0f42cc5b32ebba649f7e00d882866ef04ff2fc5ab0b3dc7b55803e004

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\0A86069C2ECC6A3E4A0AE5B49ED4320FBB9DCA32

Filesize
17KB

MD5
034e80b36c1efb3a21f0fd119d7f7a37

SHA1
f084eedeecbf49b1ace4fce189eceece4bb8b41e

SHA256
c7b93c92c01c69c4f2051bc75a7c3d1fa28ff1a58068af431e6af276a05613ce

SHA512
017853d29f81c86cd752a8521b74b214890948734a2e71085d464cc039e34e5f83762deb2e7328e459ee2117d320819bb8d4a859a94a8342431d62117c83d8d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\39CAAAEB9A8C297118349073A19D12FEF17D25CD

Filesize
23KB

MD5
7bcd87380d39fa4cfcaa0a771945311e

SHA1
5f3049d4f274159a4fa28206994e3e7a67da8f6c

SHA256
47abaecf0510ac4e1a5d3c6f702032456a765e037dc171cd5edab883a2599f82

SHA512
a2d9c7a0870c76cfd324afbe5b050fc4f62fc19678b6464c43ff1174f1209870e8a205897608750f3875c6cce04cb240882e84be9a8b6a1d1d561bf7f52185a8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\3F464D04F4055E52DE37C98727960D2B43921D44

Filesize
31KB

MD5
a112633e7322d3bc64b532a93adf90d7

SHA1
57e6e8f95c6e283e106733d5568be87b034911a1

SHA256
fc31908f4780bb09370c3b48c323e55aab355422f8ae375faa962775a1e251c0

SHA512
3b6290a272ab403bdabab67a37b4c764e1f80d93070575f64c14091638eac04b492e55bc26543337aec3292d49fd70af9b8cd7fa7b9602b5d8bf3186caf42217

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\48A6F4519121BC6249E5EA00E31815A52FAA0464

Filesize
13KB

MD5
c24c55429f77504d5d5d6ade682e0cac

SHA1
a449e8314ad59a5cfe4b277a09efcabaeb335dfc

SHA256
53c3e71c9ca9307192ac10aa853f5872628574698ea5d0bdbb2215e5fa3c3ca4

SHA512
46004f6122668909bc58d66ecf72b809c27e9022f1e8ac66c3aaf2263ec1dff4e74e0070c956666f3a09c3bd8d105775b29f6346ff5f9ef8cc95b71f15697146

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\539C376D03D0CC7AF91712BE94AFE33C0FD1D545

Filesize
44KB

MD5
3ba3742458f3bdfdd51a171e530827cd

SHA1
6a908a3a6bc7d037200be115c30581c776be9071

SHA256
2a67c78c482d540b9e9f2e964f3a8024c6c1eb4df856cdc29977396cd861b329

SHA512
0f7004b2a0bcaf23ba68d9b16f070054afafb2fb8d97a3e8d92c4eb36a46ec7782c996ba95d0dd4e0d4ca29554206d57beedd74a6aeef87b589696dc9ed61fc5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\B403CD48B9B4A9E6E9DE38291F2B8425CC3BBA9A

Filesize
75KB

MD5
29af60602adeb64a1f365dadb81f6d7a

SHA1
1ddbd985e844c1ee031b4504345a1fd86efa2f1a

SHA256
2fc6992b9d84061f75572ef21dd66df6eac62e718c8ac0eb49d44ed0e6baa374

SHA512
1c51174efc1fe4765cbe36e8d8b9ff84a415d87db9f0e8f43d89c77a993594a63f776e602a3603f955d9299570aabff3dce2be1feef1b5ebf31a6c39a3bcd5c0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\BB054B2AC99277174B03D968EDB33CC5A0FB23B7

Filesize
24KB

MD5
3fd3a7bf989ff38b11985c0c32d35933

SHA1
31fe45ec36b63b4134a5fa84cfd2695785266699

SHA256
ace04b4eb591273e2e58949e33d69827cf872a86b23bbd234fe37030adcd4d1a

SHA512
c468ffc83e7ed4b37236fadaede2c4ecbdb6dbfc084c8a536e0832ebdf0280fd870dd422cd7d79a4ea5ec10c89d9bb2d2755f9c0890245239b276c4d0edddfe8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\D7F4C838F128C96EA138F5A40FA0C814AFD1F107

Filesize
47KB

MD5
70b4e377b5cf7fc1b1dd6d63b832bd86

SHA1
296a5b7245e89eb89f472c5401f85fef2a2548fd

SHA256
97a4f7bcf127743809773f26d8fccd9f88bd10c34f327ad2d48f45bcef67d8e0

SHA512
cfd93ecae76c910e84f6f344abf279aa6eff5fdd4d086a32a9e2e5a94179ba1dde035e4dedbd7ec712de950df3418d23311e0d4f3e1a7f8c111b429f85b3ca80

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\EA6D9BDE7E0D49FE4A6CD50D4500CE4E0B32B2D5

Filesize
785KB

MD5
73a8874ca0e19e8501a849df66c95074

SHA1
02b837b18c81bad1423346b5600db2ca2d264842

SHA256
ba49f7a5f4f4d1d8263793f66eda815d7df489f0d02d75af49f5ea0a79d8f6b9

SHA512
fc0a036ebebe82906e76425edfbd557256ef8e09cbe2961275cfac3f29367109f3b03e40a8334309af2a7c2467d161aa4d5d4e6cb51ca03290f1daa97c310d30

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\EDDB6B0B60943AAEADD9771B0D1F26C6AFA79F13

Filesize
19KB

MD5
8766abb76bcad93594f0491563b065be

SHA1
ddbf628926201d83bbff212d460209c0afe12552

SHA256
a106bad01b84f8b50aad67da52c98b11d4939b9e921493ed75f5331ca876e857

SHA512
e7fe3ea9474b59c1d0896d4026dbff6879be2fa8d8d0144d6b4101bcc121947f76cc22330dccf7b72f2e59a689029e22cad184a7e6ea910d2058db101a2322b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4rqlt10q.default-release\cache2\entries\F970AF1849D195B8B07D40E8A83C8733C69FEAE0

Filesize
16KB

MD5
3a3050ded175de8aa87c7baef93ad074

SHA1
0ab21a00e361d8fc7d7b6aa96b638197ba078db9

SHA256
ad33170c02d9c2f1cbd2e67a42aaef60f69620c2073c26a69cb17435f4891a39

SHA512
68515af3066e6229e8f00ec09f5feb43619ec3469f69bd258a94413d23d601838be858ef3cb93848742b76077e75cf25383817de2149042c8490afaf7edc791e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\AlternateServices.bin

Filesize
7KB

MD5
475f16be45b88712c8128e7928263c0a

SHA1
37609b6089a80ef791c2247c22bb26305b17c84d

SHA256
951281f5604d1369af4b5dd5f2a70a250c86f7b0aec9290e83bf89070ed8b316

SHA512
ed36acc72ce4546d52e0570a6b34b9d214c79082e0a710771efb8ffac82b239b7f53755bdcbb5e14e633ca3829f60251b786140eacc32c565629a90c2dbdb407

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\AlternateServices.bin

Filesize
12KB

MD5
0fca4639bbf241453d89d9bb320f0dc9

SHA1
6dca8240790af6f109422f36d71bea560a642304

SHA256
a47faefa07f1eb96a1335df9f0facce2d113d74b8d6424964cd5564ccd30d549

SHA512
e2554cfc347af8a70386fd87518b0fcceca924f46cd1cbdd9d430080b8b417678651912334d5b5a802423e30f8adaab04a255afdbe10cd4b465962fc6c898804

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
882ff7b37875e1f2abfaa60f980a3fbb

SHA1
a871fca0605743abf924de37c4106e1970590c25

SHA256
1d0601a91b6d19ff74e4f3bdaf4ec8ffdabea2d6ba5731b71ffecf34dd786554

SHA512
6f1ebcd21b47f48b1dd91caf900d0ba3585529be7c60b44f99a68e250e73f7a224ab9cd4e1778bd234c1c2a24b3d73c855ba60165ef623fb39a63304765802ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8891b7f1cdb1edfe46b0536a7b37296e

SHA1
644af7aa501f05608284b32a13cda626d69ea20e

SHA256
d6d0dbfefa6a6f0b04f48ee07dd45391a4ea076c51ab3d371efadfb99c13fd6e

SHA512
3979e3b08b872ffc92a7a51b90beec87b232a27866ee1f928597796c96527ca8b51dc16df7274da921f7e5ee3fc7c21728c06980f8b9bb7080c754d1fa5896b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
7b5ac8c5611b4ae8c2563761633b7cc9

SHA1
8fb670f910aa43da511e48784516b3f41603fc1d

SHA256
3f9bc3a14018769f28fad58579f5ff9996c84cd1c0c4ce45fb593fa62f61f1ac

SHA512
bf5c5ddb15f194cd404e822d7e1f76b1ce2d27294fbc5a6aca7e7ea77d6cd6bfb349b154ab8d5770a230c0d5716578c20bf87cbf83215581abe745f916968485

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
4f46c12e1203a45d659f52cecf512d6a

SHA1
a63ed073842f1d6d5e93a1ab2b6c93e9e750ac81

SHA256
ff76961bb2ea090621dca70491beb33c2b0aefe0ff00630523f3014891fe20c1

SHA512
32b1dbb6b58530e615c0fdd71d08b5d7cab9d384a0ff550bfd07d87af64157a84ff3a52f3d8ab9438c05592f2d2b8f50af6c5e512a6338532e5c96096fe31bdb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
0cfc42ee563b24540ba0b5842b75a0a1

SHA1
0d1bb5493180fe4a2960c579384660d2580ed111

SHA256
06f06555c5ce4be86fcf511cc72f845f4d237aedccd06aa4c74d0904d62dd597

SHA512
8a76509d88250a14faa8d6d2575cf3b6a1d1dcc05429acbead2db9e75c139ddbb7ef1581a0acf9df9b27a045071603b98dbd37c8ebe0bd333d53bb84648dc749

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\pending_pings\462ae782-949b-43ec-82ad-adda6ff2c7f2

Filesize
26KB

MD5
3d839016d7274e388e3d8e70422dc228

SHA1
d201d1aa28e77b743d73cb549279c1fe15a9ae33

SHA256
f6ab08025f6988d763718a156e8978a45445d4e7fd725a87af486c5877d8fbfb

SHA512
fe7d6a1939ac0cde388a01e99d5e1969422ddde9d86f095ba9500517cde7260d336d974769a8efe047a108ef59afb0de7f5651920c340cb1b5c02aafeb329e02

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\pending_pings\baab5aa9-ddf5-4f5e-a72d-8dbcb2a758db

Filesize
671B

MD5
2763749be38d6be2e33f29f287c811d1

SHA1
c0db47baea41c6a1505d1bdba7ec8d215cfce25a

SHA256
4054077f8f17b08a858bd87677f0e3059beacdabc2c9efa2a9d17e26ab6c5a8a

SHA512
974d5ae463c1c7641300c4f8ead13469a541d94f55df45db4b9b10cab1fb3b1fa1a573138d31de7fc4ccbef8bad78e07533698be78939c72ca74ea66f73b9116

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\datareporting\glean\pending_pings\d3a109e3-92ff-4b1e-86ce-e8d5b23ddf57

Filesize
982B

MD5
4f0f91f25f587ba597715aa450c14523

SHA1
86ce9d81f7ecb8c3ff64bd2ae0335874b6804480

SHA256
cce12b6f6e7ba4b5bd329510eca6c1a8820a7b5c583a1854ec698fc5c2a3cdae

SHA512
2f36116a663e6d1f29e48240c6ef4a5919f91e771222be94836011d1c5aea6310f290f18fa7cd9c6f249a10e1a1402a449f8be4f01c0069b73832af6678150b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\prefs-1.js

Filesize
9KB

MD5
61a8b87e86024fb2e95b05be5b9e468b

SHA1
74e4f79ac4ad7fe3a785502b24cced414482354d

SHA256
d7da0e2c0eff0d11b1fcf4a5e3c4dac49d50508b351231bceb8d4b0dfce3c4eb

SHA512
dbd3a48c938add82e3859e134c06a6df1060816c390e880f9b5afca342eae3f5dac7a131d10bb07870f4717d6e89e8b4a8c8e27ec5caca896bc0bc7f7b310edc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\prefs-1.js

Filesize
10KB

MD5
77ffc6186a030d9799899e7a104473d6

SHA1
3b2af3de93b9a3d0ea899f3051d8a70e33b0c105

SHA256
db32e4e59072d748ed29ce328ad91214f582d3e086026152b4e1e5eb96eb4695

SHA512
c2ed7a63c1283e2230fb9fefa70639e05ced7c095a1923a1ac3db35c93b05313ea20197f9f3922559cc66e5f315c53a267e00e7c33054cd8757f8c789717bd8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\prefs-1.js

Filesize
9KB

MD5
31bb2870fdc8f313a33bfe08d6aadad4

SHA1
2263267dd7ff3c2f87b3fb041ef634608773aa0a

SHA256
b322d74595e9e7d2c527506ace47a881d1f152b54a8c524468ae4c1482b5f052

SHA512
a986b1d37bf821a48a2dccca7207beca5b26fded45e796b424da3d854516f0407ac6767ed30053f7ccb8b5d427775ada80dcd3d40d8804c5b07ed4cde212b6b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\prefs.js

Filesize
9KB

MD5
297426c5d62f24cd9f00611e9fe535c8

SHA1
40861673d1e441486127902a891136dc0a82e775

SHA256
082b91abfcc232bb4bf40aab21707c2cf1d2b9018584d8143f4d4caf55e6121f

SHA512
d21aeb318804267a9b1e0917dadccb89d932fb5dcaed154a73f844a0e80e143e7d413a0202816ad92c7403709cf8ec027485d36c1c7b69437633f33eb6692f9e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
c0df7de35c1ae2c4057c5282054b14e5

SHA1
3369b8569ce80a06afac9caf40c4028ffb549fa1

SHA256
65b0a37ecc84ff78920a9de2a319c5dedb88707b75f08eef3d517ea695dffae1

SHA512
7c91508585300261c13d2aa83855f2c15fe080af95b3797b344855db5b30d4023524bfd6032497651d8e23545e18ae28386ea7c5f528174bc2de799cf2c9987a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
584085a5cee5e5a563d0c2c34874b687

SHA1
fdba87e500005678133ec2866e884f10ed98054e

SHA256
02bbd06d2446ef7c6fa283176a178e73f85e8c1b997c9ff2b6808dabd2c3b084

SHA512
ee68322ce5faecbe2e34b4b449577a943911abd83ce47e07c9ac47e21570df33c154dae86ce85ba9d8591a4133ea1d20f9e72d0dac623c0e71485f834c0a52ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\sessionstore-backups\recovery.baklz4

Filesize
38KB

MD5
fb196cb43f4a1137a4907ae894045c7b

SHA1
32b1376fb84e10b594a91d3935d4364025d7ee9a

SHA256
0806517adf515d3b65005625aa2ff9f9b0a32fb8cbb9e92395373642303a665b

SHA512
0459c7fcc41801ff0e739d3b5d711a3b37f6e3d18a9d612447cd74564358eef7bf2b55f83eec46c80db16330104fd99e2c790cee0f543781428de849b4f30e20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
b3d4a3485987fa47daf0e3320a2757e6

SHA1
21e28c2eb11cdeaf694644c40bfaf593be6826cd

SHA256
d524ba89dc994b5f1f52427b571fdd5128cbd6cb89ec97f78ece475cf2c1690a

SHA512
5de38654842a55b1ea4890ceb81fcdef0df6f124435253060808911e118983c2dfd916d9ea57fbdea9bf06da758f231e898dc1771d137d4292635788111460f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\sessionstore-backups\recovery.baklz4

Filesize
37KB

MD5
c72fd1ceda7ce57effc42b1f96358c66

SHA1
82f1d24f2071d7661ede4a5827cc9ff0e4e33c53

SHA256
c27fa59589a60a1e3525dc60e408a50390c16d21e520fb98bdac54e77cf39611

SHA512
e068b4726c183027f6b41a4bbea44a505712e136aa6dcdd3a7792832b2b996633d693660b5a618a19618a58a6d2d6a4a845d5092ae42aaf7f5ee6e1d3cee6b98

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4rqlt10q.default-release\storage\default\https+++wearedevs.net\cache\morgue\67\{aec85cf8-7e9e-40bc-a813-d978216bf543}.final

Filesize
968B

MD5
d4eaa2ca1163d919a635c18684df676d

SHA1
80d805c1724eae282d9fa5131d752b939b495c69

SHA256
b41fa304a88900715374d97bec6cbc31c0f1f3b6d225b930edc639db324edc45

SHA512
a62da191b9565387c125a0ec22c5b8555658081dbc9ca56f2d05c2e5772ad2a24d187cd8dd0209aebb8aacabf28634413b97f32f802a33728b979701e14f8f7e

Download Submit
C:\Users\Admin\Downloads\Ronix.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\Downloads\Ronix.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
1c42e16b6a8679720618d54fc7754d64

SHA1
87c0735523465bd8470e7d1bb95bd04b0cb28c81

SHA256
b5fab4319e5c28ae529d037faa7d9bb7042b1ddbf5359c79d23e85dcd2aa74f1

SHA512
44fcd0a84860e5af6550377ef71ffe178ac54fba740391e8391d74072e562f31c5cde5cba42ba7adb7305a5b0fb3f4b453ca4bce03d269d5abf4fb307b79b6a9

Download Submit
C:\Users\Admin\Downloads\Ronix.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\Downloads\Ronix.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\Downloads\Ronix.exe.WebView2\EBWebView\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\Downloads\Ronix.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\Downloads\Ronix.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\Downloads\RonixBuild.NHgCOMJA.rar.part

Filesize
32.6MB

MD5
fcb8ce41aa00cd3a26ef6f2c637311fa

SHA1
fa1167f818f7c04eadb2a3257bfbfc1076c0028e

SHA256
0a6345d0ff7553fe209f1f52818faa5b67736bee6ab92c862d70b79132a3688f

SHA512
fc6bf51a74255de0ce7b0cd00ab330da706e085145789437841a465f17a3e6696a0570a2696d46a077cbe1b5c21f56b6186c8a89d2f32a7211418e3fcc9e050c

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Guna.UI2.dll

Filesize
3.8MB

MD5
846a7e5993282e220b26b82e7a39a40a

SHA1
e37fe15d2fb33753c042e16d1d008d412e7d99e7

SHA256
5613682635617cd43720807448f69b10090932e8571a358b92361d2a2c7a4597

SHA512
fcf608391d7f8406bb538aca0e9dafb804cceda6c590dcd98d684645bc3bfc0c1d43455a74854988b4b30e56a68ef8be886e92e993f1504b49f0e4baa1c0cc0b

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Injector.exe

Filesize
18KB

MD5
31ec6f010e896718994e4ef100f3f39e

SHA1
7b5ac3683bf84df67e90d0e919ff650757694ab9

SHA256
6361ee808f7e4e1a8632c49aaa59fc333c76b489a0bf4364108b00ab2da3384f

SHA512
149b51484e962b89d996b36d0cc01bf1e5f17ed3a2d2aa2a3261d3d0c868b56bf66059e1281a858a91df06fe766b59284e76f657b0e491b4336ebc34808c1b60

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Microsoft.Web.WebView2.Core.dll

Filesize
759KB

MD5
28c787dd02503de7f4fe5a6392288014

SHA1
5733e41ff98170157199bfb6c68a4a9a3035cabc

SHA256
d34ae19e628f187f0d14d5d816764435086b4ab25df98a211636b4a51edbf85b

SHA512
bb65f803b5c8fa85b4336fe54440bd19d8a72dfe5b7dfc6d5bbb8387835d7b253ce4aeed9804b6f422d02a393dbf166d8b0ee6b9a0727de0d3a6b9b6132ecce6

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Microsoft.Web.WebView2.Wpf.dll

Filesize
80KB

MD5
fdd6a09347923a12d551500efa134f99

SHA1
d64a6afaaeb1d2cc8bd82ef385d34728aef267d6

SHA256
0abe32fbcbde73d01cf5c7d821ffcde7512fd238f0c5d7e96152ba7f48f48818

SHA512
b5ffc72c3f0bc1bd2e04a8eb3b28cb44c82d117c87e2743544ae626e219a35d576458657f4f1fb853a4e4be83b3f5324cd502aaf568749a1e7d35281868f8912

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe

Filesize
86KB

MD5
cda697aebbb6c8d8baba20a999169683

SHA1
e641423c3c9aff34caaef736b69840893d5a3026

SHA256
5e4505e738be8dff263182b677375600686c68add49a0617d3161ebc1d00144a

SHA512
30a80150fb2fe215fc197cbb2dc23c7e0ea16a7516fa256d0fac681d36bd2e8ef298109440e6fe58e58f30100096d392d5100006062d42cbda9da8e5a027a521

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\60c49769-c248-46fe-8bb6-4e0b6e65aef6.tmp

Filesize
19KB

MD5
32cbb16a34a3120d2d5e89fb3a3cc16c

SHA1
caf8e0600e9e46aeb2c6b738033c3e8a20a05c3b

SHA256
c5919a85ca976fe8eb8e3784ca218376ff3462abe9047f7e4e5171ab635751d2

SHA512
12c07f98aae8f96d473f9df26fc820265f9e6027c8828e6e686f166c7e83077c4313035c8c5e6d9a20d734c1e00d0f41d13d4f4944184ae99d5ae24a4ce226ec

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
9d18d767574b7cd536d568e9042ea463

SHA1
66a8fcf6bd1b5089bf8c120eea071df289dc5756

SHA256
25a318b30b29dcb8fede7ac63ffd27f07c87e78d7ad5cc0b5105db5049e2644e

SHA512
8e04698b617039899232b4913d30783572919881f348ebabc323cd6ba649367e9d1cfd98b4e13cb51d37393c9c2200d3182c097b202165ccc568f7eaea891134

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
26640ea36b1f82f18a6d6448f4a1f3ce

SHA1
3bb930ede8e9f1a67e90ec5441598b2f9fe39dcc

SHA256
822eff2d471f7ead94e0e40875be33dbfd6eccd8ac30a5a8e6e3a95f05f2ee74

SHA512
154f3c9e64d8ba74168d6a80d4aebd4d8c181199dbd7cce70f4911ab92e48b832b82dd1e50b065807b52a079ed6c93c5b282440cad9f87bc039ca8ee6e00930b

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
b172016a60a7a9b2765aa10fd9e22e13

SHA1
e823a5bba4833d96435613ed1849315c8f210d84

SHA256
5353022e3b91d16557059b8520b1b6a5b37664c137102936b1734284dc119d10

SHA512
00fb5b2e8fda753fd8e9c5b900d8ba2f126e6389342eea4d19669a0de16c7e56eb6610e1add35ebccbee112a90d810bf783ec4fadb9300c146e6269bf729a04e

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
2427a725f02245471055aab72fc1fbd8

SHA1
6de11945415c18ee1cbec76a1309199cbd306d1c

SHA256
d812e7a96295736654f5e52bc01fc463f3782b61d04ec98a31a4b11986c1a6dc

SHA512
a1cef9d9f4be4738dfdfd586e326bde71a78ea0ca15babca5f1aea0b6c846ca78777fdc58bbd2407db7f1e1c5d90bb4e2184e6ebe75350928155cfe5504c1191

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Cache\Cache_Data\index

Filesize
512KB

MD5
c1524758bf410501e2fe8cdd43a0eab3

SHA1
c9dc8d9a6536b9b29b6e7d3b436412e3a9230cd9

SHA256
8b6226ab3ac3081c860503e1f749d54727d915df83ef0c9c3e36de927200f9d9

SHA512
8718116af64996e522a30a7c0b9ac62aa2b0af15b3764fc3bbb54e6e67a07e9a05965dd3155c6c77a36af6fac1cf45f0d9f79d97e833806f5ef45adabe227afd

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Extension Rules\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Extension Rules\LOG

Filesize
402B

MD5
dcf672b3e7ce36f855ceef366abe26e2

SHA1
0107aa9e5c5c333a3d26f72ac38dd6245aa970bc

SHA256
d1c16f6cd4f1842aa702ef040652861700476b6f282bc3c45693195eddd8751a

SHA512
4896dc96c7f77ed41c320065a82a1b0c3742613192a02218f66327441a15c37f475f26ba1ea30cad9a829511bff7b0a379c6568ce83bac50078dee53633fd2fb

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Extension Rules\LOG.old

Filesize
381B

MD5
16ce2056b3dcca3aa679e669dff3193e

SHA1
19fd922b8d6a5159b36a9d4f798550f85e95a032

SHA256
2348e0a2264fa204b73e269da3b08ff1df9bab3b495980e45891ff75373ad8c2

SHA512
fa81385c40756138699f95d99c7e7687c3b2da38d6686b307c33060567f46b05285f962005f9b826f4d293ab45abc920fa602f3cade8e8b6f0ed659f0f2b686b

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Favicons

Filesize
20KB

MD5
babd43551f1b29eb82e221460676126a

SHA1
e9bff307613a14b35830893bdb6d1ecc931b425d

SHA256
46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb

SHA512
5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\History

Filesize
184KB

MD5
1c86deb22747fc86c869b73c9724fc08

SHA1
306922297781d35c2f6f5c94249451efceabee90

SHA256
890d2c103e357fd20c551376b814e32fe3728c3697b7ba1a462739cbd552108a

SHA512
477e52754e2039d05aa524fde370ae23c3032944b52ea5965af69af311e2f5290fffaf6d5f6f0c4c018ff5e6f7489143bdf59be75b7859baed89eb78ef0b0494

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Network\Cookies

Filesize
20KB

MD5
51a20df6f804afd907f46cc1910bd961

SHA1
bb7287484c3eb4eb5128c336bae1ff0cfcf8fc23

SHA256
55cc0c2d464ab59935ca6d7373a7b5dd3253b9f9bd358af91c042203eca9c3bd

SHA512
08f13f72ae40a595619f59438a1ae03a0f9aadb7d05512f59003eebc7afbd1c5f6b9191d6abb7b80df38348775cc3d672b0c239e3247c1a40eede875f4ac165c

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
139B

MD5
038931ff72a0c6aa0695a404960b1b22

SHA1
90802f36b75c3ca70fc8cd1cf8bdfbae0e8723a4

SHA256
bef93811ae263e2e9145a44205340015843b1d4485d084bb642eaeb500fe564c

SHA512
97903821d21bb748255c29be83bca5be61e0e36719050d4bb780ebc35424202a23f3ed4ee0056833e7748f1d55d82a5f38476298c5012202776bea411da7001e

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Network\Reporting and NEL

Filesize
36KB

MD5
fa739570350b78ef09e5d8ca61d0d71f

SHA1
d4e932ca96e76aeb84d3a151d847658df6a5555e

SHA256
951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804

SHA512
8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Network\Trust Tokens

Filesize
36KB

MD5
d59c2d0f794872da30b2170ff414b3a3

SHA1
a8a18552f4e7a48ad2b5373176b67818744feae9

SHA256
d772e24f4fbec8a21439ffb57c335e6f2c945dd9f70fb56e5a84115e752e3797

SHA512
057f2ee470e79ba6aa5129ae716d18f28f737c0e651be1c52fed0db19075dbdaee09e3f7d3b7ee779dc73cdc51cf72a6d70ec22cafa6e5520dca46dfda9c0659

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Preferences

Filesize
9KB

MD5
0750cae5349c7e8875ce4b3233cf1ff0

SHA1
3976f720605741696f5a92c652fbbc748c580685

SHA256
f8bb6eb7433a390333e31e4dc58d8f49d2203dea4e6ec232baf3b3042e0aff6f

SHA512
851eb935aee7afb334ec3d9915bd3645185774fb7dfd2a879fde966da415e7cd23631ccbe5374576e16216e40e2937ff0c757d3d2ce72d903db844ff6b1ded74

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Preferences

Filesize
9KB

MD5
25caa91bd10d4937c1cc436172294dd3

SHA1
b3f46ea5cea40676147ed3f0afb010549bb80e23

SHA256
7f91474e833e2879009947b544b5fb7ca5f606295c74bf5926e7ced0122126fc

SHA512
59ad19eecc826c5060f016f4fbc1072ec997f93737b119d18280de26f62ae94d8f0b64d1aff8e2009d4ddeb946d575e3e6f62bd07cf7cffbdcda14983b5c2806

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Preferences

Filesize
8KB

MD5
d701699164bb4b2a3bcc73329daef230

SHA1
4bea2244058a0b2da5e312cdae70f6b7239105ad

SHA256
8b2a60ebf8656fa044bb145d416f6fc2a4144c7557bea0d9c790681c8977d912

SHA512
fbdc82a00900b44c7f4ea906e57d711aa2ffcd7d3bd4c368f98d3506c3f4419ec46a2154c52a82add837dd51e9cec1c4e660dda9afc744f003b5126597611555

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Secure Preferences

Filesize
6KB

MD5
112088d052137802f15cfb6e143c0269

SHA1
33036b5bf4df59a82dc54403f10346d5675b9894

SHA256
88257abeb16d97e227f6fb80dbfaa5a70c7f3216858dde0309821e3c857c0ffa

SHA512
be825c032e1aed244b6b43ba47075a9bacb26d020966f89d897cbf79b3d3ed53dcc0e718214e5bcabb14d7cae1aa7ce821e2f9e92dd755a3ee995cf6675c2e78

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Secure Preferences

Filesize
6KB

MD5
57bc2817b1fb579938613d7185f35858

SHA1
404b15ee293b2b4a16a3ad89d2747b32c52b85a0

SHA256
d16506d9f1d949fc9da841222f3845db4b101ea80f84489ab9e11ecd28d7b0b0

SHA512
97246f253aa24c101aba7f1faddb7fee9eee4b803c8ad0b4e1f35bc3b6557ae908031d235892d128ebb5b78d92d7d5675d49fd979b83ce9e871ce886ce6578a8

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index

Filesize
48B

MD5
80ad8dd266f791d6a2e12b0038dc2a46

SHA1
60d03deb679763d33136131b3b9645d0563a4e31

SHA256
3c5814849153e676d187b3a622dcc4e57bdc6fba811332f25892ff75a9b5a172

SHA512
4ff3123b4583c8532c00ef30cbef62c5cd13b6d1e736a77497208779bddd4cb0a23e3a07d199f41f7595581b6d04dcc570e4b7bc6216226aec7766f5beec137e

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Shared Dictionary\db

Filesize
44KB

MD5
b581f0ff8f8aa3371ae47b48c95329e8

SHA1
4f588efadf3675f3526cbe762c50eb8e79d9f2e5

SHA256
f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0

SHA512
e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Site Characteristics Database\LOG

Filesize
424B

MD5
e07631332aaee4e42540b402f39b5ba6

SHA1
f4f6ace069d425eafed57e8b0e0bd1652fbf5449

SHA256
221c90121d8a75c1d789c585bc924a7ccd4d245178cd30241f345c90d4acc053

SHA512
56bc83ffacd64121719824a8cc80ed9039468fe5f7341ea88c99e74c9d2ecac8204932a96731fabbde4e9d55f5692d02976223d239614d721df1b6693a0484f0

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Site Characteristics Database\LOG.old

Filesize
424B

MD5
8e4980b85d0cfbfaa2b35d623ec89702

SHA1
36c8cec3143e54936538c91706872144d685feed

SHA256
bf74fd9da64e5db8abe557fb3aef4b1ab1daeb52533e8939da78c4581fe2f280

SHA512
9069c927929ecc82dbdc148afbca16f133bcbe88cb205afc19c2aa30201a61c1c9ba6a6632858b28f6c495181d1c0e48578b85355b8890d1fffd978a33d7c4bf

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG

Filesize
400B

MD5
b6ea87a4ff2a16dd4d44cb7dd1c37e6b

SHA1
3212dca26b9ecc2954c3237e4d7815ff267e5b5f

SHA256
171cae493867d965f94f25a8fa52f236e9bd058faec6e8faf36c4b0c126b0415

SHA512
7beb7404bd6385447ecc87b9866167dbfb574dd2dce852bee35a65a81f1d36275008fdee891c4d5cd10d42700f0b8954620a9cd39105f54d006e2cee6a42b4cf

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG.old

Filesize
400B

MD5
0ceabe99410c4fa75275e9b3e14a560c

SHA1
ba9f01d38491c145a08c9996b09f0d6ddc33d1cd

SHA256
23181ca9c03269cf517125844c9e4b63a7fdce2da9c0d1ceef0d8f1194c81c19

SHA512
38f4a6c8d3c3ac76efec915be24e3d97b5c93893f300cb05a052e625ecf98a941f921230fabb14b18ea00b841660eb42f2220da24d8527a27ad3291cab25a7d0

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Visited Links

Filesize
128KB

MD5
2952cd51602ff08658fb95379db3807a

SHA1
b60a2b18ddcb4eed86db0719eace35067afad503

SHA256
547f615ea8abe1c55c3d04f1919259ca400371490935fcbcf9d0cf6bb634a006

SHA512
3709d478a2db5ac5bad463289310078c73b386dcafbb69f4ec6fda432d9795e450806847e86c279649952ead6b16128cc52d40f01806e8c7a23d0be1364b2ccd

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Default\Web Data

Filesize
226KB

MD5
60a4ec25e7806567dd0f594503908db0

SHA1
5738c8ab3a6b0e1879a564af0c4c4a57160f0941

SHA256
f52f2b6812b839036d8b2bf59b4ca6d3a69a0b8bdd500ccd2b0aa00a07f1c360

SHA512
9e99a235720fd4f0387acf43343c61f298699750d40a59149aff83f85a3dab87b494e600e235028eabc4cb0ed67dba8c67c06f66448a156a8aceefea33c0a300

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\GrShaderCache\f_000001

Filesize
16KB

MD5
9eea612df3d086f0c3fa972ea12bbaef

SHA1
acc4abe62bcf78cbeec8efe698a78dbabc94f6cd

SHA256
e9ed313e14f2dbf48198589bcf9968e27d308c4d0ffa24583b2792a685e54c05

SHA512
db6fe6cc6d7d0b1d01417a93e6d802e0b1113944ca62868e67b37fea34d55431f3ca8bfdf808eb34e9260de429ffa2fd5995fb9235f6a0515a77fcb497155ae0

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\GrShaderCache\f_000004

Filesize
16KB

MD5
5558fd71907c812a57abcbedb63183d1

SHA1
616cff44b15d531ba52fc5f299e29dbe9c4c55f1

SHA256
15ac609cbc879df95c2afcd5538f5dddd30eb077fb0a0fdd468ef0ad6338e5c4

SHA512
8d9b98df15dee5bc71c9c7cfc3c0185d74de7437900fc7154c54ebdd00cddc02ca059b3255c44dac1d95a2b474ba129ac6730b2fabe0a950f9de00266356b61e

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Last Version

Filesize
14B

MD5
96fb5f155aee0f8cd88274656c58ca83

SHA1
1fe86d9df188b0f86ae2d8da8f7c1ef663258baf

SHA256
06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91

SHA512
fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Local State

Filesize
20KB

MD5
791d4e5d6230242a1737005eb00496aa

SHA1
f1d944954fa1c2f054d8754bad9a6a45583a31eb

SHA256
eca0bfb094e5862fff6713537be9132c8f7cb14a75e2d1fb0439d257ad8f8eac

SHA512
e1909d196359d594b7d916012f1ebf394d87afdd897ce9afff3075000637c02afdeccb90f6c920a2df29fc74a00982eaee2798b9da811885d991d8ed9c6922a2

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Local State

Filesize
19KB

MD5
3f1948f44635e3fc6b2f76f3b33a5b1f

SHA1
528731bb654cc52a879874d84461cc9b4d14d3e8

SHA256
451967ec52dfe2aeeb6474505b1f7279d0c6ba4f6886f4c5fe0b8ac1b43628d1

SHA512
d49e3356514a231048722bb3e23c9663303d42e2602efa2c980354bb88e418e1bbced02f17a74c9d286769b66971116b3ee1b8cd6b0338dd79818f1431dd5b9f

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\ShaderCache\data_1

Filesize
264KB

MD5
3ce937f17dd41f756402d94e20f9e0df

SHA1
3aae7a6fe698f0fe30a7deb59b54b3cced33d8fc

SHA256
0a81231287976176b9591494ef3591f42c59f646069091a2bfb32dc9c61605eb

SHA512
c4385b42d487f6689cfb486719dbb3dd5443f4647078a1c06046ca6c6dd748356a9407928cd294a9788ea390c528e593549bf34277d5effd076dd9323ea7b4ea

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\ShaderCache\index

Filesize
256KB

MD5
f174bceb7e596ee248e1cbc892205ff5

SHA1
4e03f23437417750d75f678fc0c2fadc36b1d80c

SHA256
18175265515e64c137a43d7bfab8bfbfd74af176f17aa3eecff4c53ae627aa80

SHA512
370f400e9d41e629da6351a352f2d0c3ea2b20de8a6c5eed4e647884b282e4525838eb295a16e409c029e485f49c30b3cae77ad5ce63ee853049e94d383afe08

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Subresource Filter\Indexed Rules\36\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Subresource Filter\Indexed Rules\36\10.34.0.57\Ruleset Data

Filesize
2.8MB

MD5
6a62b26b738ffda1414b1e45b3b97c12

SHA1
ff44417a79841f948bdbeec9049f9fb59d16dc9f

SHA256
da3927c997d3bb2326e97a8dd7835c28f50ad8c4a9dd407669f20730c0159207

SHA512
820caca570523600a057dbedd38b7e3b375d6427d716cb74d0aee0825e621268a9f418f135443e5bc6bd7b9a1fbb8eb6676324d46f9111e56404b8953f23de53

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\hyphen-data\120.0.6050.0\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\hyphen-data\120.0.6050.0\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.WebView2\EBWebView\hyphen-data\120.0.6050.0\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Users\Admin\Downloads\RonixBuild\Ronix.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\Downloads\RonixBuild\runtimes\win-x86\native\WebView2Loader.dll

Filesize
113KB

MD5
a737ac7e44a3a5470f76a5b7462dd5d4

SHA1
4a676f796588a5b8c951f20e72bbf113cd8db8d6

SHA256
010fc6f17ce7b1df6bb4d4e6a593f53518864be944706d0fa035d25a28038a83

SHA512
2d86d1838c1acb85013e04627671940c8d62d44f3f4e79e077b1f43aeee1b97c96f2a05c96c79f7c4957c9041fbf06c7bd8d97aa4fc808cd6a4d97f5da613a44

Download Submit
C:\Users\Admin\Downloads\Scheduler\E1OOFNC9AK.lua_21060

Filesize
17B

MD5
d770ef9993cf9b14c30cf97896ffb90e

SHA1
acd5b9298152ea2f3bcf10d98be0015920027e76

SHA256
5b13a56cc8543a7292a62bb5aa5f878ba5525967796926fa5709e4fbeca17f67

SHA512
f6eae132fce29e734306ca3ccd7c82db592bff693c569e54d2947982a64cd11debd5213783f5ee5eff5f875ee72c495e1eb048d7108eaa714ec17df8ec0e87b9

Download Submit
C:\Users\Admin\Downloads\workspace\.tests\isfile.txt

Filesize
7B

MD5
260ca9dd8a4577fc00b7bd5810298076

SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6

SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

Download Submit
memory/2796-2641-0x00007FF958BA0000-0x00007FF958BA1000-memory.dmp

Filesize
4KB

Download
memory/5396-2692-0x00007FF95A8D0000-0x00007FF95A8D1000-memory.dmp

Filesize
4KB

Download
memory/5396-2691-0x00007FF95A560000-0x00007FF95A561000-memory.dmp

Filesize
4KB

Download
memory/5724-2941-0x000000000E530000-0x000000000E54E000-memory.dmp

Filesize
120KB

Download
memory/5724-2575-0x00000000065C0000-0x00000000065F8000-memory.dmp

Filesize
224KB

Download
memory/5724-2559-0x00000000052D0000-0x0000000005876000-memory.dmp

Filesize
5.6MB

Download
memory/5724-2581-0x0000000006BB0000-0x0000000006F86000-memory.dmp

Filesize
3.8MB

Download
memory/5724-2560-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/5724-2726-0x000000000E5F0000-0x000000000EB1C000-memory.dmp

Filesize
5.2MB

Download
memory/5724-2565-0x0000000004F60000-0x0000000004F78000-memory.dmp

Filesize
96KB

Download
memory/5724-2569-0x0000000006650000-0x0000000006712000-memory.dmp

Filesize
776KB

Download
memory/5724-2574-0x0000000004F80000-0x0000000004F88000-memory.dmp

Filesize
32KB

Download
memory/5724-2590-0x000000000B5C0000-0x000000000B65C000-memory.dmp

Filesize
624KB

Download
memory/5724-2576-0x0000000006590000-0x000000000659E000-memory.dmp

Filesize
56KB

Download
memory/5724-2558-0x0000000000360000-0x000000000037C000-memory.dmp

Filesize
112KB

Download
memory/5724-2938-0x000000000DAF0000-0x000000000DBA2000-memory.dmp

Filesize
712KB

Download
memory/5724-2939-0x000000000DA30000-0x000000000DAA6000-memory.dmp

Filesize
472KB

Download
memory/5724-2940-0x000000000E500000-0x000000000E522000-memory.dmp

Filesize
136KB

Download
memory/5724-2561-0x0000000004CF0000-0x0000000004D0C000-memory.dmp

Filesize
112KB

Download
memory/5724-2942-0x000000000EB20000-0x000000000EE77000-memory.dmp

Filesize
3.3MB

Download
memory/5724-2943-0x000000000EF60000-0x000000000F040000-memory.dmp

Filesize
896KB

Download
memory/5724-2944-0x0000000009740000-0x000000000975A000-memory.dmp

Filesize
104KB

Download
memory/5724-2945-0x000000000F1C0000-0x000000000F338000-memory.dmp

Filesize
1.5MB

Download
memory/5724-2946-0x000000000DAC0000-0x000000000DAC8000-memory.dmp

Filesize
32KB

Download
memory/5724-2577-0x0000000006640000-0x000000000664A000-memory.dmp

Filesize
40KB

Download
memory/6316-2693-0x00007FF958BA0000-0x00007FF958BA1000-memory.dmp

Filesize
4KB

Download