e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634

Analysis

user interaction
yes
max time kernel
66s
max time network
69s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ronix-Installer.exe
Size 5.4MB
Sample260419-2a3elsf16s
SHA256 e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634
MD5 00e7c93d610841d179eb75683b05f1f7
SHA1 fa51d17b3e8edc2315341f46c72201fa3506b564
SHA512 639892febf0c3a56020f063410dc63bd8ed72528b0796f489aed01fa068f30213d34a42dfad6b683f60a26c80a2ffc05e61c9e50c3a239d953d6ddb1cf3cfcb3
SSDEEP 98304:juRO1zNIfko55jRMmro9B+iHR9lRu1Ux6ONgwKo/lgAVbNbEYL9kA:juW5MjJw+ix9378OaFogA19Jz
TLSH
T1B346336E42C63D91F2918BBA6D7519898C12EE375F46C43EE61F06A6081C35ECF3768C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe

Executes dropped EXE 2 IoCs

pid	Process
3632	Ronix.exe
5468	lsp.exe

Themida packer 15 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2212-0-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-1-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-2-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-3-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-4-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-5-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-7-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-8-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-6-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-10-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-25-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-78-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-62-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/memory/2212-94-0x00007FF745620000-0x00007FF746499000-memory.dmp	themida
behavioral1/files/0x001e00000002b28f-281.dat	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	discord.com
35	discord.com
36	discord.com
51	raw.githubusercontent.com
52	discord.com
1	raw.githubusercontent.com
2	raw.githubusercontent.com
32	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1736	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211110616109294"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{97651228-20BA-4D12-B3E4-E876D9133C52}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{75029A72-9725-467D-9484-7AE8584D7163}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2212	Ronix-Installer.exe
2212	Ronix-Installer.exe
2212	Ronix-Installer.exe
2212	Ronix-Installer.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe
3632	Ronix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4112	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
3632	Ronix.exe
4684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 808	2212	Ronix-Installer.exe	81
PID 808 wrote to memory of 4684	808	cmd.exe	82
PID 4684 wrote to memory of 584	4684	msedge.exe	83
PID 4684 wrote to memory of 1736	4684	msedge.exe	85
PID 4684 wrote to memory of 3748	4684	msedge.exe	87
PID 4684 wrote to memory of 3748	4684	msedge.exe	87
PID 4684 wrote to memory of 2872	4684	msedge.exe	86
PID 4684 wrote to memory of 2872	4684	msedge.exe	86
PID 4684 wrote to memory of 2872	4684	msedge.exe	86
PID 4684 wrote to memory of 928	4684	msedge.exe	89
PID 4684 wrote to memory of 928	4684	msedge.exe	89
PID 4684 wrote to memory of 928	4684	msedge.exe	89
PID 4684 wrote to memory of 5012	4684	msedge.exe	88
PID 4684 wrote to memory of 5012	4684	msedge.exe	88
PID 4684 wrote to memory of 5012	4684	msedge.exe	88
PID 4684 wrote to memory of 232	4684	msedge.exe	91
PID 4684 wrote to memory of 232	4684	msedge.exe	91
PID 4684 wrote to memory of 232	4684	msedge.exe	91
PID 4684 wrote to memory of 240	4684	msedge.exe	92
PID 4684 wrote to memory of 240	4684	msedge.exe	92
PID 4684 wrote to memory of 240	4684	msedge.exe	92
PID 4684 wrote to memory of 996	4684	msedge.exe	93
PID 4684 wrote to memory of 996	4684	msedge.exe	93
PID 4684 wrote to memory of 996	4684	msedge.exe	93
PID 4684 wrote to memory of 2340	4684	msedge.exe	94
PID 4684 wrote to memory of 2340	4684	msedge.exe	94
PID 4684 wrote to memory of 2340	4684	msedge.exe	94
PID 2212 wrote to memory of 3632	2212	Ronix-Installer.exe	95
PID 4684 wrote to memory of 3764	4684	msedge.exe	96
PID 4684 wrote to memory of 3764	4684	msedge.exe	96
PID 3632 wrote to memory of 4112	3632	Ronix.exe	97
PID 4112 wrote to memory of 4872	4112	msedgewebview2.exe	98
PID 4684 wrote to memory of 4472	4684	msedge.exe	100
PID 4684 wrote to memory of 4472	4684	msedge.exe	100
PID 4684 wrote to memory of 4896	4684	msedge.exe	101
PID 4684 wrote to memory of 4896	4684	msedge.exe	101
PID 4684 wrote to memory of 4896	4684	msedge.exe	101
PID 4112 wrote to memory of 3856	4112	msedgewebview2.exe	102
PID 4112 wrote to memory of 3856	4112	msedgewebview2.exe	102
PID 4112 wrote to memory of 3856	4112	msedgewebview2.exe	102
PID 4112 wrote to memory of 5116	4112	msedgewebview2.exe	104
PID 4112 wrote to memory of 2352	4112	msedgewebview2.exe	105
PID 4112 wrote to memory of 2352	4112	msedgewebview2.exe	105
PID 4684 wrote to memory of 864	4684	msedge.exe	103
PID 4684 wrote to memory of 864	4684	msedge.exe	103
PID 4684 wrote to memory of 4752	4684	msedge.exe	106
PID 4684 wrote to memory of 4752	4684	msedge.exe	106
PID 4112 wrote to memory of 5052	4112	msedgewebview2.exe	107
PID 4112 wrote to memory of 5052	4112	msedgewebview2.exe	107
PID 4112 wrote to memory of 5052	4112	msedgewebview2.exe	107
PID 4684 wrote to memory of 5220	4684	msedge.exe	108
PID 4684 wrote to memory of 5228	4684	msedge.exe	109
PID 4684 wrote to memory of 5228	4684	msedge.exe	109
PID 4684 wrote to memory of 5464	4684	msedge.exe	110
PID 3632 wrote to memory of 5468	3632	Ronix.exe	111
PID 5464 wrote to memory of 5660	5464	msedge.exe	114
PID 4684 wrote to memory of 5736	4684	msedge.exe	115
PID 4684 wrote to memory of 6124	4684	msedge.exe	116
PID 4684 wrote to memory of 6124	4684	msedge.exe	116
PID 4684 wrote to memory of 5168	4684	msedge.exe	117
PID 4684 wrote to memory of 5168	4684	msedge.exe	117
PID 4684 wrote to memory of 5772	4684	msedge.exe	118
PID 4684 wrote to memory of 5772	4684	msedge.exe	118
PID 4684 wrote to memory of 5664	4684	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start "" "https://discord.gg/ronixstudios"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ronixstudios
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffae581c188,0x7ffae581c194,0x7ffae581c1a0
      4⤵
      PID:584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,162023907459573310,8498481512758474405,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
      4⤵
      System Time Discovery
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,7516450354868255191,18114955716975359847,262144 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,4484879925625659465,8418390197859995035,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,2346241516337751707,14110914373089541713,2097152 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8430453305501343245,15679810508699094468,2097152 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,7120327756177477627,18237514797440898278,2097152 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
      4⤵
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,11222396241890866294,5218706723100142580,2097152 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:9
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4312,i,9030738997908263120,10135781393727473452,2097152 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4456,i,8827364443525940413,14024324750390900378,2097152 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:9
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,10728074530979908517,16252177639782860643,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,5497922481331051692,12036348750524728732,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5388,i,1012139878800093380,11922341648310829477,2097152 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,11330684490183309199,16412562697389716734,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,9918689241305713403,10715887689532459729,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,8289492592308432226,1151465198826284847,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      Modifies registry class
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,8204094387774474862,11682132118717053577,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:12
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,6326945746428233753,4965015365522709541,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,17234317568774422610,6525974248845907572,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,17234317568774422610,6525974248845907572,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,12154574193096076644,14355340658129746294,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,13173500064114984808,9894527782270338514,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,6813219421387223058,15193766548893163680,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,5080672854582771309,14432263151574816977,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,17568629617132373427,4732215485512909775,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,10354452458661760358,6869325827870330185,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,2305617250444541815,9879074324616154506,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,17466894532641650994,10304074522115850010,524288 --field-trial-handle=2368,i,12101805778458757319,16412415499562436121,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
      4⤵
      PID:5164
- C:\Users\Admin\AppData\Local\Temp\Ronix.exe
  "C:\Users\Admin\AppData\Local\Temp\Ronix.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3632.1520.9797971623582548633
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffae2fab078,0x7ffae2fab084,0x7ffae2fab090
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1652,i,4080789865063386544,3143046737787645563,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:2
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1868,i,4080789865063386544,3143046737787645563,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:11
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2056,i,4080789865063386544,3143046737787645563,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3412,i,4080789865063386544,3143046737787645563,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:5052
- - C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
    "C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau
    3⤵
    - Executes dropped EXE
    PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8fa308b96beafe75c7ed52c731007cb9431d82e2b613c0b0fa324502e8a0ccb1
MD5 d09e02debdf1d75902d5144bd672ec4e
SHA1 a55f82b67efcffa73190f2272a70a7190d012676
SHA512 fae39634d3d7715cb888c01211e5cbc17be781f2ded4a9336eae5b1d548f6a2e479493ebd280880119560d9d526ed3991b9f7f6b7fe889d3043231a9a6fed5fb
TLSH
T14BD023347799D009C63905335115F75533DAC56134A64011F42DC44DB85D3AA5FD5186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5087c8011abf31579ce8c3f4df8be4beee21db8e28b1d3b1caad76308ad73422
MD5 709f5d486b5b4c084f2a646b78c810ad
SHA1 daf2cd53973f1cf8236df73c33b7f4d32009d748
SHA512 61eee5f5ca9f8a359e5d4d501af7fba5c8af30e55fc94443e19bfc70cf4eb61961a2e606f3983a80ba785a9e546608579f896eea27d4d117653cb20b4ef2372c
SSDEEP 96:JkKXLTWV0gyXbBybuZd0piai22EWyb+H5W6ML:JDbiE/2i59jySZC
TLSH
T1D5A10814C194EB5AFBF02179E9DD04F972387EA4DE3B7E2316C2637C0A19F318285808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d3a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d3a7.TMP
Size 3KB
SHA256 9e6b7b71c780e910452fdc2366207cfadda57801450d378fa3fc48491d555600
MD5 d3bf6f7f415c78977cf89188df95ea0e
SHA1 22e8e8d6d0174e2f2cd01a3221fd189aef2d3d9f
SHA512 579785182f96866c38d4ec650881da69285c17115fc855dbb3996506f35c7fc62d4533dbb509ab2cb62244e7de6a3caa6ec9566d23261582d7b302bf3cc46d24
TLSH
T1CE616058D0A48B5BE7E435B1FAEE1474723C6E18CF3A7E1316C6477D8A5EF318186418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 79d9b3aacc13bde8cfe807382b02359180be1e002371e4d03eeee31969ea4fa9
MD5 af01e4aa2667f3bfe28381e341c11b27
SHA1 5950b9c99514f517cbef5ce894a0d4a3123c9c2b
SHA512 56486f0d3b68ed72e7c770cf08178a09ee9669585cdf8e961e5f52ba57d5eaf08fc8646e33570e19b5ac5c107dfc3034259093645ac5ab1b7a28a4f80a4b001b
TLSH
T132519CF783E8862DCA1156F0AA187E1BCE2D0964431C3C6AC9E4AF1BA7E2471F14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 74a9fe2354f2d6640bd4eadbd94ad24271962bfc62340750799b56191c8e6ee4
MD5 6a29e3d44c8e77d48a5b3bf520c30877
SHA1 e678606fc5a4df407391d79943e583a41671f8d6
SHA512 80358117b15ace28bb3482c85c9bc47b42bdf7afe359e86c9b2ac81dd3b9662e7480757fa525b82403931bf4c727b8b45e2f5c050496463d00fa290b65aa9599
SSDEEP 192:sxZZRQyM//K1Ml8McU/f/sVNaEdpn2/W6+WNz+0/eBW0xkAEGxqsIg4J:sxZZe0U/f/sVN92/bZ/eJljc
TLSH
T15652D616BA345977CCDBD219BA55BB57D6F804A2D2900E44AEFCCA1C01E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0d9843ea53563489ec0333671688e895f70d3477c832d3e20796b67e12b7d4b7
MD5 467eb3956abd8d810cb54a8f3fee739f
SHA1 2562a66d98b38f3e19226172f888714cd8bea9dc
SHA512 05fd80e8e2d1ece1b640a4b79f1b4b4ee0ce065161a00dad90e543179de8b81205f46c084493c7301e7676b5092561b704966ee3d114fba951a5560541cc5917
SSDEEP 192:sxZZRQyM//K1Ml8acU/f/sZWpVYYMaIdpn2/W6+WNMz+0/eBW0xsebGFAeIgbKJ:sxZZe0U/f/sZWvYYO2/bC/eJWy
TLSH
T12C62D716BA345977CDEBD218BA45BF57D6F5146292900E44AEFCCA1C01E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 94063a0a6319ddb4ed10d62a554df0ba8c0a344b4777041232cdbb6f46cf3c5a
MD5 8fc70a7c1d870ea1eb5fe6ac87f21e77
SHA1 dc88166b20b7fc33fadfad2dfe4c445985ad161e
SHA512 6e1d2ccea63a8eba83b0af14cc9737796168a690e91ef0d0ae293396651ca1e6edefc9026e9f942626d6556146413492ec52501d3c07de9f4642237e90f088f6
SSDEEP 768:BhK2G8g+2fJWRmdnQkP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3C8Ll/JL0oQlrooX:BhK2G8g+2fJWRmdnQkPu1jaKC8LpJ4oa
TLSH
T13CE20A3B244CCB7E4F841E6CEC26AF966DE801CBA6584D5447EA884C03C77EF561A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\69818d8e-f331-42bf-a38b-69ec4d5b3ce4\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 6a9a9ede6d91d2100b6442de9b0522c222e0e57c61cde4e37eaae7cb10bac048
MD5 8eaf73b008ccd162b9da96c5b9a387cc
SHA1 63b6a39b0c506b43564105e2992accc33f137d0e
SHA512 806c5786d607e7bccc464ac847a236f04a3dee1d8794abf297270bbff251b5a11db75d4d0a4c92a56a2fde91931380be71513fd9f86eca9ebd095d9836501a69
TLSH
T169D0975BF0690080D7AB0E802A3220AA8AB27CC4548881489202206DA8B9B829622F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 7d2024917a6df3d56880022644c2ac1dee7f4e44c6ef686cafc809fed71e90dd
MD5 6dece5cb3458821a942ed7c6c4621109
SHA1 623d9d9a45acbbeab2f394151ee756ddc249a1ce
SHA512 e904567ba5a7c05c6a179784854903e5335e9cf5caa55df4656cd4bd0616aebfbb2ae9e353dda87ba316522623ea46d3812d0bbe8cef290aa32fe71e27b2a0f4
TLSH
T1D7D0A75BF069059096EB4F912A22607A4A667CC454589148660604A99889B929513FD2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58658b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58658b.TMP
Size 138B
SHA256 fef284aa9c6772f9456d40223faf144336541251a68df5770eb69f8ca80cd328
MD5 94b79121c769e557ab9f5ad057adb1c0
SHA1 bd4c87748281a63d30eb5681df81184e7957d051
SHA512 aa71342884bfa82130885769670ba089badad944db1fa978024e5d41147f23b721c0e222d5e455e986ecd3577d6cac4e4018191a599974d3e97f51a4a68f2aeb
TLSH
T1DFC02B7BF0490404871506900332519D4B673CCC4899C08D6113306410B6F632602FD2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d8e1230d9455f7f2043e9cb354b60876d636e36c99348f962d33af47520bdcb6
MD5 22cb8a20491c0a361806e0b74416ad31
SHA1 a855fc68a460197010ebfc99d54db1b08e4984a6
SHA512 ce30b3609373f475522ea55c7febddf49e545fd11b3f27a2f22236535c0fddb09d1403853e8780ec94eef762eb1f80395cc3faeae656098ffd06a63e8228d1f1
SSDEEP 96:KAhyKisSubCK8cUSGYK3qEIgKdaC+beKoM+:olBLfAXBD
TLSH
T1BDE14750B13A03926A7E294A86D0B47E82D175E33454EC3B77B812A74F66E60DCFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7d1eeac3e4e6abe6630263c2f01e09f580a83adb36f9672876488bc9efff9dfa
MD5 352673fa19a01179ea8d133b70a39ff0
SHA1 8188d549773c4878bacb7e93b0e1a9a7764c7e13
SHA512 7dbd7715e642aa55661c67352e44145d5a368bffc5deb719a603c66c0ede4b5efa53c45318b735e770e5abe29f4cc5efb9fd0fa08e55deb042234ea38bc68b76
SSDEEP 384:nejccCs+Bt0S3S8Na3leEeUCUQvAwoImlR9EcFe7hvNtNjIS5:IccQyrINPoHljEcFedNbMS5
TLSH
T194827D756978AC775AE29949F047271B6FB450BBA9C41F20D8EC8B0D05CF39C270A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a5b06603e167e7a55f2cd0dfe99407f389a2e96c69510327242c0d4289a367c9
MD5 4afd22c7c999f7f6889e256de81e444f
SHA1 eb621099cb974f79c76cb82dd8319ba032760925
SHA512 1247f82fb9390c948b0924ab4cfe6b3efc40025bc170bdb4364970ab53787235500698a9aeab65cef48f662b65a68fcb7291b9c72211bcbf870e52cab316f697
SSDEEP 384:nqjccCs+Bt0S3S8NfMleEe3xUQvAwoImlRgXSmfUDKK/7TXbcFe7hvNtNjIS5:kccQy7ENPoHlC1fBK/7zbcFedNbMS5
TLSH
T183B26D7D9C745C3F04EDBB48A60E2A2B5D68423BD6F45A29D7EC4B0DC1BA64CF306116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c4d5444214b171e23bbacd1c355d16937343418676983e1dde0e20f9b7a00384
MD5 fb1cef1324a9414fef8078d1a3f6fdac
SHA1 67c4692b49bf3162a973a32e823b1ad400cdcbf3
SHA512 1ebacdacadc474093cf20ea53d22c15ec4118a4bed7da0852d7c53be44da28d8df64511e3d9234ddc31c8706bc8422732ba69a244b6fca259b2daf664348f642
SSDEEP 192:VGN26EajeQmiUyFYw/SnRvAwoIDq6ipU6:VGN26ENdwKnRvAwoIbmU6
TLSH
T19302D835B97C7CBB8EF3AD45B4877B276FA5112BE9942B44D9E81B0C40DB34C130692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 022e050cda521a5ad05191c92ae1ae4a517e6b332e694154a7df1dd16c38304b
MD5 61270d9852a9d65424222bfc5586bacd
SHA1 1191c1f8ee06e209be1af294ec089b54bae1eb64
SHA512 f9c7d59e062bf93b0c10df134ad0b5db1b4846887d9bbd1c4745fb25127f821d5725b6bf2e6fe563e94d45dcf0e49db92dc7f105710511b9a029eab6cd8053da
SSDEEP 192:mGNj6EajzQmiUyFYTS0RvAwoImlRyqUupyqtmU6:mGNj6Eqk0RvAwoImlRvEU6
TLSH
T1D4121935B978BC674EE3B855B4833B176EA4117BE9846F44D9E84B0C04DB34C2B0A51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5ece251-43ef-4723-a0f2-c0c5f92c3d6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c5ece251-43ef-4723-a0f2-c0c5f92c3d6e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

66605bc4-5253-4719-8edc-b6205c90c9cc.tmp

Path C:\Users\Admin\AppData\Local\Temp\66605bc4-5253-4719-8edc-b6205c90c9cc.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c09d6ea-de6a-46cf-b1dc-3ad97ddf45dd.tmp

Path C:\Users\Admin\AppData\Local\Temp\9c09d6ea-de6a-46cf-b1dc-3ad97ddf45dd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Ronix.exe

Path C:\Users\Admin\AppData\Local\Temp\Ronix.exe
Size 15.5MB
SHA256 5557080d062f953443f6482afabfd048cad643726c5ac3d7862a84ea99af77a4
MD5 71d920b006b80dde1931411f5fb53984
SHA1 605a5509956749e63d5665d8d6b46629a8fdd7a7
SHA512 310d0b6da6da8051ee36987c0e3b707c8446b4a72301074d1c176c6c74cb02a5f81b6606a5450aa2031224cd46eb9963b21fc60a02f6dcf8f240d19be3056769
SSDEEP 196608:3ZL3AuoWGbcyoKgU7AU2222G226LCe5F:3ZL2TzoFU8U2222G226Ln
TLSH
T19DF6F7247A5B996CD05BC4B4834B8A73497130CB0B39B9BF448596382F6EBF46F3825D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f24d5919-8a9f-47b9-a33f-dca02336d69b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4684_1480722257\f24d5919-8a9f-47b9-a33f-dca02336d69b.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4684_898630791\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bd1c91f3608a040c8a210cb57669f34b41895f9a6e6a7f7b982e18079ec11129
MD5 08ca167b8646f055f32bbf14f26bbb45
SHA1 4561463cc47f39102843b913e5db71609d80446b
SHA512 2a5cee4fc7c55364c19d38eb9284711560b6c4581dfd9b5d23687cf28ac6fdb36b3f58c236583a3ecc72d7f291539f2424459f31cb394c93bc466f47a811c9f6
TLSH
T1C5D00410D1134104DC543571011543437F0154134047410430540114445C5501407050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 674d970a68c3637c66b5247adf85b5c4226b59326a910b4935ddb473aae737d3
MD5 c6d8a11d87634493ca02a4ab9a1264a6
SHA1 bf681030c397498b981dcddb3c845163cba70ff8
SHA512 d3cc3357faff17ad7110193d058010839dcb2489fb3cb5bb367915c8069747a4570d39dd4f52d57d006b047dcb973654c0f2e29291056817766959f94ae37cdb
TLSH
T1CED0121272134238C82035730103624A2D01D11B804B8004742C862D5A1C4A01D07491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 56ea3ee3bdebaf7f42c78338135e5bd6df4d76c98e09a94c13faf6c24115ab5b
MD5 f27f578c11c073f459b94463410f5b81
SHA1 b4003e43295af5d65871bb260e82915cd7f4f0a3
SHA512 fd7f2a0ee2920e21ed69aeab96e16f106dbf09cd28ad2d1820137004fa9a9d858bdec860871b2e9e0274df4188aae2d71556fe1fe53dd9d48d4e611ea713cdaa
TLSH
T116F08C68AAE5FA06FF720A7CA5FC48DA78347FA082534D7381D42C7D68C3380B341100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d56c.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58d56c.TMP
Size 48B
SHA256 cd8c723c1f282d87d5a3a248a2b0e2722363af8fd19a2bc9d8295e64907766ce
MD5 e2516b479db06005c434a9b53f4c7ea6
SHA1 411ee08a76a1c58c75b36b7ef929f66b3ce34b08
SHA512 4f3f0a10f7a37d78b9d6919b0447e4514b9b614c7a2d2916b87b250de228956061fe5bda55b1d3b3efb9a06b1c20aa2852c5ee13fdc3fdf389d212a81d92f262
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences
Size 6KB
SHA256 57e8ef9a2b1b2b7c053da269b79184e8eb829611ab4cd129098c53fff0330108
MD5 9ca0fee5f46c5e560cbd0c24113be0ad
SHA1 2fdb2e715318345888dc33d022091d7a8a169074
SHA512 dfa3195e0d840469b4af4842dbc38425e5090ec3ebcb4a8aa55ccba006dafc5112df9a919e8a981d230d798e63d51792c433d1b3ad7e870410c03238f7f3fc01
SSDEEP 192:stI0RefIZ8paB//S+WiTfmoxg1bm14bMC:stRRevS/Vyox/C
TLSH
T135E1D907AE6869774DC7E6197A35BF1AE2F6106226C40E54EFFCC61C05E66DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58fcf9.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences~RFe58fcf9.TMP
Size 6KB
SHA256 b1564f11c1d1ea6c6adba51abc58b184925b9b208cf166e24946589e4ec7ac58
MD5 3c715bfcf1cf5b0d62a4a77c443ca349
SHA1 334193dfd2ca6116441d163ea81b63ed8609b46c
SHA512 f0e1648fff85300805db36be4e2aa3f63da8820e1560899c0e54d8c01a5338f1e431926076f73a30a17d54a982731c43e018df49c2a438ef295eaed24a06e8a2
SSDEEP 96:stI05nBELFb9PffwZ8i0vhEiktim/7qx+WVHMSm+uecJvD1ixg1bQj7+gH/jMEB:stI0R8fIZ8paB//S+WiTvDwxg1bmhbM8
TLSH
T15CD1C907BF2869774DC7E6297A35BB1AD2F6106222D40E84EFFC861C05E66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 16KB
SHA256 ac4c5bab8354ae5aa4b36034566767de1a0d94419a1b327c96315670a8c9135f
MD5 e0804be8fa3331436ebe06acb5a25f14
SHA1 8e51b8021a0483a9a8ea4d7d6ef10fd597ed9fad
SHA512 3928df80a807fdb8cbe4e880ece83eb778f5b3997521f07e3b60ada1b3efde38c5a51c420a9bb3845b62415397fced03e7400f861373817b2e728d19af85a54a
SSDEEP 384:zjfRE5BdEZfr0kuh9Rt/nP9yxNbRFluMowWzGC:PRkurqhNs1Vow4GC
TLSH
T13572B0339A709D27ACDA810A790A2F0669B4C05A61C13E946CDD5F0D07DBBDE1363D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 1KB
SHA256 a83f0397287b231d801824499540e6925fb12ae7e5d84d7d8785dc18465b6974
MD5 5cbd960930c9c748f4130954f91d69fe
SHA1 a565abaa58bf3d2693be07fda626ea4294f21a15
SHA512 238fc22e004b7fe2373cb85481762066dbdab6bda88fdda97ac3a983c000f75208ad1fca8f64375b7b0b73e398a5d74204619e65ff22f9b49cfadb527b701f06
TLSH
T1F83162B3F4946B32AEC45656B61A3FCB1E2050B792405E44B9DD8B0C03EB68C613AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 2KB
SHA256 d1ef49e294048b7365bd11bc252ccc6dff0ac119f693845336d81baae59fbffb
MD5 aaeff247a8fc29c79d4951aafd4355c3
SHA1 55c1ff060aac48f97e0e19720895453cb78d421a
SHA512 afbe4d8187c90ed76f85f7febc8804513456c9138f30f2ee4f8487411e0982fd72713778dc7ce4d3dfe6280a576660ada90beb5961f2e96cd76e245ad44d8f36
TLSH
T11751EB73B804AB379EE646557A0A3F479E3850A296513F50AEDD0F0C02DB25C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 3KB
SHA256 ace1e45b15bd817683a147f150de3c0c160474313a2eec7f6f06f4950caea30f
MD5 c239fd553617a01165a991a51e92122a
SHA1 9388b2bb8297b5c102e140a1d66aded3565a104a
SHA512 6ab26a3dd5b904055d805525a1ef648da8d2bd7c379d449528fbe8fc59a26fbfdb1bfbf9a90cf96f0e4407bd5efed156a163a53bcdaa33d4619d6d4b923fc682
TLSH
T1BC71B837B964A9274EE69A05B9863F4A77A45077E1C43F94DEEC0F0C02DB3982352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe585d8c.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State~RFe585d8c.TMP
Size 1KB
SHA256 3fb10f9a74825ddbacec37830ae1e2a6aa68a8c1f7f6ed120391feeea0471ec7
MD5 96b535105914dc409ede9324ef15ed02
SHA1 2254486c66fd9dfbb38e7fdb27caf9c8df86ea92
SHA512 4eec695c32c63faec889c71c226c6f0dd14f6d9a40062507641fce3f6bca1990e8c028da34addc31be7e78b086efe4cea23dbaca1d65478f89103cdd81980e95
TLSH
T1C4214273F4956A72BEC80556B6263FCA1E5090B792406E08B9CD470C039B6D85237C33
MD5 SHA1 SHA512 TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Loader.exe
Size 3.5MB
SHA256 0cf13ed4ab8567b81b7918c4ee2ec665631d1b667a13c823f80b0f6d2a6953b2
MD5 e2663150610c0118dd01752ef82c5188
SHA1 9593af2032ac3931cfe3c06f41b7123ec5648a6d
SHA512 c8de7e4c3790ef50dafcdea5c6b6165ebd725cc447757648a070504bfde0d8a2afee764a06feb9f0cbe9d15353153f6c1077823def968d4060d7b8955bb3c9d1
SSDEEP 49152:RjlAk3o8Sw1u17giirmjfp1qt3H8mQGt+q3fNB/9Xr6ZqZm4kKsnRGRHC50Nml2k:tlzDSFB7c3cmlZ6ZoFtCn28zSmoI
TLSH
T12906339F6A111345C58F2B34193DDE370FE1C867C9B88297C126A6F50327F3BEA69261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix-Module.dll

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Ronix-Module.dll
Size 8.9MB
SHA256 bb8fa7341fb84d9e7fcf98689424d61c102714b20df910fdd91e5d4a4c8842d5
MD5 ce9666a71f7cd2d59fcfb3617dca52f3
SHA1 fcf1e6ae331b62096792b6976f903dd5f8af383b
SHA512 b6b344d9215eefefe36ae80c082413c6a2721494495b2be3fa8bca3852c0e024981f2572a49728b9dbf2c87ced42401ecd8b3b763db331921256040873e2e99d
SSDEEP 98304:isZUcdAxRVxskO0JyJodNODkNJ6USMwHhcsDi4ii:7zdA/VxskOcyJodNOg/vmoi
TLSH
T177969F76B6A800ACD87AC078C6578A23EBB1B496177097DF01B4467A1F77BE41B3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau
Size 733KB
SHA256 e012b3226113babe0923bef668c73550e11609ce17658796509d5ef44d4fcc1e
MD5 9fb7cf00bd16602f900ff353848a416e
SHA1 048cc7f41d2f63b9e87d3693aa5510aa66fb2417
SHA512 30e0b35cfc1a95bf22aeb580bd1f47267e6cc97a81e2301d6da7a317ba5fedbc6ef86b43fe4195fbeb88135249590d44939d17b6ed1a388a91f8715fe874ecc4
SSDEEP 6144:U9gNZUqKS8qf2CZVzBXlDv2bt5JQc3zVvD+TzFY/OSRlXAKAPplC6fTU2Ag6SfDI:wJQc3zVvD+TD9eX9b
TLSH
T1D6F4441DB7047130194F53F6AA9F8844ACB1A2C6916C50F8D4FCB7891B7F87D22A6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
Size 10.9MB
SHA256 dd16dfc077156df6795a69a4bbb753a0201de9513e6614741d8f1976ca9e8b7a
MD5 16de28c93995a988aaab6eb1c409038e
SHA1 424666825b9a2970a0d7663fbe66f9e885e5215a
SHA512 2ad14445e7cf7df46251d2978757ad2c73a9b0fd143d7fcae8cf9d78af1702c7a991be69330535a8cc664baa85c59ae0b1fdb8bca8354e1fd8f5bbece25ac074
SSDEEP 98304:gJeV6UHLvpVTLS0wRlgF8MkaQW0Dlems/Dt3:gJKXfS0s6QW0xemot
TLSH
T161B67D37629C11D8E0BBD07D8B8B5D93E7B2340903719AEF05A046965E1BEF94F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\version.txt
Size 5B
SHA256 20d2cb096d1ab41a4140246d12f07bf6b8cb743fd48122b72532c03d44c5c14a
MD5 1237637816a1ef8e3a33c1191d9dea66
SHA1 e5906c31c05c50ae1bcfde5f3a47eee483bc23c9
SHA512 e6bcf72302fdf2139b5f9d77dc0be3458daef8ad42b81842371dffb98307479a8a8e053eac8f27eea9cbfc47cb60248ab0fecd994bab3c2359c1a9d5dab508fe
MD5 SHA1 SHA512

Submit Download

main.lua

Path \??\c:\Users\Admin\AppData\Roaming\Ronix\scripts\main.lua
Size 25B
SHA256 761d0ba13957885dc4f35ecd2f6fe9ec62138c586766f4f8a5c03706efbff2ab
MD5 01999e84d8107b5efc0d1b93d566ab46
SHA1 19dd9037aae46c141e02d5eee0b656b3411779a8
SHA512 0df3f23b2d14989e034d50ea19aff0369c21c76e061cc65969e9f051892b31e7578ff9adbc37a97dbc1c84088f44bcd47bfea3d8e0d2aeecc3f639514c072a32
MD5 SHA1 SHA512

Submit Download

memory/2212-63-0x000001C348AA0000-0x000001C348AA9000-memory.dmp

Download

memory/2212-0-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-90-0x000001C348AA0000-0x000001C348AA9000-memory.dmp

Download

memory/2212-91-0x000001C348AB0000-0x000001C348ABC000-memory.dmp

Download

memory/2212-1-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-62-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-78-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-64-0x000001C348AB0000-0x000001C348ABC000-memory.dmp

Download

memory/2212-2-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-3-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-4-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-5-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-7-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-94-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-25-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-10-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-6-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-8-0x00007FF745620000-0x00007FF746499000-memory.dmp

Download

memory/2212-9-0x00007FF745B6C000-0x00007FF745B6D000-memory.dmp

Download

memory/3632-932-0x000001B4EF330000-0x000001B4EF339000-memory.dmp

Download

memory/3856-189-0x00007FFB03280000-0x00007FFB03281000-memory.dmp

Download

memory/4112-980-0x000001FCD61A0000-0x000001FCD61A9000-memory.dmp

Download

memory/5052-221-0x00007FFB03280000-0x00007FFB03281000-memory.dmp

Download

memory/5116-986-0x000001FB35F00000-0x000001FB35F09000-memory.dmp

Download

memory/5660-541-0x00000180D9B00000-0x00000180D9B09000-memory.dmp

Download