hxxps://wearedevs[.]net/d/Ronix

Analysis

user interaction
yes
max time kernel
80s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wearedevs.net/d/Ronix
Sample260525-ry1ktaev2w

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
246	1624	msedge.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Ronix-Installer.exe

Executes dropped EXE 3 IoCs

pid	Process
2204	Ronix-Installer.exe
1708	Ronix.exe
4424	lsp.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000600000001e6af-853.dat	themida
behavioral1/memory/2204-854-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-858-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-857-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-859-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-860-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-861-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-856-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-862-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-954-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida
behavioral1/memory/2204-957-0x00007FF753660000-0x00007FF7544D9000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
315	discord.com
323	raw.githubusercontent.com
361	raw.githubusercontent.com
366	raw.githubusercontent.com
286	raw.githubusercontent.com
287	raw.githubusercontent.com
312	discord.com
313	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1624	msedge.exe
3228	msedge.exe
5716	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241934258081027"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{977D0A15-09E7-4540-B4D6-C16AB955732F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{9D1DA28B-EC35-4CC9-AE51-1D16BD24F266}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2204	Ronix-Installer.exe
2204	Ronix-Installer.exe
2204	Ronix-Installer.exe
2204	Ronix-Installer.exe
1708	Ronix.exe
1708	Ronix.exe
1708	Ronix.exe
1708	Ronix.exe
1708	Ronix.exe
1708	Ronix.exe
1708	Ronix.exe
1708	Ronix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
4996	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1264	2340	msedge.exe	88
PID 2340 wrote to memory of 1624	2340	msedge.exe	89
PID 2340 wrote to memory of 1776	2340	msedge.exe	90
PID 2340 wrote to memory of 1776	2340	msedge.exe	90
PID 2340 wrote to memory of 1776	2340	msedge.exe	90
PID 2340 wrote to memory of 1724	2340	msedge.exe	91
PID 2340 wrote to memory of 1724	2340	msedge.exe	91
PID 2340 wrote to memory of 3096	2340	msedge.exe	93
PID 2340 wrote to memory of 2764	2340	msedge.exe	94
PID 2340 wrote to memory of 3096	2340	msedge.exe	93
PID 2340 wrote to memory of 3096	2340	msedge.exe	93
PID 2340 wrote to memory of 2764	2340	msedge.exe	94
PID 2340 wrote to memory of 2764	2340	msedge.exe	94
PID 2340 wrote to memory of 1756	2340	msedge.exe	95
PID 2340 wrote to memory of 1756	2340	msedge.exe	95
PID 2340 wrote to memory of 1756	2340	msedge.exe	95
PID 2340 wrote to memory of 1744	2340	msedge.exe	96
PID 2340 wrote to memory of 1744	2340	msedge.exe	96
PID 2340 wrote to memory of 1744	2340	msedge.exe	96
PID 2340 wrote to memory of 1740	2340	msedge.exe	100
PID 2340 wrote to memory of 1740	2340	msedge.exe	100
PID 2340 wrote to memory of 3000	2340	msedge.exe	102
PID 2340 wrote to memory of 3000	2340	msedge.exe	102
PID 2340 wrote to memory of 3092	2340	msedge.exe	103
PID 2340 wrote to memory of 4720	2340	msedge.exe	104
PID 2340 wrote to memory of 3092	2340	msedge.exe	103
PID 2340 wrote to memory of 4720	2340	msedge.exe	104
PID 2340 wrote to memory of 4168	2340	msedge.exe	106
PID 2340 wrote to memory of 2276	2340	msedge.exe	107
PID 2340 wrote to memory of 2276	2340	msedge.exe	107
PID 2340 wrote to memory of 1660	2340	msedge.exe	108
PID 2340 wrote to memory of 1660	2340	msedge.exe	108
PID 2340 wrote to memory of 3096	2340	msedge.exe	109
PID 2340 wrote to memory of 3096	2340	msedge.exe	109
PID 2340 wrote to memory of 2776	2340	msedge.exe	110
PID 2340 wrote to memory of 2776	2340	msedge.exe	110
PID 2340 wrote to memory of 2248	2340	msedge.exe	111
PID 2340 wrote to memory of 2248	2340	msedge.exe	111
PID 2340 wrote to memory of 64	2340	msedge.exe	114
PID 2340 wrote to memory of 64	2340	msedge.exe	114
PID 2340 wrote to memory of 64	2340	msedge.exe	114
PID 2340 wrote to memory of 5136	2340	msedge.exe	118
PID 2340 wrote to memory of 5136	2340	msedge.exe	118
PID 2340 wrote to memory of 5136	2340	msedge.exe	118
PID 2340 wrote to memory of 5224	2340	msedge.exe	119
PID 2340 wrote to memory of 5224	2340	msedge.exe	119
PID 2340 wrote to memory of 5224	2340	msedge.exe	119
PID 2340 wrote to memory of 5444	2340	msedge.exe	120
PID 2340 wrote to memory of 5444	2340	msedge.exe	120
PID 2340 wrote to memory of 5444	2340	msedge.exe	120
PID 2340 wrote to memory of 5528	2340	msedge.exe	121
PID 2340 wrote to memory of 5528	2340	msedge.exe	121
PID 2340 wrote to memory of 5528	2340	msedge.exe	121
PID 2340 wrote to memory of 5552	2340	msedge.exe	122
PID 2340 wrote to memory of 5552	2340	msedge.exe	122
PID 2340 wrote to memory of 5552	2340	msedge.exe	122
PID 2340 wrote to memory of 5648	2340	msedge.exe	123
PID 2340 wrote to memory of 5648	2340	msedge.exe	123
PID 2340 wrote to memory of 5648	2340	msedge.exe	123
PID 2340 wrote to memory of 5148	2340	msedge.exe	126
PID 2340 wrote to memory of 5148	2340	msedge.exe	126
PID 2340 wrote to memory of 5148	2340	msedge.exe	126
PID 2340 wrote to memory of 4352	2340	msedge.exe	131
PID 2340 wrote to memory of 4352	2340	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wearedevs.net/d/Ronix
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x26c,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1000580499365097585,8390795560914143917,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8816173699247583257,6873089814444332231,262144 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,8695506996769647519,5624874836663091311,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,8503218502592410414,1880067043400306560,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,7989458539897944847,6049608997415327448,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,15156781712402432212,8321853927969062802,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,15989088358679070077,6952638932366156103,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,5286107480941285199,18165282788184348011,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,13916646074332522042,13912756029640957662,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,4970159777084747075,14273780603872408611,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,258300029137968090,11067501927151521589,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,18206120029566363210,16282266875641210142,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,18206120029566363210,16282266875641210142,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4197590955849127140,159846186141245917,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,13782755849605320111,5761696764846189746,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,7301952333750953679,1095435339123603342,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,10737866799552355398,5988051631716703355,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7021374079536983743,1091468392927688768,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6436,i,1144385479265087840,16079782255916716155,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6724,i,5311358785262521107,7340725128078954136,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6748,i,3539262124036457449,10453185026660887870,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6436,i,8052569541638044174,7471355397727161563,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7008,i,3506490516592520614,9302229815493760117,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6396,i,8040142831762494922,8103349656265243113,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7468,i,456923156354184458,4304626438501580478,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7720,i,2231228522055206994,125489645438270525,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7840,i,6443435706349133913,8228008285269222822,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,6364758727988458598,15147536051705426878,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7120,i,14242230683406176103,5741468753687339988,2097152 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,2272513765523651842,12144769356974537366,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7900,i,5803000060624794994,6132050529610137569,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7892,i,10674038844876433434,6148210242491144750,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,6208920875653264136,12798151929723990037,524288 --field-trial-handle=2272,i,2437795751494950159,12318032671547458790,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2848

C:\Users\Admin\Downloads\Ronix-Installer.exe
"C:\Users\Admin\Downloads\Ronix-Installer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start "" "https://discord.gg/ronixstudios"
  2⤵
  PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ronixstudios
    3⤵
    PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/ronixstudios
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x280,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
        5⤵
        
        PID:1292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,11771402028689952264,615110097385527252,524288 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,17861296307506367070,3665153759438636541,262144 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
        5⤵
        
        PID:5160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,3582441245740538936,662748485699008829,524288 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:8
        5⤵
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5488043858258632010,17691832252802668187,2097152 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:1476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8539566108478516033,13333919083312232551,2097152 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        5⤵
        
        PID:5660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4780,i,524982626704544843,7111992335856863571,2097152 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,3316901498027184815,14666994013781137929,524288 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
        5⤵
        
        PID:4104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,11018129398194489293,1877090273764875530,524288 --field-trial-handle=2268,i,10414137034285723157,12390806132125995877,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
        5⤵
        
        PID:5300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:5752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x210,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
        6⤵
        
        PID:1160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,16581182704184985630,12575800572128578178,524288 --field-trial-handle=2336,i,14079451373717328495,2200880720467701100,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:5716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,14083219982218758023,13197568181214108670,262144 --field-trial-handle=2336,i,14079451373717328495,2200880720467701100,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
        6⤵
        
        PID:6100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,15543954583754371025,5056566892788922540,524288 --field-trial-handle=2336,i,14079451373717328495,2200880720467701100,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
        6⤵
        
        PID:772
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,18389858518720198699,17707384177172520568,524288 --field-trial-handle=2336,i,14079451373717328495,2200880720467701100,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
        6⤵
        
        PID:3472
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,18389858518720198699,17707384177172520568,524288 --field-trial-handle=2336,i,14079451373717328495,2200880720467701100,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
        6⤵
        
        PID:3324
- C:\Users\Admin\Downloads\Ronix.exe
  "C:\Users\Admin\Downloads\Ronix.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1708.5848.5359511585912283135
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4996
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffe9c3db078,0x7ffe9c3db084,0x7ffe9c3db090
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,11237107222015021138,9710482412535200761,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,11237107222015021138,9710482412535200761,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2404,i,11237107222015021138,9710482412535200761,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,11237107222015021138,9710482412535200761,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:4456
- - C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
    "C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe" lsp
    3⤵
    - Executes dropped EXE
    PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9290f31943fea28c016e6ceaec332806f773a65990bba3d3ea4bd73961aad160
MD5 80a4128b7a2e569f38a74361ff44b2b1
SHA1 f070e5ca906b7a803e400cd6323666ff3f2d7695
SHA512 31f6f15bdd9ed0209aa73a9d7d612c5bcc86e5876cbd0d9d963a4d20eaf191b09425270cc4d6c0adb4e6b48940b5df5c5f20faa1bd2084b6755ca13ddd79e156
TLSH
T11DD02265BA379AEAF2B8243F28A2E507134CDAB257032223E3448C0C8CBB64748C08C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cb8bf239f61b6049ad57030f971b893e704f03b468284ac36da9c4d4b4b22eb
MD5 f18c2bebbfdca75040f08b9845c0c540
SHA1 93498851fc161c75068534ecf5059b14381d401c
SHA512 96327577ba0545bcb315be08336716f2016795962dc1b86b0a63157bf8cac5baa10712706ec5ea1d9ca3753e3e4db6e16f32ff9017fead09340cfa9d6a78c796
TLSH
T114D022ADB22289DAE3D4683F284BF60F274DDDB0A6922672D3854C484EA7A0684C44C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11f8f5509e0ea5de91167e8c2771f316388e5d28710186a6b992a413e6ad52ea
MD5 dc6e4547d38feeb78ed2ca0274a7f56b
SHA1 abaf0aeeca64fdf09056e35526a2d1af88591b16
SHA512 100833f7ba93813f0b6e9b4e1d13d25b7a55bf8d4a1d658c2bb9235a14b750e78a2a833fe002e89f85cc693ba3302b132c15dcc9347fef0a83964e0acfa7a3a2
TLSH
T1FED022ADB62289DAE3D4683F2C5AF60F374DDDF4A6922672D3894C484EA7A0684C44C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 74KB
SHA256 bb65bb513f49892b84a6418fa4581bf8b47fa1d15fe664b48f3be0c710184a3c
MD5 518982390323598a485612d27ea8d995
SHA1 e8e8427e445c799140e2d48937fbebf1f27d9ed4
SHA512 d5ab7091880932bf30603024e137a3350222de421374c62be9589c0cde66959ef88c5c1a5dd4d50d7404699fe12f5094e202d78d465cefcfa178284e0f11e2d8
SSDEEP 768:Jx8l6EjlmewjxryqLF76grMmZYyYQzcwnhuIspyMowWH:Pi3BmeOXkgWCGQoWH
TLSH
T1B2731E136C15851CCFED8EB588D5FAB4295CF21923D40F9512B3CF661E923A7E32B0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0688f7a0fc4df5a5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0688f7a0fc4df5a5_0
Size 322B
SHA256 adddf18de6631ad76e6e27c76fe9c1178f8cd3d1f90a20eb4e5202ac7073e96f
MD5 0b9d8a86bbdd036fd753924941dacb3e
SHA1 cb5039418374e7efaf0049e3ebf143d7ec452e62
SHA512 c75d7b77cd452d3821d5d12990c5bcfbef8ccff4bf172c662ba5670ec387900270c151519175f7783fd51037f1f36050867d87d24a2e67d05feb2ffd1a7e1d02
TLSH
T1BDE0728B8015E428E3204DF083B8A0A7A007804609AC59898028C0E7AB1C49ABE85A42
MD5 SHA1 SHA512 TLSH

Submit Download

0aead90b1bdfe8b6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0aead90b1bdfe8b6_0
Size 3KB
SHA256 7320a6a3ea04a9949145ee78651f62dc22088799dfed34b158cc9606c7801033
MD5 f29be7d75bf4aed3ca21d0d07c6adb90
SHA1 22e8325f931ec8b9ee664bf68bfe8faa3bfdeba9
SHA512 c37ea98d4b9fde7134c35ff646f94d5d4841b79783c3c024a7729d373083d73271176640f67d9691393db773c58385851d170e02034d707c846be7938d9d25aa
TLSH
T1BA7195EAA354D71DCB3253F912D28626A336800A6FD3871360D1EB763D842F7689DD4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7ce630a612fb3e76e931142e6554688daf818c4fda153c42925be08463f29178
MD5 90909d7a8d7f31f1578b5dd32f8203d6
SHA1 7d1550895b82274e59104f96143cf84f5bcbf5c5
SHA512 d94fed9c84880a3e56978e1a184c7096b8003329990ff983f1df0686808bdc5e2746a35cd1d84bf636a066af46af53adc24121be6aea882392b091a4b51b010b
SSDEEP 48:rlguuwcSlCFjjjr/LXviL274t7fL33E7W28ys4jpjbv4T2ZfjEs4YTgst+ldz92j:rDXe/Ll4s3OQZ70xei/fpr4O4nxP
TLSH
T112A14D7D45965CE8FB5903394CF20A55347189D4F813EEFA2740DC36A92BF81B648CB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 69303803ae9640c7791691363edcfbbf99c6416a8cfd4507993ad83fc112f499
MD5 b33c09ef9ffabd50fd7bb5aa058f9273
SHA1 108b902340c39ef2c1162089322fe90f4d0c4093
SHA512 89e8e0144578c4382f9b6bb8869acb1113325a2cdac70cdf50c0bd6b8bf479e45f4d2e914b34029205c81e82b06808d3f9f7fdc7c7a3e04ebc7d506100b415be
SSDEEP 48:Kb496YXuI47ANhnwdiPQW5ExpvfxyhZCZ4N504Hq/mHBXqMLlYsKiw+KuXda6GCN:rn7apb4Q4XlLwR+snC+KAzxnjiieLio
TLSH
T14FB1607D05A55CD9FB5903398CF2069135B189D4F813EEFA2740DC37AA2BF81B648D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c2d6787d5c69ef1346fdf6d257905256decf1a9a5076509930ded9f299ee4839
MD5 c2426273c96f99a00fe71c0e53ad4974
SHA1 d14e93010d75d449a073f6e7756767d0d3701fd0
SHA512 868057d580727d0159c6d846dc9405f95eb78c2159b1a1a31c98525d57746b4b93fb624c4ac45fe50bec657228f7e4c7511decc5a8ed263aadb48cb2b81cc960
SSDEEP 3:MsEllllkEthXllkl2zEklp:/M/xT02znp
TLSH
T17A44040C7FC00415C5401035D551C3D003F0D41405115F53355305135DC7D410C40100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 023cf5321495eee7a183864df3d54c3d9016710ef235c11cec1173c5cbdb3da9
MD5 dfbe2d8456268eabef7a11aaf22ccf02
SHA1 2b6fed2ca3d91e74976da73db6b365bbfadf2133
SHA512 844cd118955e98af6dcea98a87a0457b0ec871c5fed1befaca03d7002cd23ecedd5ddf47caf5a10f6686de445d924ddc09e00fb9d0b227a77e7124fa71dda11a
SSDEEP 48:IzBmw6QU1Pzi/JsZ2hcvPDj4L0j5+AVcIWwh68j8gPiPm99fSsgf1hKmC7NMxkxH:UBCxIYj5+CjWWNIifDuixiSH
TLSH
T1F6B2095F9E38B813DB610DBA331E053ACE3BC1685FD69CD5382880718DB9A62B4745DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 224e73e4eda93efcad9f9342f80beb6739af2c26f8aec7ac3f28d9fa616202a5
MD5 f22e7fcb16356bbb3e1d97cdf9b9dd56
SHA1 21ead4fa187cba14fdff18332cf051c7de39c5d5
SHA512 354e53db56f5e29313c859883d2999c65c6ba3204d9c1cb455aca4a96ce8e1881432c49c7b0dbf1e7ef6f8432c97006de913c33155269eed50a632cf1602558e
SSDEEP 96:n3WEuhYIU+bGz83uy3+u4tgp4DLjGQLBze9z3frdAjBHMsDEuspU0wbtqrOQpPff:n35f+G83uy3Ct7XBBKbmH7DXspU3it
TLSH
T13C14415F1F353311CDBC817669E744E35D6EF03F8B5266CA686104A0CEE3A52B02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 14KB
SHA256 208e8b1c8d6667604d78909e6568785d260ba5f74b6e709ea65a9875347d07f5
MD5 17abeae7ff45f79a6e721b99a2d4b8c5
SHA1 fb1d6f1e354c390877f4486a8501a5248b512d6c
SHA512 29c21a706ca40340f08d41b3fa4c0d277ae840c901abaa469f60d8e4f44b27f5e3a219028e8b9438afca133a4523b9ada70cb87b5e36ed360fb644cd4f5af51f
SSDEEP 96:BYF9lbTK8NilrKRYiZiKXzi3XhHlIcociiv5k77K6mi940ek9b3sSEY0Bi9GMihO:4uuoERZ7D5G1zP3BjpI
TLSH
T16D62EA0668CA7CFEEE4B12E2D822BED5356D293B9848C2F0D1E83DDC13B5A57540658F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 6a67b3589d013623cf4d0bc232b17994dc603cab9eed11df174cc445ad869d7f
MD5 43920b535d8780d57b1198c6ae795fbe
SHA1 3854ae74ebcf56894348983f50df60effeea6cc5
SHA512 8115ccc06965463422a995ea9f845e73ea2d5d4e2a7890fef0c172e082d01da8235decdae962d02361e5035718f8ac55e96ef74a6d84b5b8441909e855db55cc
TLSH
T1C2E0D8F85DCDC11A9594348B432C7708D3F03517F7886F415B04D880F601114F2C5AC1
MD5 SHA1 SHA512 TLSH

Submit Download

54771622-aca7-447b-809e-0ffb4d667dc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\54771622-aca7-447b-809e-0ffb4d667dc3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 3e7a2f136756b4fbd74c04a87b397ed8165c5c55518df2f945b600bec0f6ffbb
MD5 e85abff38d864160f39b731b5db533f0
SHA1 f81edf3b733f4d38a57d45e2481ca181d41d651e
SHA512 192adb830b33b179ab75691d2be886ce7a4d26704eb76f476664b4fbe6a157332a9f0416d52a062ce82d879fcd7e2d343ba4e749ce76e2138ded318e9aeefbfc
SSDEEP 384:D+csswjyMwErquX+0eF1rwspq0FBHpJrilhizeFXes0HoJF5JsiFrb3LWxWpWIkY:6FZ+5mZuPFzsKFpROUQXcor5eASM02w2
TLSH
T1BB42ADB7C2E8896E996125F467246D2BCF1E1C1943183D26CDE8DF4FA3E1472E30255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 0f63bde51f8cb78532ca75e3b202267ae7214b5564bae2326e48a295c4aca386
MD5 0439285295eee746377f11d867c5d1d3
SHA1 f4692432afec9bdf9a720a7a337d16d9640b62c6
SHA512 b9dea1b79237a8ad6bd61703ef88fe785d447bda3a9ac2cd5596755a6515595be4ce2ae2f8695e9400a1eb199fa22ae28a6bcaf78f62ccb44b3402cb5351f525
TLSH
T11031AE978ABEE4A36028887F1ED97C0A657AB839118150F4EA76C13CB0C44F75E2643B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5cdb9cd0fb2c0749a6fdb654fef655fdbf95e7cde862742193759fa3cc809894
MD5 02e8036ce96b3c4fd1d06dbd58140064
SHA1 820d5ebcb59161118fdbf3c98168582a58fc40c0
SHA512 dabb1d5b68f97f1889eac35ac2e9c189dd3a934d0fcbf8a839f30770bc263952a5e3ac07ebefe3f8d0058a204bb56fce7535351905268952ff417c11f3e54099
SSDEEP 192:sxZpkR8yM/jK1Ml8Mkb/fLseZYhAIdpMPHW6+WNriJ/rITqHg0NgIXIy4tgmA+t3:sxZSqMb/fLseZGBeHb0/rYGG0Lqcc
TLSH
T17B62B763BA3459778CDAD25AF555BB27D2F9046292901E85AEFCCB2C04D7AEC2102C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a9ab5c534321255cc9a103d2a4201b2f5bc96f42c7ca0ea333c2234b481da201
MD5 7e64d4450afb18b262a614198491c740
SHA1 8ab44748ee75af18f8df48b7c6263a7bc820b7d2
SHA512 1a4abff4f822389aeafb9e8b327ccddab5810882574642d8efe88cd7597372416bc6ae20bf5a4550a0ed2ea9ceb2eef753636ee1564a4ece67d7d2b0e5f2e256
SSDEEP 384:sxZSCFb/fLs6oWvDtGLeHb2D4ZroGG0BdqUS:sqEb/f/oYDtGiHb20cGfqb
TLSH
T18D72C763B53459778CDAD26AF555BB27D3F9046296901E849EFCCB2C04E7AEC2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 339be85ecebc52b67918366d515c12bf56a4575096c926f46a061e63988904cd
MD5 65b646bee89158a29773dc39f5657731
SHA1 27f863dbf78e4358e02af147389589ff669465c8
SHA512 6a16c464ad46d1b5a20da9cabaa9f3b51df03361f5e36d8d69482dd2401277019649ef52fd78c5bc614ea6c81473262c2d62b1176b3360f5e28bc07b051bcb4e
SSDEEP 384:sxZSr3b/fLsgtWvdOG0PBHbWQyB4ZroGG02qbS:sqDb/f3YdOGCHbWQ/cGWqW
TLSH
T14082C763A5344D778DDBD26AF555BB27C3F9046296905E819EFC8B2C04E7EEC2202C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4645e31d079a5dc885cecd59cfcd8ac142f56c9505bb73f2bef6bc1baac618ba
MD5 22d4ecef68c66d3b33d9c31593e0a75b
SHA1 1a9a1a5c8c79a219b75d5270421c7554737dd971
SHA512 6e27d89e63715513627a402dc1f24dce167fa4d3d0bf51901bc787505bff7feda7694917b794349cdd464d11da90e4cfb1004904b5f79e702448e4c04d18aeae
SSDEEP 192:sxZpkR8yM/jK1Ml8M9b/fLsSZYhAIdpMPHW6+WNr75XrIDthqHg0NgIXIy4tgmAV:sxZSC1b/fLsSZGBeHb5XroGG02qcG
TLSH
T1B262C863B63459778CDAD25AF555BB27C2F9046292941E85AEFCCB2C04E7EEC2102C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c374022ebafed572b390874c10a6638feda1bb29509c87eaabc4320b908be5ed
MD5 0ee7176dce8ad8443c871cc6e85c3182
SHA1 e1c0597d1e87ade4cda1411a48592ec539973b66
SHA512 0d661d5fe9131051fc1ccd5eff271d16de98e26d1a5be3399476b3ed93574f34d2dcd576359af81ea5c66ab78214dc3dc6598b9a3d9dc99e2dade13f414f0b70
SSDEEP 768:sV8bqLb7pLuLXa+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVCKUCZLlRTKVVMe:sV8bqLtEXa+WvSC36u1jazXCZLbWVd1
TLSH
T16AF2FB3B2C0CCB7E4F804E9CED2AAF9A6DE8018B5698C95447FA854C03C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 bb14e42e8d08f038d1330a04080cab5de113a70249f42bd59b486c37ccb91720
MD5 1c416c5534c6e9af68c3e07d41ff54f9
SHA1 13958775d80a83be8383c9617a2601aae02dc2da
SHA512 3db316401f1e1c000f84bfa0c36d79e9ca7aa19c4ed2a7e82c2885cf8bd1649c176dcdcbae2fbfa962044c9acb499c73362c483e48b0875f9e62320fed754882
SSDEEP 768:shCbqLb7pLuLXc+WvSCb68F1+UoAYDCx9Tuqh0VfUC9xbog/OVCKUIZLlRTKRVMM:shCbqLtEXc+WvSCb6u1jazXIZLbWRddr
TLSH
T19CF20B3B2C0CCB7E4F804E9DDD2AAF9B2DE8028B5698C99447F9844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 50369381938e26c71003140f6f46cbb4c3ad6075c21db4cd4b6045f45da6bb09
MD5 1106b569b3d73779e986e563f55d394d
SHA1 2d6d90312539fbcaae98a35941dc3c11e5d2eecf
SHA512 95d1f80f7f61d246fa1e1ed4aa8d2a672b08a03a6099606de215d02ef62a9a4ef2885d8245e72b4d22b2cea47ee538ec38f0212451bfa930909e29e0d67ed0a2
TLSH
T1FCD097AFA0B11090C6FA4AD14A3210AD03142C881885D08DE022081844A1B03C202FE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 d643ed4c45657a38095636d192c8cee2531e90ccb2cff4ff2590f0ce30d3d3c2
MD5 d3f672fc6c5b85766c7d0c3774dd6883
SHA1 94cb1c8bae57b20ac6f665ca4d48dd27d808e70b
SHA512 399790d70b182109b32803b5f035007e33a3762beadbe5ed47cb2703d0346c65db2099c6f67e8ba2a40430dcc39dac49f6c42b9bbaa128cbab22a72d95a1c22e
TLSH
T17CD0A7AFE4B21491D77A0AD69A3215ED43642C881885D48DE423391C54B5B43D215FF7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59ce52.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59ce52.TMP
Size 138B
SHA256 04b32c97aba6dc7b57b367448c02546e51b5edcb1e293517de777a6ba117bf24
MD5 d1b4cf62890ec98dbe47beb0d623bd47
SHA1 649b944e390be264317bd49731ab8ac0a9544ef7
SHA512 fc3bef7f7d8271bf228afb1fd0295b69640c4c750b153da17abb6625011f242540cd27f72ad822f6c3e68ad8d4f79ca139c9607610ad5d544ac9354e1a390ea4
TLSH
T158C02BDBE0901041CF3106C0833265DC43082CCC4CC2C44EE03338142070F23A201FE1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 1KB
SHA256 00e4e0fc1ba83fcabc23148a47b1552cc7ac6088dd3d04d8637abe84a1e9cdb2
MD5 92d0dcb8de80f47afbadcc9976771fe9
SHA1 92d601ab75e90d79841956047c4ca51cea17b892
SHA512 1727caacf513175ce08c266c288157c2231ebbc7fb6c1a258d9bc354d9aadea8a0459762b0cb7f96707b239276af671ee2a55d284cc3c3b92f495b015472c66d
TLSH
T1DB1178BFA7051210E67100F3B8D932686793C08CCBECF6CB927AA014D6B252D31457C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 f1ac565a76dd5953b8443ebc6a0edd22b193a69ea7de5b98607d0c5e5f8b6e2a
MD5 6469851e04b5155a82f249a2c3e6ac95
SHA1 9328cc3a6e54ff44e50b011e6d8baf3046656301
SHA512 1e055ddd4ea9943c1476fdb8384e6b20b3891f7869b4d10d674d15540b0712bced2286b1d58a05706e8cc0da32c73dd7098798467fcbd8ea9c5a1deea4f23550
TLSH
T1E1E04F7C16C9C57A61673683026C9308D3E4B527F7C8BD062F85DD806642A85F196781
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d04d641e83b68957b8ec7a238d35507a09c83b55158f3286063037956c35bee5
MD5 6be664240c1f1727d9358105a9c64374
SHA1 551799ae5aff51c90396b545df19ea41667a7c0d
SHA512 e3d5f21e2fc3d7cd3b26d25f8b0f8ce8143d85ca0cf002fa5eb555322f92a8a24e5aca2d8920a72a7cd746c5263bde776da9b33a6bf7a63fd1842a72bc7e80f7
TLSH
T16AA00218CA4BB021C4041770264525957751DD53060D226165B2D598DCB2784A1D7115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5919c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5919c8.TMP
Size 48B
SHA256 40abba70e29423cb632be26641a441178f5dd07dcfba7f24fb18b12e8e393093
MD5 632f468c50fea6880c0f6ade3c76d5ad
SHA1 525adc305479de840d54100a0533e92a1b08abb2
SHA512 ddc6e79e929b84d3ff7b6803f701dbc7fe67c4938ccfa0dc6ab97381d31118b69a806454dee15751da04204c90052b2fea25c59ce7bba365304bc868e716d90c
MD5 SHA1 SHA512

Submit Download

Tabs_13424193466956214

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13424193466956214
Size 39KB
SHA256 a941ff9a802c36245f81b9864126b157213721c6fa14c7e0f0853679d8ff0829
MD5 138168c9db405acff81f428ea349b4e5
SHA1 f2362a2c7248dfc984958bfbd2f9e5c48e84c811
SHA512 70081c617ae940c631048a0e4fc9ba91b9f5a5a49734a4c917c38b1dc97e2911a14c375a37fd1853ad1dae171c796611afe13d854db634dcda15f434cf95cd69
SSDEEP 384:dxZM17zKvMjoRVvMjoRlztOFMjojiM3mjolZLNGYMjocT1YMjocLN:dwmWmRFor3mgL8PVPR
TLSH
T141037A2D2AE5133EF3F2C9B4C7D4A66FA422F463B5065F5C48D147464A13A02B9A3F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 84ba5e679ef95c538d90875b09528030d12bf7c7348cc82bf0943e56df3f35fa
MD5 6fb08650673eb046852eaa7e3d51110a
SHA1 0245bb86fa0a3b2b700ff4b4826d1d78de3fc749
SHA512 c68a1d4aa701fd3dcd98b282ff6518015ada8061e2e0f029c0faba61ba490b46bcb340f86bb47683b282b357d40f4a0b6db8784a31951cdbc9c2100b04d8fe6e
TLSH
T11BB01248BF04B11BE0940B73069C4B94E310F10120010D138A04CF220CACAE47E82CD1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 84397b159d5f91355d91b22e113981dc4e2ab009a614454c083d74f852cf2123
MD5 a3d1cc989e86545facd233c9995cf46d
SHA1 0130a5e1738393be1fc26e07f082b8e66f8703d5
SHA512 d995c409f7474ca1f3223f0a7bc5e038dcd79971a58f6ed0768250357bf913b2c27b7005ed20acd0cfbda1ea942940b3b84dcd3e8965501a2ba05022dac41b7d
TLSH
T1D6E04F7C26C9C22B629735DB437CF308C2F2B516E7C86D162B08D980B706684F297A81
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 c955ffea889354ebaa2a472a7bb861dd94af5b36b2dc977a68b1d428be94467b
MD5 cbad6ed19a53967e27a3beb6e4fac37d
SHA1 a8f8d6d52cbaca1aec7cd2df950131715fd9013c
SHA512 23cde9f475a62698f010330f242695b52dc26790fce7899a46c6e61ab11adaaedf66a72b0c4f3547c02381d3f4eeb6307ba92bad1abdfec37df87bbca8685e08
TLSH
T172E0867C56C9C23A506475C3437CA70DC7F0BA26A7C8BE475708C481B601A85F2EAD80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dcad90da2fb12fd210580581e757b53ab3643e28c5fa48595f1a4ef986b62557
MD5 6382381fadadbf40f4f74f84b3d8c88b
SHA1 989d2d9148859d52c2e526ac7bf8bee5945f3ba3
SHA512 466314862372463f74e838873763b1934ac800fa3596a285db3498eff136766ebaa6a04cba7f63d304c43494beedf8dfbfba12bb75fd9d1ce93859e78b4e8b4d
SSDEEP 48:K4aIfK3qAry1/IxKkY87yB4InK52ELzMPT5xB:K4aUK3qGm/KKkYii4QK52z
TLSH
T14091186B32B7024128BD391DA2D996779E4531633428A46F7BF860F15F6AE212CFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc9ffaa3-fc1d-4407-ab29-0373d7426269.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc9ffaa3-fc1d-4407-ab29-0373d7426269.tmp
Size 414B
SHA256 341abd50333d1c68104ea7057e3bf616c8a87f561f54040d2c515a69ff99c1c2
MD5 06ab1e773a879f1a4b0f335d7bd25eda
SHA1 291c44bc41fcb88776b8b97d0c0449c597fbf8ec
SHA512 1670be324fde16de33a06e1854ac1378ddb5f46a15666c8864a31fbca54a9ba995e4bface69a198bf8aaf3e9e11557ddd2d9b6639d06f6cd15b8c4d451b9ae4f
TLSH
T170E02BA9C8119C270AFD0B596055038BF794235B2B80594BBF3C831CCFF463A458A81C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 136KB
SHA256 bdd1eb1216cf5ff4197506b0fe70f253632615e3c953c7c8baa8f85f1736890d
MD5 321cd00eba773456611b6114baad7dc7
SHA1 e99c30df8075d2118b14172187fba3c0151cf855
SHA512 19c4f3e29855f2c2a0d35d50ffd779244d7cf0bf41e3cb880f7ad98376f96ec86a089dd600eb8c7ae0edaec7c54a998aaacdccf68d26e32e4d56daeb84d4c045
SSDEEP 768:qbzsjVdoG702ZKqV4IRxsTMySFoYCLQSyaCSCWsV0hV4o3d33uPo1UDmuTMZZy/J:qeryP6u3/dDbQgoS7x1K51Uwx
TLSH
T16BD3B7FB7F1A7066C9E991F4E04AEE04643781E2829CF4DA953C4493F33B9097AB5781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9360c369ff45d054bd1eabd9d0ad5c9e7b96f02b1a965189625b84a949236e32
MD5 d366c5e7a28d93b3f522b0c596346db6
SHA1 2c1944ccb3bcadffe203023e696cc0a78f1952c3
SHA512 79d1331f1e2d4b529a42a4a02ae52f2528bf020116133ae82feefd9f7d71774ab821c6610699f599484d6553db61db9a54e07c77e93284041d10b772c7414be7
SSDEEP 192:uuoLsN0UfQ6ifbiL4QmiU1/7G4Ea+jeOmEtmy8EamB/sU8:nusN0Uf//8JJEa+qOfZDyU8
TLSH
T1B8322B31693C5CB75EF29A95F54B3B139FE8106B95852E94EADD4F1C00C769C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 69f3f6ae534b009673364ccbf92c644664420e4b3239f753c9e85325353ab595
MD5 13bb70863a70505a64f14bd5df9cb828
SHA1 23207c7ab497b337d657607523bd6ce1d105af96
SHA512 3fbeacc545381ea68c726f258dfd8ced4270b0ad923fc0d461c28f5de7e6bc43ae14c44436e03a6827a41c6cf879718ba2f2a7c986bf2984f8ca6209227ee4ff
SSDEEP 384:njtNnNnb9Q3sNSUA//aaS2Ea+qOfZfmtASMNi/Kcx3XDqfNcvF1/7Iziq:jjZb+3CE/SlafORf5St/Kcx3TiOq
TLSH
T18EC26B71A4685CE708D1E5C8A646F6133EB8427BC5882E9CE6FD7B3E30DF4B85306865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a203b6395ea03b0dde5e6928cf91a05fd93a013680aca8d564da68e788db9fc5
MD5 c5c148bb5808748d31ccc6239270d6b5
SHA1 53a8eb1743901bf68a3b922485bdbd8f159b9d5b
SHA512 c3c441f393aa43a556c7cf5a7a692250c311e470e9f91da0959195a72b884aebcebfb5f803a0303f5a2a6087ae997919c7562bdd4da59ab2965fd8edfa1fb042
SSDEEP 384:nAtNnNnb9+sN0UUA//8TS2Ea+qOfZDyXDqfNcpO:AjZbETEgSlafORDyTikO
TLSH
T16D927C3129381DA75EE2AE94F54B3B176FB8519F85842ED4EEDE5F1D00C768C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 444ce479c6324360f8fdd41f01102b0afdaa14b9d77b173b058476d77b3b8f22
MD5 4f0f02dc9206440cb6239f559c3ae599
SHA1 7a6794ded937eb14a9a55a65c87b545644efa802
SHA512 2097982023930bbe055e828f94fa70f1380c7cf6459cd9812ee352a8ce9ea38ac75d7cefb40b68d259905134b889801da8984911187418229fe75be5d6e9dc62
SSDEEP 384:nAtNnNnb9+sNiUUA//8vS2Ea+qOfZDnUvoA4BCYEsLOKsJwHDyXDqfNcpO:AjZbEhEeSlafORD2/4jKKsJIeTikO
TLSH
T1EEC25B7198694DE708E1E5C4E546E6172EB8417BC8882E4CE6FDBB3A30DF5BC2316416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 255a0322c33050ee6a3bdf2509ed46d665ad9333add90685585087ba43b32e8e
MD5 03b6992276012a7aaa776793f954ebf6
SHA1 a6c9c57a2d0c61a17df5a8f9c315f7880138001f
SHA512 c163ee9e9e3568447bd0a9625c685172ced998945454fc8cbb84641e5948beb61c8ac567bf38627f4c03bb2a5781d19bfa22c083c0d7b4539abca4b50b26c52a
SSDEEP 192:vONG6DbQQmiUyKXrBa+jeOmEtmy89NzB/sU6:vONG64trBa+qOfZiyU6
TLSH
T1ED12E935793C5CA75EE29E95F4873B279FD4116BD9862B94E9D81F1C00C7A8C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0d83019e9372dee86021dfe596d4a261c4c860937443ccd2f79606a4786c03e3
MD5 b5d8324ca0eb9164acd1fb755887b5df
SHA1 77dbb6c7342f586998eeaa6ee0d9fc8f532584b6
SHA512 05c5640abdbf532840cd5fd28ab910bf6221985d24d23ee3afba2d884c35d7f2c850e7cd5dc208d95145865955cf680e5e5cf0ea5b67ffa9b49b0c195647b19f
SSDEEP 384:nAtNnNnb9+sNiUUA//82S2Ea+qOfZDnUvoA4BCYEsLOKsJwHDyXDqfNcpO:AjZbEhEvSlafORD2/4jKKsJIeTikO
TLSH
T1BEC25B7198694DE708E1E5C4E546F6172EB8017BC8882E4CE6FDBB3A30DF5BC2316416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 08692f37575906b4cb11c29164bd19debdca3ff45c243e8746c75145b3da9047
MD5 635dba8d04e80216de08b8246cbf8dd1
SHA1 aa2d825b5f2741429a0d3c39de034f869daa7fa4
SHA512 742049918516813dd79c13c3bb8e9739ca621e8227fd757b5c2b40c05db40b4bb3c627c6eb2b0112187e034d503d0a683d251ac6b030feb347258b262504c5ee
SSDEEP 192:vONI6Db6QmiUyvXHBa+jeOmEtm8RgXDU6:vONI6u6HBa+qOfWzU6
TLSH
T1A202F93569786CBB9EE2AE89F48B37275FD4207BD9562F84DAD81F1C00D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 c7db955b819b983a64f0025b81549ce9456573a5f07ac4a953546b7b786b9978
MD5 8e9eecf422304626bc4901fc0229376d
SHA1 50627ab35b3c491128c6286d1efa8e4148729f42
SHA512 140fccd7e91a0d579408bed2c4391886a2329ea0ec6e0a270382b2181312ff5391926a464bd21875ea909f050eb9dbb6d12b934d38b02c3cbfeb386fceb96465
SSDEEP 3:MsEllllkEthXllkl2zEkl7:/M/xT02zn
TLSH
T1F944040C7FC00457C7401031C451C3504370D41007115F43355104135DC75410DC0100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

30a5827f-0d24-44d2-934a-285835b07f66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\30a5827f-0d24-44d2-934a-285835b07f66.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b1adf565405fd02d23b8fa0d568d6b13f249383568d3bfa1012754799b36677a
MD5 43ced968093200314f5cb9dec3b51ba3
SHA1 2464d06c38ebef79c8cda774d2189afbd9b30971
SHA512 3365c6071723993dae4c2d5d5615d40e40d630ce0ee64b36297dc6117fc62da8e0043835d246591c518a37678ea40e6dbde04e7dd5c7954abcd69328ac5a6dc6
TLSH
T10A41065CA6FA1148B3BBAF569BF6646E487B79772E07D49E10110D4F4A63A00CC61733
MD5 SHA1 SHA512 TLSH

Submit Download

6904a6bb-15ab-41e4-8dec-d15b20def9fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\6904a6bb-15ab-41e4-8dec-d15b20def9fe.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c334dcd9-28f4-4db4-aa16-29021e7dd169.tmp

Path C:\Users\Admin\AppData\Local\Temp\c334dcd9-28f4-4db4-aa16-29021e7dd169.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2340_1681299426\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1e427ac-426d-418c-b16f-30278fa12d66.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2340_1681299426\e1e427ac-426d-418c-b16f-30278fa12d66.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 12b5b94682c3ce72bba68f78a6cbe47fe527367813ab76f04830768b042a5371
MD5 2f6da7547158c6f200cb6304b9eea06c
SHA1 c2862bb0cd7aaefa6da5016f08d490b0c381bd9c
SHA512 374b2b0f66b399322799b7379ec08aa82900f7b09c223445d9f6ee18f24514c10c615006ff6240ba551ca43ea28b59d05c865dea65768e51f0810438f0d5ab8b
TLSH
T151D0121732410278C83024330442E5490540C72F424940006828855E2F640B50D43881
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 1KB
SHA256 73ca75a06dedea5003d052c45086631b71a03377813db0f3776552509f14500f
MD5 0ef19854812c10508cb3733d59db37f6
SHA1 9bd25a6fe6e36d2d6cb2458ef0d739a5b3a79753
SHA512 0d9800838e5ad38042a801ba594f715683e3a8e8522f629e19c38ea8c1b4d2c1479eb4a297257043ef9cd5e0e7da21f9d56c4f4c408452dbedca97fa5107e718
TLSH
T1173162B3E8D41F3709D196C3F2867F572E2411AE92948F4463DD4B1E02E79CC5226C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 2KB
SHA256 7e2c7589b540722762c446188a0c76b950911a5dad76767c597cb653083eda59
MD5 e700a631d3826355243ac6afd1e1f16b
SHA1 e98ea2cf49b9c5f6a07cf2c42d2d8a6d3cf0105c
SHA512 ef3fc825b86f1d471a39fec91f6e5f28245de291f8ead3d11a44b399f17cc765f7a220337a4316a61cef659255b2e3d3830ae932d17268203087dc842ce9d4c3
TLSH
T106519673AC445F374AE28AC5B9493F136E3911AEA6952F50AADD0B1D01DB99C2302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 3KB
SHA256 d3a69c8bc3990b2c6bd16fcfd1d5871faf3eace1a49b116b18019f2d372cf08d
MD5 3a6ca4e8748013e6d2b0b23ac62ab548
SHA1 e7c6bdc00ee66d4ebc8d68df86a819f89739cbf0
SHA512 85f5b9b1e460d17fdfd462fedb367f3fb0ea9afb60c4e11fb112d2ea795e5e442224853d3858c28ed2ad8d105919b7a2c11f45c4593096e76b0c148b6a1442c4
TLSH
T1F571A673A9A49A374EE29981F8893B077A69116BE5D43F94DAEC0F1D01D76D81302C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 16KB
SHA256 950b5f98c49f4fd4b553f013d0d918125198a1e686a524000b0ec679c6e7fa1a
MD5 bb1c0cb6f23e43ea84c0d917b816b27c
SHA1 39707c714b10fd561c3e9b922a2b7fcf3525bb94
SHA512 c4e718650d13c99bff20cac20153a2e0e75ed7a6572d2565683cc7b5dd60a6050851c9f8d5e9355dd4197681911a1602f69e8aee1fb5a5526ef93ac831b1ee1f
SSDEEP 384:zCsr8vAVy7dG5UI6limIfB8SNbU5cCWETg:Br84y74GVnGlETg
TLSH
T15472AE31A6345F3B4CD1DD42FC092A167D7882DEC5C91FA8DAE81B19439BAD50342D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59ce33.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State~RFe59ce33.TMP
Size 1KB
SHA256 572f3f49fe296d26ed2c8a9700ddfcc14c3bd27c26a8f6c5a69b0801633d997d
MD5 695e36ee90ff06b6a750dd8b9bee46f3
SHA1 dfabf1727b5d86733a0baad663d052b901bfb1fa
SHA512 f4b1974999151af20f864c9c1eb20323247892a4ae5df7f6b2dea73daf0cfb927587000742fc489f891daa7d83c9af6b88ef1d772847b92715fdefbbeba71e5c
TLSH
T1452112B3D4982F3759D549C7F1467B4B2D2412AE52948F04A3DD471A02E79DC5326C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Ronix-Installer.exe

Path C:\Users\Admin\Downloads\Ronix-Installer.exe
Size 5.4MB
SHA256 e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634
MD5 00e7c93d610841d179eb75683b05f1f7
SHA1 fa51d17b3e8edc2315341f46c72201fa3506b564
SHA512 639892febf0c3a56020f063410dc63bd8ed72528b0796f489aed01fa068f30213d34a42dfad6b683f60a26c80a2ffc05e61c9e50c3a239d953d6ddb1cf3cfcb3
SSDEEP 98304:juRO1zNIfko55jRMmro9B+iHR9lRu1Ux6ONgwKo/lgAVbNbEYL9kA:juW5MjJw+ix9378OaFogA19Jz
TLSH
T1B346336E42C63D91F2918BBA6D7519898C12EE375F46C43EE61F06A6081C35ECF3768C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix.exe

Path C:\Users\Admin\Downloads\Ronix.exe
Size 15.5MB
SHA256 d2e1afef6561c5806b1d6438a886df3102449a8708cd2f7ea9a8ec27a9065385
MD5 b1cf36c7076e3bb998b309a125fae177
SHA1 c84dfc8557f7eac1a1a2d2e441cebd1fa4233cd1
SHA512 bd416af112268642f3ad9c87b85f202d182cc8203848d6d91f75edcf7492cad311d5bcb671e329eafe9b4089f624365ae7a09114b2440658a53376d20ab7b6be
SSDEEP 98304:nOsiN3uJmrP+tudDWREOgW+fiuWwEZAWTZ1rc/BEtzJyKzrn4U71HOCW17aW6YrP:OTuJm/DWRE+Jd1MKgU7sP1CCP
TLSH
T1F0F6F7247A5B996CD05BC474834B8A634A7530CB0B39B9BF448496382F6EBF46F3835D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2204-856-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-859-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-858-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-957-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-954-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-862-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-857-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-854-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-860-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/2204-861-0x00007FF753660000-0x00007FF7544D9000-memory.dmp

Download

memory/4148-1104-0x00007FFEB9A40000-0x00007FFEB9A41000-memory.dmp

Download

memory/4148-1105-0x00007FFEBA430000-0x00007FFEBA431000-memory.dmp

Download

memory/4456-1132-0x00007FFEB9F40000-0x00007FFEB9F41000-memory.dmp

Download

memory/4456-1530-0x0000021E7EA00000-0x0000021E7EB2A000-memory.dmp

Download

memory/5620-1517-0x0000013679800000-0x000001367992A000-memory.dmp

Download

memory/5620-1034-0x00007FFEB9F40000-0x00007FFEB9F41000-memory.dmp

Download