e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634

Analysis

user interaction
yes
max time kernel
27s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ronix-Installer.exe
Size 5.4MB
Sample260425-wmelesft2v
SHA256 e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634
MD5 00e7c93d610841d179eb75683b05f1f7
SHA1 fa51d17b3e8edc2315341f46c72201fa3506b564
SHA512 639892febf0c3a56020f063410dc63bd8ed72528b0796f489aed01fa068f30213d34a42dfad6b683f60a26c80a2ffc05e61c9e50c3a239d953d6ddb1cf3cfcb3
SSDEEP 98304:juRO1zNIfko55jRMmro9B+iHR9lRu1Ux6ONgwKo/lgAVbNbEYL9kA:juW5MjJw+ix9378OaFogA19Jz
TLSH
T1B346336E42C63D91F2918BBA6D7519898C12EE375F46C43EE61F06A6081C35ECF3768C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	Ronix-Installer.exe

Executes dropped EXE 2 IoCs

pid	Process
5152	Ronix.exe
3968	lsp.exe

Themida packer 13 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4752-0-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-1-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-2-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-3-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-4-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-6-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-5-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-7-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-8-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-10-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-62-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/memory/4752-80-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp	themida
behavioral1/files/0x000800000002447d-349.dat	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
42	discord.com
43	discord.com
49	discord.com
51	discord.com
89	raw.githubusercontent.com
5	raw.githubusercontent.com
55	raw.githubusercontent.com
94	raw.githubusercontent.com
6	raw.githubusercontent.com
39	discord.com
40	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6120	msedge.exe
4320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216137570971565"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{12B75D68-E7DA-49F6-B290-7C95C3C79F70}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{917046E9-FC1E-4741-B5B9-EE8186DAE8B8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4752	Ronix-Installer.exe
4752	Ronix-Installer.exe
4752	Ronix-Installer.exe
4752	Ronix-Installer.exe
5152	Ronix.exe
5152	Ronix.exe
5152	Ronix.exe
5152	Ronix.exe
5152	Ronix.exe
5152	Ronix.exe
5152	Ronix.exe
5152	Ronix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
5676	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3804	msedge.exe
5152	Ronix.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4604	4752	Ronix-Installer.exe	86
PID 4604 wrote to memory of 6100	4604	cmd.exe	87
PID 6100 wrote to memory of 3804	6100	msedge.exe	89
PID 3804 wrote to memory of 5108	3804	msedge.exe	90
PID 3804 wrote to memory of 6120	3804	msedge.exe	91
PID 3804 wrote to memory of 5396	3804	msedge.exe	92
PID 3804 wrote to memory of 5396	3804	msedge.exe	92
PID 3804 wrote to memory of 5396	3804	msedge.exe	92
PID 3804 wrote to memory of 6136	3804	msedge.exe	93
PID 3804 wrote to memory of 6136	3804	msedge.exe	93
PID 3804 wrote to memory of 1276	3804	msedge.exe	94
PID 3804 wrote to memory of 1144	3804	msedge.exe	95
PID 3804 wrote to memory of 1276	3804	msedge.exe	94
PID 3804 wrote to memory of 1276	3804	msedge.exe	94
PID 3804 wrote to memory of 1144	3804	msedge.exe	95
PID 3804 wrote to memory of 1144	3804	msedge.exe	95
PID 4752 wrote to memory of 5152	4752	Ronix-Installer.exe	98
PID 5152 wrote to memory of 5676	5152	Ronix.exe	100
PID 3804 wrote to memory of 3852	3804	msedge.exe	101
PID 5676 wrote to memory of 5956	5676	msedgewebview2.exe	102
PID 5676 wrote to memory of 2856	5676	msedgewebview2.exe	103
PID 5676 wrote to memory of 2856	5676	msedgewebview2.exe	103
PID 5676 wrote to memory of 2856	5676	msedgewebview2.exe	103
PID 5676 wrote to memory of 1140	5676	msedgewebview2.exe	104
PID 5676 wrote to memory of 2340	5676	msedgewebview2.exe	105
PID 5676 wrote to memory of 2340	5676	msedgewebview2.exe	105
PID 5676 wrote to memory of 3816	5676	msedgewebview2.exe	106
PID 5676 wrote to memory of 3816	5676	msedgewebview2.exe	106
PID 5676 wrote to memory of 3816	5676	msedgewebview2.exe	106
PID 3804 wrote to memory of 3852	3804	msedge.exe	101
PID 3804 wrote to memory of 3852	3804	msedge.exe	101
PID 3804 wrote to memory of 3940	3804	msedge.exe	108
PID 3804 wrote to memory of 1956	3804	msedge.exe	109
PID 3804 wrote to memory of 3940	3804	msedge.exe	108
PID 3804 wrote to memory of 2664	3804	msedge.exe	114
PID 5152 wrote to memory of 3968	5152	Ronix.exe	115
PID 2664 wrote to memory of 5000	2664	msedge.exe	117
PID 2664 wrote to memory of 4320	2664	msedge.exe	119
PID 2664 wrote to memory of 4544	2664	msedge.exe	120
PID 2664 wrote to memory of 4544	2664	msedge.exe	120
PID 2664 wrote to memory of 4544	2664	msedge.exe	120
PID 2664 wrote to memory of 4448	2664	msedge.exe	121
PID 2664 wrote to memory of 4448	2664	msedge.exe	121
PID 2664 wrote to memory of 3524	2664	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start "" "https://discord.gg/ronixstudios"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ronixstudios
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/ronixstudios
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffb6e49c188,0x7ffb6e49c194,0x7ffb6e49c1a0
        5⤵
        
        PID:5108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,13590495608199806810,11665565687722261301,524288 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:6120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1588467665763596077,17098417613809635497,262144 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
        5⤵
        
        PID:5396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,13180713622587414128,13606276912622393793,524288 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
        5⤵
        
        PID:6136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11757555270526628520,734685268034836203,2097152 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        5⤵
        
        PID:1276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6934513799493197982,12677150888819001015,2097152 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        5⤵
        
        PID:1144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,3855219072762363394,8543537168683190686,2097152 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
        5⤵
        
        PID:3852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,5162524743529160003,7538344458322615989,524288 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,818900932586750534,9211833516597019074,524288 --field-trial-handle=2184,i,15175189929253843870,11716417429692583434,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb6e49c188,0x7ffb6e49c194,0x7ffb6e49c1a0
        6⤵
        
        PID:5000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,13868065873723407415,4093311033763964274,524288 --field-trial-handle=2532,i,16234583399753972191,14860398625878165326,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,5461115345817665277,6922850973341755835,262144 --field-trial-handle=2532,i,16234583399753972191,14860398625878165326,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
        6⤵
        
        PID:4544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,12736409247283587797,5058548273092522784,524288 --field-trial-handle=2532,i,16234583399753972191,14860398625878165326,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
        6⤵
        
        PID:4448
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,12919043358062000261,165880258138583052,524288 --field-trial-handle=2532,i,16234583399753972191,14860398625878165326,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
        6⤵
        
        PID:5252
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,12919043358062000261,165880258138583052,524288 --field-trial-handle=2532,i,16234583399753972191,14860398625878165326,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
        6⤵
        
        PID:3524
- C:\Users\Admin\AppData\Local\Temp\Ronix.exe
  "C:\Users\Admin\AppData\Local\Temp\Ronix.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5152.624.9670538014118297997
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x120,0x7ffb5a8db078,0x7ffb5a8db084,0x7ffb5a8db090
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,12815779435744934167,5095761210530377172,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1628,i,12815779435744934167,5095761210530377172,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2336,i,12815779435744934167,5095761210530377172,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,12815779435744934167,5095761210530377172,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3816
- - C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
    "C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5850008303a32f5508ea5b04f4f9fcc2a13d2046940b5c17ac32956a9f029384
MD5 d7df513c72ddc12543ce371f35ca49a1
SHA1 825871ff5b3f944deec7625dc03e592ea1ee4bb6
SHA512 334b12e599f8d21d0ca024c4e0f0de4b6ea6de8b0ee744f559c2b52d2e8384c23c738cf9bc7dbb5260fe22d75c1fe4e90157ff3f23284be8e4a3479e55f483bd
TLSH
T1B0D023313AABF859D01500704D1273597B1ACD5B7CC75516B113547DAC1D4555FD01CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d356a03f92bafe6be44edcd7a2253b57e0c2f25c18077d8f77a358c3021df3cc
MD5 0ccabdacb84d9cb2639a96e5ca0b9723
SHA1 bb3dc8372440b67759d512e34faaf13e2b9b610c
SHA512 1124e5224aedbbaa26721c6ba1da89634ab54eb11be4506d5fafebace6c90e6313146fda715694f6881675cec54f879b28019e188cf57e06feff9edc35338138
TLSH
T16EE02BA5C862AC371CFD1B5860504682EB5423473782894B3A3C930C8FB1937458685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 21d80663934a2ba1a1a0106bec72eeabc4b4c447d93ba87c4511c600c324cc34
MD5 d37c88277e9827d26186bd707296dc1d
SHA1 ca64c9aaa1940b0a27c53c8cb1f4d2aaef74fa52
SHA512 01458449d0e3cdc46f72d0614fbc415cc12bd723614e54fa8110dbd983e7639ec5bdf93cc350718d58fc5b827c20131255db63855b4fb80c1480597a356209b8
SSDEEP 384:FT3m5vIF4NtFbI0YpmA2vnKcxn7eKEG21sSdbxJW:F7m5vIFz0YU3vKcxn7nNE/xJW
TLSH
T16A13C7FE7A09DDA6FAD3513D4EEB5A301378DB61CA801153F3B7B01A826A35E2C5D604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 406b3d1493e0cdf292a6a28ec6f0639f90d89fe6f82859aa59e6976636ad0776
MD5 30e22e79d58069ea5db75e4b3c0f0fb9
SHA1 d081013301f20c36c9fd7d1747542c6c53e3f37d
SHA512 f5b4860eda7b08b483712d0cea1ff651986bff2ceffecfef01d537e0b79a852a97e8488cf791131f7e86df1b149516b97a4d8c1faf0931c47780fe941c6d1fb5
SSDEEP 3072:2jMZynxMa7eQXuUYJqK109ZdKvPp2cCFYX4:2jMi7xY912ZdAxa
TLSH
T10FB4B6F74901A41BCF6802F593133A3CD23B415D2DD6E8EAE5390CD56829F22B6BCE95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 2.0MB
SHA256 2edb66b10dc2cc0eadeffc013ec1d45821269fb4f94e6e4573c28d9dfd137f0f
MD5 df9b69c3b7ffc77d90f39cd2f9b8b529
SHA1 ef6d3b977252df8b5163b2e9e795df243a7117d7
SHA512 90c6c36ad5c5a3fb4df2e52de8877d8517077a3532206e286b88cb735c3bc126ddcd8e62cd7621af8bc0d751d9ec02f844708f99f34342636d978eb7e85608d9
SSDEEP 6144:75bm3Gb9gLx4Nt/I68xp9ZVeKk+gaDB4o2Qi1P92SKmV:75bfY4Ntw68xp9ZVCjh
TLSH
T142A55DDF4F34AA82DBBACDB0F9C4DC1A7DB411C1BAD6E0832401C66855837C16B966DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 f57a7e09683b55dc378d34fcad46083726ae3f2de81eedd9af3afa7661c16f38
MD5 af7c9f91a497af208ffb85d2f6d375f8
SHA1 ea08e4adec6bfb85fc5528a9def5ba3c938310d6
SHA512 cf8ec1a999ef3b22691b73819882dd882d97d827d4a24656482cc2b8c9e365f6415d6194eee1220be916523470bc9257e8011896f346e34f579e8725cd9cd247
SSDEEP 49152:T1baBAOBTF6b9qp1r9OXa2VUmTg1z+Bv/h:xbABTF6++UmUUBv/h
TLSH
T1FB868EEEC6785C83CE678A70B4E0EC477C7412C3B955C1D38958C59412AB7C1BBAE2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 310da8c68ef9ea62c7151985398a495b9b12e7af9b9909eb72bc7e8baec005ea
MD5 24c3eeb4536da073313a326f706e789a
SHA1 d67ac35776d83ad52904e3a1c17a6c52eb8b3bfa
SHA512 82098737693c54cc587ee24d648f473fa4f5e8c977da5f3744490ee7958233f3c33691a9695158f6b756984efe885cb4a3432947a08c6bbcc42fa69d30e2ac7c
SSDEEP 96:w03tXsmc39Dnvj6Lv6ytAqFmle6YGJnwzSsADhcaq7Js/:/t8l39Dr6fpe9wzSsAt7SJ2
TLSH
T135C1D9D9689AC818FBF065704BF914C672B1D74486A73E6BF9F3E03E6725760E84C412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586f01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586f01.TMP
Size 3KB
SHA256 1ba997696c321c7b8b55c9abf3807eaeda51e4655b055e361ad8344e94e411c8
MD5 bf600b0104807a610322361e1580a417
SHA1 fd294afe5e94fabb7523c38d107db2e60b0415ba
SHA512 bb0e04b23df355faddf2d40ad5b17081ba06931d293ea122823157594d6dce6b85dba418ef18f86539cac171c5235ccbb9139e7a02e4c59994b9c46f2d68617b
TLSH
T1A361F8A54C688064F7F125B083FE10C57274EB5906A63E2BF9F3E13DBB15B61E08D856
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 cc3a7f00b31066a89a802c4a2cf84ab35d58bcb6bcf54e664b3df781b63d55c8
MD5 bfeeed3077a327fdbebd96128b858081
SHA1 ae47f6cbb07049e7cd253cae524cdfb02fc47348
SHA512 ab48574814cca9a3f5f0674d97c363f1dc9d7acdf1c8ba4218fd5e5b47339fd86b19c02b9c5ad24387de95128a23ef25e88dc2b992f52a3deb4683dfee4526bd
TLSH
T19FE0D8A458CBC1ED551134C2426CA708D3803653E69ABE036F088DC57603401B641A4A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 1aaa39226c65d637676a698d73bcac15f609b9e359625ba2030c4137351653a9
MD5 65ac0706119e7802920db95a7922cde6
SHA1 6aa8a5c14644444fd1e67b13f44ec7a07731ebce
SHA512 674f0bccbbf996f1509ea5600396723a4c502f79b5fbf8dfc53ba93c4c09883165b6076e10753b48c7d86f45d924abaf22aecf379d8c3df78649c2ca9e38739e
TLSH
T147E04F7805CDC16D956568D383BC734E83D1754AF7A97D12278D88406107A45ABDA294
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 cbc844fca8e34a82e73b9dfa6d1efdfbd943b300dd2602e6fde858cc453db652
MD5 71ce3df06259ff761470e8d2614ee808
SHA1 575d461ee52b546f39f8b8d061a40d9fae88940b
SHA512 1b1c72005da1e3fe411ba1556b2fb94f5f2cbb5a59ee83c8f2dd6bf419959819d5cf534aed9c79610fc39d0b124101375ed34218a414241316b1380681ecf5f0
SSDEEP 48:uzBmw6QU1Pz6HwJOrZjrte3FJu4yeRvXlGg12AxyU4H:6BCxOwAr5M3FJu4yYvXlz1Xx6
TLSH
T1B692B7470D393853EB451B7A272B4479CD7BE19CBFA5CC85312550641EF8652A03A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 861dcd32967b8a2c0873dd7583ea0ca411471e354cd5fb92e69b922dd547ab16
MD5 acb0524f4fc6f3b64408bff4f4325fae
SHA1 a510649d48284c4309ffb1675a70919bebdbb82c
SHA512 8a810221833fc6d5fa18bdfaaefb4cf2ce6da549f1abdb3db5de8a5b70e294aedde4593fd0f70ef8a8f3539b9f03f4866319de8d784ae29e52dac358244f0350
SSDEEP 96:BQIU+bGz83uy3+u4tgp4DLjGQLBze9z3eCjBHMsDEuspU0wbtqrOQpPfR4J+MCXJ:BQf+G83uy3Ct7XBBKCmH7DXspU3iD
TLSH
T1A714201E5F242721CDBD517629E744B35D6DF03F8B1266CA6C6114B4CEE3B52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 8KB
SHA256 4f2fbff3d272a5a91dd1cedab2c020c10dbbcdf912559f8612c895d2349e7c2c
MD5 fbfdee95679960b6bc39aca0200d8dbb
SHA1 256f578327e55c303469a1851f74b6ab58348abd
SHA512 10dc4d2029ead46779fa947b1a251befccbbef3099c36bdb9e38cdd038b337d88b3a5b02844ff0f8314bfc5ace4b95688ad8925a53ff02e9418daa7ee41de600
SSDEEP 96:0q2nwePI1aZFADZXYAyKU3Q2mIAMuUZv3t/aP6uKXl+CJF9o1uqNXTZzgFGLtOl:VGPhfuU3Rjhd//bMChWjdtOl
TLSH
T1A312327FE418847E877B8737928B351DCBBB397A184CF559E0C21D0C066E66E1206A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 e19c899933cf0f20ecb6fdc7a539dfdfd916c367b7d2fdea5464e1f0e7952db4
MD5 1eda72c391b2aa854396e4c7737e3ba7
SHA1 a1d868e4e221fb7e95b945fd8c64dbbe761636a2
SHA512 7a1e47eba5eee83cd45870822b54d08747bf1664743e88f85a5edad5e785303e80c8ed1074fd9cc7fa83ddec773b3989ed53b9099f697d2ffafd7c0058707cfb
TLSH
T1B1E0DFB048CDC1EE6204208B83AD770DC3E03A0AEAA86E422B08A951F406804EAC23C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 2ba6cd19564e2dac8cbcff9616036388692b666bf59fad4c1eac479f2d148640
MD5 55c8f03b16d74219bc19612f3c294bd8
SHA1 5c48797b7fc38be28844ecfcdfe811672f60cfff
SHA512 28bdad1f3bfa2ad9d80538833a4d9512f07b62d0653ee53af26544eb6e79876290e48c54867a3adf897c771c352978467f14a6ca1aa9674e038fb54aeb5b6c2e
SSDEEP 48:T2SLopFMatSaw/auUOt8B4nCM97fYisRQ3ERqd3cpNHNMmy4NgFHNOdlp1NF7Ioe:iSeMatUaAKkdQm3ERGP4bXzIxXbNx
TLSH
T17D92C64F4F342610D2B10776ECC088062F6E11ACC3F32B92F91960B68D62DABF5014E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a8ff464831eb1887699f4144b2d7276129cda459246a55f50c58057727f34165
MD5 d89bd49137cb57168359cdd87df51ff2
SHA1 367875d1855a99c4e942116a980b7e8c84fa6fc2
SHA512 c675a2ea784b6eb0e805bfdda125d4520008c5f90cd7a9c9449ab0302661496bfc2936709932becc6e4998ca792a7c889258c827ee99bc2d0b45fab353337786
TLSH
T148417CF783B4866DDA1196F0AA18AE1FCE2C0924431C7C6A85E0AE1B93E3571F041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 b23bf47930f9e9178c5d34abac4f644c8ef9cf1b5b92cf6dc43756556c3457b6
MD5 d1f7b62078cacf69114ab2d80be1e83e
SHA1 088fef8fd7e96fe63ace385daae93766da181529
SHA512 e44c345d5dcdacdb83be6f555da3dafaca1029c10cbbc14a733cd6d8f4b5810c3077b07e25ee01bac37f09417f16b0b2dc33f3f03e355598a1508e1336d8e44d
SSDEEP 96:OIEumQv8m1ccnvSWsBjUj6csDM5uITKRGORfRSOGITKCCINnFLLIAmRCPhI5f4g:OIEumQv8m1ccnvSWh5uU3Al7Q
TLSH
T165F215FB06379209D95444B094046B9EAF12045B07F6B6FCA7C14BE3F7922E3F1A9B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 53136eb96598d0bd602edd9fd4656ff68cf5481789ebf5bd71f92248cabe8573
MD5 c47c04f16bb37a7de4599a01e68dac0e
SHA1 9fbb270c7afac48789ed0127b615fc6bc63798b7
SHA512 df8e4e1244a2c4cea7b9dc0deec99c814ec1d1063f33c845f0bb89582eba39abc0f72d082bc5fd0de54f855138e844e2d47f57661678c8b85c6a2e95a4dacd6e
TLSH
T13BF02BE7C2BDB833D079497F2C8938003DB598340141A4FADDA6822D70A48B6DB02877
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bbf5bf2fd74049bf6dca018c57c830f4d14b75399f39caad74b8c6367a6a18ce
MD5 54d97371041108c4d71f9942aaa75a90
SHA1 bf8888c239b971c7d0081e3cf7c2765f19eeb059
SHA512 540aac81b62247545add36dcb008d1737bb72c3c63b4e5fba1073701a3df73de4a2c4cb94361ff81173d04a69c7ee7687260671dd0cef579b7b821fcbfaa3031
SSDEEP 192:sxZ9RTVyMqZ/K1Ml8MjC/fUsd0WpV/I0tkvqrjRpzodp+nHW6+WNXrW6lD/Yudka:sxZ9WZC/fUsd0Wvw0taio8Hbz/mmzZbZ
TLSH
T1A872E905A538997BCCDBD219FA557FA3D7F81563E2904E4499FC8A1C10E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 95e9309e068b09ea26c1afddc243f14a870cae924465b1d0a6a9888f45bbe90c
MD5 707d8cf48255904e75f7161c174976b6
SHA1 4c9686b5487f56ee30eb88131e298c3808ec4976
SHA512 f236443c720a87dec32676db51d2348fb135f76f86e8061d9ae25c2ce1b69c0afc4ca7d62274cdb415151a4b483c0603b106dae9c34335b6f812fe108621fdeb
SSDEEP 768:DXgLiAo7pLuL/aeWvaSXq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXMKJLlhzCpUroA:DXgLiAUE/aeWvaSXqu1jaqMKJLDOp/A
TLSH
T1F2F20C3B2C0CCB7E4F844A9CED2ABE8E6DE402CB9698C95447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 c14dd4f4b624ddb6d7d405ef863729c7c5cafc2d15a287cbe2a0c3124adb0215
MD5 75d9afc5bae26cc0f2724fd1ea2a2064
SHA1 5b8bc5b8bba3f97095d2e91f5e36633f177388a1
SHA512 a4e22042b420ada9ce8899ad071dd22e3395eca84b0f8b5d749a0841027908306e94fe90117ab2857ffbdf409fd970799a4924a37ea5ac39110e3a17050abd5f
TLSH
T1B1D0950B92161454D7BA87511A21105B47356C44D892844CD401303C8034503A113F5A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 afa50f1bad9b7257d742fed1b47933f6cfc2c619941c4f81f935aecfbcb95312
MD5 873b615fec0de6c79f0eb6c7aae9fb6e
SHA1 27030b4bfdf32cd15697f926176b05b8a0e9ca8a
SHA512 02ca45cc779baa836524b03a7b75dc0d32e948178e75e31f5a5cc3b2a35f7bc92628d99bb20140a2fef0188b68e99bc6851aee7a1dd4cc2be7276a56fc8a8139
TLSH
T170D0970B921A55949BFE8FA12A21202B8B21BC88E8A6848CE001003CC444A03A103F56
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5859a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5859a4.TMP
Size 138B
SHA256 b88f1465b288af29bd4de845a49f50d8775a3f9f4d3409433d5b21b81c82a784
MD5 869071eb5ca59092efed2938b3c0927e
SHA1 80c092b689dcd23e4f78c85c97c7eb437da0bf73
SHA512 7aedba8fd4686931cd2fa5c21dc2c57dcd447a0dc4a8a923798905db613a049a9e5e5df4e3d964929fbd41a1b380dc850b9444ace79174f83849a08ffe3b2308
TLSH
T18FC02B67A71A11058B2A42A10B32121DC7152CCC9CC3C84CB00338349030E137107FD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 8099c6452634ec0ee4378363668efab1223ba116e43466dd25941bf6ef813c35
MD5 7c8c40710d83285f13fdd46d3b70fdfa
SHA1 ce1c32047907867779532cc9d24943d759f0faf5
SHA512 48e34853eb6b99d843703a97786e7f3e7f88d3a2022f0cd6420e724d99b23707941408696c4c75eb15710b681c07b07b932c7073247ca911363b41cecc8be160
TLSH
T131E0867005D9C1BD60562483437CB34993E4B617E6E97E023F8CCE426283A44F5D2285
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 9df7f6b7d3e79b177760b192ade27e9dca3823abca88d7cd739d2b90a1e7afa6
MD5 344096fd68cd02a109206c7eb6825828
SHA1 428b5276764fbf5b2b7c1b6ca6f8648b903bd96b
SHA512 d39f571b1bb746ad1859c292233debe520427c00d3a30e494f4c7a3dca71b1c348b7feb99f7195ef6d0f25b081121a78d4cb950a595fad27f304917575c195a9
TLSH
T1ACE0487415D9C67E61863097435CF348C3F3B587E6E87D163F0CA684620B985B693685
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 7707afc2dc0ab4fdbf768d1458609aaa442ae3d7439f66e446a949a24e3e262a
MD5 74c362b9dcdab83ae10899a43649d1f7
SHA1 d5dab168432259362c9446c58e75e4283eb0bd69
SHA512 eb59f7e45a8188f1222d96a298550c36c6ef2e147f593340a435e0e65bf508ed324eef2be1269859de38c29d9993758210861195ffec39428c65c517a830850e
TLSH
T145E0867085C9C2BD51456083437DB70D93F0BB06A7E87F46670C5861A1426C8F6E6684
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c878cfab78a245c18f18225b7aba06c5a327f95fc98d6ebc93b317658ad510a9
MD5 5551868a3922c5547f2afd8a9889900e
SHA1 0e45804bf2432a8233d4b35fda46a7266adfb5a0
SHA512 5746afc8fed0f140b0b6bef9e6a40d8c7273f71bff70542d2f29f685b0fa661e475921cca93f77604ba0c35321ee23cc5c7792219a231b7e9d7cfac8f6745e0f
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BD5Dx:krN/INhx+kcxKBzxDVx
TLSH
T16FB23911717B02803A7E399A85A5F42F66C230633098B53B7BB914A60F6BE60DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 e898f445542d2c48887ad09fe31e9b63ab5659d47839aa538787b60267e31580
MD5 d2b631142a1eac6dd630831a3940a691
SHA1 37470756ff8ad74a9b007280f8b55141d50faaa3
SHA512 fcc24ef650b04fd094d05755d541843914fab257b1932a4df13a621b8e8535f43f3510fdf9892abc822621764430c4cd6edea177054fc25e6603ca3f06ad399e
SSDEEP 192:P+xWfDfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxIfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DF24520A7B747001EDE6D9725CB080771E3CB16DCF22A6915DB254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 cee96e8d648a1c5b0205202140477f056e3eb2433d05590557c6ae8b6c66d761
MD5 deab6fd4202fa42f5fe988b4f75a5354
SHA1 f85a65f2fc80c83e63a94d924cdd83defcdfb97b
SHA512 adea842b5f0953878b4bb4f2384c2fdd326c841176cb89b72cf959e011f1baa5d2fd8673958db636dcd6a2b0762679bc01a9749b52cb4653b963c0828270c1bc
SSDEEP 96:J89+c2vgxZ5CQgOXrZeDWXWY1lDsjseCNAWVKLl8MNxWWVKQwWWPWAwl5N:bpO76IAsKLl8MNssKQwHejl
TLSH
T15F222D247A011B33D20D4EBB12F98FA217D3C0924AB766AE77210C6D1DD67278BC82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 a841ddd0d2a8682c0455e1681884943e7f853fb59d00c55e5dfef2044b30ad18
MD5 0b65806a0b6dbf2d9d4f3fdbb1650ca0
SHA1 18739ee8ea4d7bd7bf88f8205a9f0ee1582dd22c
SHA512 18a73c36c3fa1ab96381dd8478d6e9d62cdb1c91dcda2f217457477a1a5f96dc1fa6bc1a092562dc9478a8f29bf6954fcffdb48ac3e584e940a9f94c1dd60b47
TLSH
T110E08670ADC9C1FEA21920CB176D6348D3D57A07FBA86D462F08C444E102548F7D6286
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 d47296cc8dbf075fb77fade220787f5aec60edcfc237c3658b917226919c246d
MD5 ef3afdef67d116f069d8bf54ed66e447
SHA1 edcdba7d20d1bd0b4512a5a23376e5603169f449
SHA512 06c854da858386a6f118efb528dadd672fb5db210d91a2b821c8018c86bf2d1bba9901b2efe8eb53140beff5fd76afa03cece049e00afd55cc0a38090ab49022
TLSH
T1C5212E12F720C158E14E823E906AAB351378E9569FBCDD1F95B934352D72F041E8F6E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 01daaf464e0724b378aae8e4e863d4097cf1b6229bb4a52e5be4e79f591143fc
MD5 3abef9d3aae6362149214f4965184f41
SHA1 2d51a3329f31edb38b86df28bb57cb3f06fc8450
SHA512 0e47e95329afa8254ac6b240b6226b8335add3b73f117ea59512222e060d3a2420bee4afb8b1202b410a13c0fb0ebf74f970ba4852fa28b88633306161c2fa38
TLSH
T161E04FB0A8C9C1EF91152097137CA348A3E57B46FEE86E062F488954A9025C5BADB386
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 f3ebf648db8feea37ef00e60304b9df758a7c455d29f15b1b03026173c643e7d
MD5 45c8be19bca709a192a554b4ce199385
SHA1 3375b0f247e4e6416b69f0bb2e59c16a02dd6acc
SHA512 271d44ce2c7041d3f5abbd72ea120f3982a6a7ed883b91d10beb19b84338ca6134ede5ceee1810cd1637512755837bffc3af0d7cd251479a81a93b19646f9894
SSDEEP 3:MsEllllkEthXllkl2zEflWWm:/M/xT02z7
TLSH
T1BF4402046F850419C5406030609183501370D5100A15574334A2442B5CC6A402C04100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 fa82f3d28b1a46caaf7b46a4a8b77e9a48833e9897aa6385d9b3f68cc4d7e301
MD5 f0bfc71b79f86b5dac9d9748ebc2c581
SHA1 acd802309b848cad5bc99e7fb2c3741abe0f241d
SHA512 89b45c7b0e96c8ec4af9583c5f414557db0b8d24e07da5e98bba98c21f81d27f85b39dc692ee2cf8a77af2779d342aa92932499dcd39f8777c3db74bb7c5579b
SSDEEP 3:MsEllllkEthXllkl2zEflB+:/M/xT02zk
TLSH
T16C4404057FC40405D54010314053C3D45374F5100D31574334F1443F5CC75401C05001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cdd5a29e7f0b598dc5f79f31793f688825275412d5c2aab95c0fdc4609c1108f
MD5 6bdee5c578fea572bd54950c37d242cc
SHA1 1273b0453615a0083b628345fe9c74eb18c43dfd
SHA512 c36aa16b8333996f5992153fb2f4afc6e42e19279d70240b2a5fd8b5a54ec892a1fe4a1b85b6a76149de76b86b4c6552959e8c01e01c1bcfddc3747eafb410ef
SSDEEP 384:nBiFavqMg3sNu8TUNTUlIm2ZTPl1jOwfjY4m1w6NdYJxRYV/Vw1mRwCe0irN1k+D:oFayv3LwgHDpY0CyxRYk1my/0el
TLSH
T1DFC25B32E854DDABEDE79BD5B70A7603DEE08267C58C4AD4DAD81E1E00DB09E530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 623355b9fb058b6f61707f7dfc3c6b340fc6a843d012b2c83d36f05aac0df869
MD5 a0eefcc52ca264f8298fbddd9c57122d
SHA1 7bc72ddc77f1cb48f6637fefb77ded7cbd678c68
SHA512 928eee48673493b38d83e0516f01b67ee09e5444c920c6cc4c68c735f05cc428d5c0f2160394b27a6f4884c279f3c694173afcc4bdee87019029bd45b0af5076
SSDEEP 384:n3iFavqMg3sN48TUNTUlIm2ZTPENz6OwfjY4m1w6NdoW1RYV/Vw1mRwCe0irN1kc:yFayv3hwgHEuY0COERYk1my/0el
TLSH
T129C25A36EC58DDABEDE78FC9A70A7A03EEE05167C59C49D4DAD80E1E009719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 a73730797c929b090b62993a8a52d004cbb596ef21ee6c535cc8fb7ea383d597
MD5 b6d449ebda827887107d7b581a2d47b3
SHA1 441e25ad0c887138162349bf26315766e5f952ed
SHA512 4ed6ccbe45b2a7dfcc8f7ff69770c2eda6aa60eeadc1a304dd16c607f25cde91f4274bbd9aa4fddcebe7ab66049ca6455924e5d5bc8ac0ae5eaa2573d73bd0a5
SSDEEP 384:n5iFUvqMZsNa8TUNTUlI4AZTP9BSOwfjY4m1w6NdYE0xASTxOpaE9Dk8NfegrN1j:QFUyw7wg9DWY0CdvS0paE9dNfekj
TLSH
T1EEE20871D894CDEBA8E2DBC5674AF6026EE40277858C899CEAF42C6E309F4FD4307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 a624ef62d30bc2653ee2f1bad36b91848eb4ce6b155cc0704d7c7e5ca6e88fe5
MD5 6cc3494c085f755084f8b071aefc84a1
SHA1 faf47fedd54dcd1050ed5f03ffb0a3c655431d10
SHA512 1ad7251e7acc9639bb325117925ec9d8358b120ca3452b4ae9e3bbeb98a7c12d2a3631affb2cb1c771a2db1dee8985afc52ec869196f3a4ac004630fe7dc9d96
SSDEEP 384:n5iFUvqMZsNa8TUNTUlI4AZTP9uSOwfjY4m1w6NdYE0xASTxOpaE9Dk8NfegrN1j:QFUyw7wg9UWY0CdvS0paE9dNfekj
TLSH
T14BE20871D894CDEBA8D2DBC5674AF6026EE40277858C899CE6F42C6E309F4FD4307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 102a9a6d436e152b0d2151850e892766541499b38994fc7dfc8670c492353fd9
MD5 331b9b3236b0a8a74a01aa586d746878
SHA1 503901521526ccee6141b84044f1c6872accf854
SHA512 3310cf54af907ef3928e4b80c606264c7882841c71fb18ba82ba0a8f45c9186012f5c656531869b01a3c37bf6beb6d09e36267be9e26c647107b645466614418
SSDEEP 3:MsEllllkEthXllkl2zEflPV:/M/xT02z
TLSH
T16B4402046F880405C550143040A2A3601370D9100912A74B38E1443B5DC65409C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2db1bdc1f29507052fe429a22ac3029a667873c18fb2ead80f938d8b68024ed1
MD5 3a88b572650fabbe9ef8c6df02724951
SHA1 529be61bbfb8a95b780a33252cd53fc94c96990d
SHA512 fd6368268e2bd720dc8e5eaae893a01ae998134ca0a9c0ccb58bb21cc437a057a4ba36de2f382e70fd16590ffca0fca2fc8026165738cf8a032c153304e7bd76
TLSH
T11941F759B6ED1148B3B77F1A9BF6686E487AB8772F06D49D00110E4E0A27F01C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 f705d283bfb9c10952a9ccc1f3f7ceb67aa7c7dbcbacdbbba667a65dec9b8042
MD5 3051a922731f4475e799ea912078d9fb
SHA1 ca72cd7edcfb441bf98d19e5d077b998182fc569
SHA512 a68f7721f3b141bb2e11a10a4dbd2ef63c74b47a30073039f95f75e7f84f65efbdb03df2c2564e6823d463f849fc386391dc1d6ebb148449eaec5547bb9fa930
TLSH
T1B2517F5CAAFA1018F3B3AE5AABF2B55D497E7C732E0AD45D10510E0E4623A40D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Ronix.exe

Path C:\Users\Admin\AppData\Local\Temp\Ronix.exe
Size 15.5MB
SHA256 5557080d062f953443f6482afabfd048cad643726c5ac3d7862a84ea99af77a4
MD5 71d920b006b80dde1931411f5fb53984
SHA1 605a5509956749e63d5665d8d6b46629a8fdd7a7
SHA512 310d0b6da6da8051ee36987c0e3b707c8446b4a72301074d1c176c6c74cb02a5f81b6606a5450aa2031224cd46eb9963b21fc60a02f6dcf8f240d19be3056769
SSDEEP 196608:3ZL3AuoWGbcyoKgU7AU2222G226LCe5F:3ZL2TzoFU8U2222G226Ln
TLSH
T19DF6F7247A5B996CD05BC4B4834B8A73497130CB0B39B9BF448596382F6EBF46F3825D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3b81086f2b7cf869ae392ab1ca8b94b48a496cd925420f7ac6687e79c50f9610
MD5 b3645d68a411cad22365db2db81edc34
SHA1 5b9e482d89a7b14cb86b0b473940f517d1b595f4
SHA512 6daa70aa981d7c32b00f20441b4a6e5e6f917f1442dd3753389dc0e392b26f26bbfa6c30dd75f48a095b6572d7b435154a79b4e52babb9ddf20b6a49c4dfba6c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 352b68c9454cdd885c7632bd45314717a3802578bfccdf66c6a49306b37e6348
MD5 14596eea262b72841ae6422dabfd771f
SHA1 92e0c131e8a4c197b70aa3ee9772768e3de8c0d3
SHA512 b165278ffdab4ebdf4f7f4ce8f2633ee377433c121a6539798c9f2fbb3f3a62b3a37e80a4db86eb2fdffe3abb72720ea86e00fb7d0a51d8c91385ac3276856dc
TLSH
T108D01262360101F4C02021731102E9094500D10B410D4000943C851F3A144602903882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 832804316351fb6dfae76f0371cf82f2dc8d4584359cf109f031be7674ac206f
MD5 84b508d0ba4c084f72da211daa31d7b7
SHA1 8761de49b0f75b365cea89dddfc542ef12bfabef
SHA512 7118d6ea7ef0e7d0485ec75cdd9671b65c98137b34054e43e773ca6d77e7e77e012b23c16ea9ade3c35f3030cd4a9b6ca049b32472045af1ef86f83b094c7b74
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 e55b32b37b6ce2d93deeabfbe7d89e23217910b743db10cabf04cb24c428a377
MD5 98be9852f4f791d5b2e248f9929350de
SHA1 09c8f8b4aaa3c7fac4fb71a618b170277a004188
SHA512 d81eac01c41b44cbfcdc60c94f27cdf76810feabed70c9bc8c712490f6ce3be667dddf7cbde8f71fde4f21fe53e3ba59f143fff127d268725d8947007da78996
TLSH
T1C8F02BB53AC6F219FB5298B011F14C8377310C1051435E5B4FE898BDFC423886D0461D
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 da105a522375657e3842d2bad7a81275b826c7dcbaf4a94d5f353fd671d3abe6
MD5 821203a222e9f4cbe614ef897a972379
SHA1 11934f159313d8318008e8682fff37b011313238
SHA512 af20de116a4bfa9980e7dd4315d36448469d7ce4a23ddb221411c3657d22f254d316f9036dc9e0b1f3f43803804d0817d107edb85b740ad810e4298ff5c88055
SSDEEP 3:LstlNllkll/lb6/:LsX3lEt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 37e7fc0899b44889057155cbb001136670a1d1b0a4409838dadaad95f9b4f696
MD5 b1f0b5e09ac9e17e5cb03c764ba8086b
SHA1 86cb893cf9076fc6a9d6d451b8c434fc9e9a55f8
SHA512 631494f14a42aea979ce94408ad0206b9b3ddd8a2bd1a9cbc4cad23da25b5b8382c54a4366647e74a72d78684d9f71848eb964c6ec332765d2dcfa33bc2fa9b1
TLSH
T10C319EA2C3E4C66D8A5166E437347817CD2E091993287E2BCDEBEBDA67D10B1E11124F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe588c7c.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State~RFe588c7c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences
Size 6KB
SHA256 8da04d9c3095df4c3dc9a3b34b1df3131b955bebc7ce90999a448f4102e2ed0b
MD5 d65af8735454382b7e0e7def31a5ec8c
SHA1 c02424fb0ba26e63b4adf12653a53bbbd1b85152
SHA512 674f759666c7ae21302cf77d0d0c6449c06084102f057f2d3eb6292f02f408ddad2ff1d2e695e5f270d98b017f9a708b34c519062ab35d1ffc73828253f25a29
SSDEEP 192:stQ0RGKfaZ8parza/S+WiTMzoxgpv+H1WK8:stJRdVh/VMoxPd8
TLSH
T142E1A707AE28A97B4CC7E219BA35BB62D2F9102272D44E94EFFC861C04D66DD520790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe588c3d.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences~RFe588c3d.TMP
Size 6KB
SHA256 a004abf96a7a2b40adb84e16c680119e3aec5c16838b258b88eb4301546c8e63
MD5 d367b90c6d0ea71d790c5516c88d465b
SHA1 5f283e7f8566deff5736ea3fe56ebba1fb544161
SHA512 6da0746d9a6e0517b48b3429525327cb7d118fd1680cbb3d75dcf5f6e4bb67a8d8850cf8cadc783f41f237181590ff52d51c99efc223f7aba2d78ff4a01b9e02
SSDEEP 192:stQ0RGKfFZ8parza/S+WiTLIwxgpv+mEM8:stJRd4h/VAwxi8
TLSH
T173D1A6075E2869774CC7E219BA35BB66D2F6103272D44E94EFFC861C04D66DD620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 1KB
SHA256 d5487a5abd8119b74275224ccf5100d33c35f0b256ce4ae78dc07e5e68ff3fc2
MD5 4a03331d711fd669651d821d97c06b2c
SHA1 93769d7e15ddd616f9ad0d30b3e7479627cfe86b
SHA512 1ec8ed4fa5688f7553f394c28b13fb5c38e4aa3ddec790b8bfbee6705d01a73c716d7d4eb39299cbc64aa0302711cec895c90f8b24ea0c3ea098684332b11ac6
TLSH
T14731B5B7E4B42B336C82911072033FA76E3011228222CE84D9CE4B1D12EB19D922AC2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 2KB
SHA256 6a73a68e3f0b4bea9d67e751748d7a97d0da62a4ad0572425f3b2207acdad2f7
MD5 830dc4dc5fb4e5adcad6a4062f2fa17c
SHA1 f93e9e4c2779c2b3c982ccd66659a1bed0e40ac3
SHA512 4ee564d640836ee283a1a0354454dd4a32b762cf0d92c90d615f8534024cf5dbc530aa4c7f6b3103d387dd05cff15a35a3f2a1d4b370a6d8986ce8be5988952d
TLSH
T15A51B873B8146A374DE39614BA073F63DE31117196626F90DEDD0B0C11EB56D2306C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 3KB
SHA256 db1630c8c54caf50e4c2e1a2358d3e53ac9d6fb97eb0c5c2d71937d201d9ea7e
MD5 864dcc3d99e5b314cc82221f6e7d652d
SHA1 d320e0434ed41f44834c35af94dbf7f0b6109c6f
SHA512 fa24bc59ee4bdec1e97e46619187bf9f7b8fb5d42c0cc19f94af5b18018f02b2ffa5a1bb5ea8c554c9ddf1e9ec8859be536f0ca46159806959b1e1be3894db93
TLSH
T106717627A864A9374DE3D904B9872B16BAB11133E5957FA5CDED0F0D11DB2981342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 16KB
SHA256 472aa7bb992bb46515ca032643b3629353c507bf207821e541642df44ce030af
MD5 0238d3b4e9afd33548ff15bd750d00a6
SHA1 9807f680bd6d5035c7af9aa995e4f33edc1a6760
SHA512 3498ff22d0b64c97e20430a469131ee8132a9ec77b66c7a01bc61ef278d4722808ce62e1620961bca88ec9d5c3e91372e8aae6c46dfcb1e1c37d21bd1067245f
SSDEEP 384:z1fRE5BdEZfr0kuh9Rt/nP9yUNbKzJSDu/Qt:9RkurqhNsfYEQt
TLSH
T15472BF2349309D376CE7C10A790A2B06A5F4804EA1D6AE98BCDD2F1D17D7BEA0353D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 16KB
SHA256 54d010dcf65ae8b501ca4a0fadbe9350981e7df679b807548077ac96694db28c
MD5 1405016362f277943b1debe8f925c103
SHA1 1d8a3927eca483145aecf7f7a91242741a7fa066
SHA512 249fbe9a296be52c26a23d5091b60d6ebd3d6b5b9275f02472e1cfc29adef5ea2710aee2311b6ac5ecacd614c24e5b5ec8d8e952db10c0a5ce26d28f80a13836
SSDEEP 384:z2fRE5BdEZfr0kuh9Rt/nP9yd3NbKNJSIu/Qt:SRkurqhNsdsYRQt
TLSH
T10972AE634934AC37ACE7C10A390A2B06A5F4804AA1D6AE94BCDD2F1D07D7BDA0353D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585966.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State~RFe585966.TMP
Size 1KB
SHA256 ed8ff7c584998838b97d88d70b00f753ee18ee10a0afd1857495efcdbf0adf6d
MD5 98710e029804b025e4c3c56b72ac33ff
SHA1 c571d476f21b3a2eea051d288d3a60d5b69fb17d
SHA512 23e272e461459e5dc8117d71690c88b70ede2d5c4c67d801d1b8c06f2faa508449e08e4550c4bd041c51d3af77a423e6ef8af77ac53fe47961b8b50df1fc78f2
TLSH
T13F219577C4A86A337C824410B2137B9B2E7011724221DE48D9CE471913EB0ADD22BC27
MD5 SHA1 SHA512 TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Loader.exe
Size 7.6MB
SHA256 c78d3bf2f982b827b50814074bcff5d93856d73253fb4fc48a66752b9c659b49
MD5 e3829131cdbeb24128ff574828bba2cc
SHA1 5a4e4007b0e15377a3037be540a88f76395cfaa5
SHA512 bf9f10e9732735b7411e585824c4e7ddcc35ae522925fac8da2a49819625499b275824c7b05ac1a0f8c4be179d9026711a96cf6e7d72f9588642625db7de4b54
SSDEEP 196608:9+Sp7pKRFXesRv4UoVQtWfAd4FYqhsU8aGw8BU:fdpKf7VBaqWodAYqCaGTi
TLSH
T19F8633D64A81E637CBB79D3283D6E3C721394EEA2EF1B9C67E51D3CE14288A1C5C5205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix-Module.dll

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Ronix-Module.dll
Size 8.9MB
SHA256 f1656c6a99c166dc76978ce189d857fe255902258aa421fe0aeb6b7db346e0d6
MD5 829cf85678fc064031b89dfcad8faf22
SHA1 8d38b8e680f1607fadffccc22b2118b9a5585049
SHA512 cc68090fc7a1cec63ef0610d90829313d3cd674ece7d29e88f44c4bfbee696f35d0e1bb0b05d1257bae3618d69cd79a5bad98be41746169908efbe7ce48879fc
SSDEEP 98304:ykNxCH2plV6y+jrEZg0Cwy31dM5sy6hm8u7PBI:LQWDgyarEZhCwy31dlc9
TLSH
T154969E7AB6A800ECD87AC078C6578A13EBB2B496177097DF01A4467A1F77BE4173E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

docs.json

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\docs.json
Size 6.5MB
SHA256 e28b50a9566c1e541773c77c81d3de40a025bb5e0da8332395b3fdf4c6b7143a
MD5 84f1a9ee30d6245e3d2c7a1c76ded90e
SHA1 24da968f6962e612939f98af200e0ffe7edba38b
SHA512 8da7a6342e5cbfccd41e64ccaff059cd9466c4542a2b0f4b04d301a3a0404237a728ae43f5eacfe5525395f97aa568ca037de9b60a8db2cdcc4b93fae2376a80
SSDEEP 49152:UcL9mDo/9ZXJGYbihxzWwvke0vJVwG9he/8:b
TLSH
T1A566CD72C9A01C932686165DF8B9425AF93840DB285D3D88BA9C732C6F88D7F51763CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau
Size 733KB
SHA256 e012b3226113babe0923bef668c73550e11609ce17658796509d5ef44d4fcc1e
MD5 9fb7cf00bd16602f900ff353848a416e
SHA1 048cc7f41d2f63b9e87d3693aa5510aa66fb2417
SHA512 30e0b35cfc1a95bf22aeb580bd1f47267e6cc97a81e2301d6da7a317ba5fedbc6ef86b43fe4195fbeb88135249590d44939d17b6ed1a388a91f8715fe874ecc4
SSDEEP 6144:U9gNZUqKS8qf2CZVzBXlDv2bt5JQc3zVvD+TzFY/OSRlXAKAPplC6fTU2Ag6SfDI:wJQc3zVvD+TD9eX9b
TLSH
T1D6F4441DB7047130194F53F6AA9F8844ACB1A2C6916C50F8D4FCB7891B7F87D22A6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
Size 10.9MB
SHA256 dd16dfc077156df6795a69a4bbb753a0201de9513e6614741d8f1976ca9e8b7a
MD5 16de28c93995a988aaab6eb1c409038e
SHA1 424666825b9a2970a0d7663fbe66f9e885e5215a
SHA512 2ad14445e7cf7df46251d2978757ad2c73a9b0fd143d7fcae8cf9d78af1702c7a991be69330535a8cc664baa85c59ae0b1fdb8bca8354e1fd8f5bbece25ac074
SSDEEP 98304:gJeV6UHLvpVTLS0wRlgF8MkaQW0Dlems/Dt3:gJKXfS0s6QW0xemot
TLSH
T161B67D37629C11D8E0BBD07D8B8B5D93E7B2340903719AEF05A046965E1BEF94F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\version.txt
Size 5B
SHA256 aea5adbef574785273c4f39c1b7687cf801993e0cb6bf6781a41689e4edbb20c
MD5 15ca96027c93710f1c31c3be18b218de
SHA1 6288dca36116a23967560d315aa079e9c4f5da8c
SHA512 9bf66c703641955200c3eb6535ca6b5074482ee7807ab2fdf232c174c2d548f28bd26e7d3c76a510d845d370cda1abc9dd5f3ad8bda987ed39efbecacf12548b
MD5 SHA1 SHA512

Submit Download

memory/2340-271-0x00007FFB88F20000-0x00007FFB88F21000-memory.dmp

Download

memory/2340-272-0x00007FFB89690000-0x00007FFB89691000-memory.dmp

Download

memory/2856-196-0x00007FFB88930000-0x00007FFB88931000-memory.dmp

Download

memory/3816-273-0x00007FFB88930000-0x00007FFB88931000-memory.dmp

Download

memory/4752-10-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-80-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-4-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-6-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-2-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-8-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-7-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-0-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-9-0x00007FF6B9E0C000-0x00007FF6B9E0D000-memory.dmp

Download

memory/4752-5-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-1-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-3-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-79-0x0000023961F70000-0x0000023961F7C000-memory.dmp

Download

memory/4752-78-0x0000023960380000-0x000002396041E000-memory.dmp

Download

memory/4752-62-0x00007FF6B98C0000-0x00007FF6BA739000-memory.dmp

Download

memory/4752-64-0x0000023961F70000-0x0000023961F7C000-memory.dmp

Download

memory/4752-63-0x0000023960380000-0x000002396041E000-memory.dmp

Download

memory/5676-877-0x0000017B9E9E0000-0x0000017B9E9EC000-memory.dmp

Download

memory/5676-876-0x0000017B9E9A0000-0x0000017B9E9CC000-memory.dmp

Download

memory/5676-1051-0x0000017BA1970000-0x0000017BA198D000-memory.dmp

Download

memory/5676-1050-0x0000017BA1930000-0x0000017BA196B000-memory.dmp

Download

memory/5676-1049-0x0000017BA1900000-0x0000017BA1927000-memory.dmp

Download

memory/5676-1048-0x0000017B9E9E0000-0x0000017B9E9EC000-memory.dmp

Download

memory/5676-1047-0x0000017B9E9A0000-0x0000017B9E9CC000-memory.dmp

Download