e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ronix-Installer.exe
Size 5.4MB
Sample260606-wt52ysbv5x
SHA256 e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634
MD5 00e7c93d610841d179eb75683b05f1f7
SHA1 fa51d17b3e8edc2315341f46c72201fa3506b564
SHA512 639892febf0c3a56020f063410dc63bd8ed72528b0796f489aed01fa068f30213d34a42dfad6b683f60a26c80a2ffc05e61c9e50c3a239d953d6ddb1cf3cfcb3
SSDEEP 98304:juRO1zNIfko55jRMmro9B+iHR9lRu1Ux6ONgwKo/lgAVbNbEYL9kA:juW5MjJw+ix9378OaFogA19Jz
TLSH
T1B346336E42C63D91F2918BBA6D7519898C12EE375F46C43EE61F06A6081C35ECF3768C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe

Executes dropped EXE 2 IoCs

pid	Process
5020	Ronix.exe
6956	lsp.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2076-0-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-1-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-2-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-3-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-4-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-5-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-6-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-8-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-7-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-10-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-61-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida
behavioral2/memory/2076-99-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
49	discord.com
1	raw.githubusercontent.com
2	raw.githubusercontent.com
22	discord.com
23	discord.com
26	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_28439547\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_907718340\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_557485342\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_907718340\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_1256269826\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-sk.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_557485342\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_1256269826\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_1648226460\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-sq.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_907718340\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_28439547\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-it.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4128	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252434599228406"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{1C180318-AE20-4E80-AC73-94519322116E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{CD48DDEB-54D5-4E15-9C08-1394B647F3C4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2076	Ronix-Installer.exe
2076	Ronix-Installer.exe
2076	Ronix-Installer.exe
2076	Ronix-Installer.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe
5020	Ronix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
2904	msedgewebview2.exe
4040	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
5020	Ronix.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1292	2076	Ronix-Installer.exe	86
PID 1292 wrote to memory of 4040	1292	cmd.exe	87
PID 4040 wrote to memory of 3164	4040	msedge.exe	88
PID 4040 wrote to memory of 688	4040	msedge.exe	90
PID 4040 wrote to memory of 4128	4040	msedge.exe	89
PID 4040 wrote to memory of 688	4040	msedge.exe	90
PID 4040 wrote to memory of 688	4040	msedge.exe	90
PID 4040 wrote to memory of 1800	4040	msedge.exe	91
PID 4040 wrote to memory of 1800	4040	msedge.exe	91
PID 4040 wrote to memory of 2388	4040	msedge.exe	93
PID 4040 wrote to memory of 2388	4040	msedge.exe	93
PID 4040 wrote to memory of 2388	4040	msedge.exe	93
PID 4040 wrote to memory of 4728	4040	msedge.exe	94
PID 4040 wrote to memory of 4728	4040	msedge.exe	94
PID 4040 wrote to memory of 4728	4040	msedge.exe	94
PID 4040 wrote to memory of 1388	4040	msedge.exe	95
PID 4040 wrote to memory of 2428	4040	msedge.exe	96
PID 4040 wrote to memory of 672	4040	msedge.exe	97
PID 4040 wrote to memory of 4580	4040	msedge.exe	98
PID 4040 wrote to memory of 1388	4040	msedge.exe	95
PID 4040 wrote to memory of 1388	4040	msedge.exe	95
PID 4040 wrote to memory of 2428	4040	msedge.exe	96
PID 4040 wrote to memory of 2428	4040	msedge.exe	96
PID 4040 wrote to memory of 672	4040	msedge.exe	97
PID 4040 wrote to memory of 672	4040	msedge.exe	97
PID 4040 wrote to memory of 4580	4040	msedge.exe	98
PID 4040 wrote to memory of 4580	4040	msedge.exe	98
PID 2076 wrote to memory of 5020	2076	Ronix-Installer.exe	100
PID 4040 wrote to memory of 5060	4040	msedge.exe	101
PID 4040 wrote to memory of 5060	4040	msedge.exe	101
PID 5020 wrote to memory of 2904	5020	Ronix.exe	102
PID 2904 wrote to memory of 1876	2904	msedgewebview2.exe	103
PID 4040 wrote to memory of 4960	4040	msedge.exe	105
PID 4040 wrote to memory of 4960	4040	msedge.exe	105
PID 4040 wrote to memory of 4440	4040	msedge.exe	106
PID 4040 wrote to memory of 4440	4040	msedge.exe	106
PID 4040 wrote to memory of 4440	4040	msedge.exe	106
PID 2904 wrote to memory of 1412	2904	msedgewebview2.exe	107
PID 2904 wrote to memory of 1412	2904	msedgewebview2.exe	107
PID 2904 wrote to memory of 1412	2904	msedgewebview2.exe	107
PID 2904 wrote to memory of 1060	2904	msedgewebview2.exe	108
PID 2904 wrote to memory of 1124	2904	msedgewebview2.exe	109
PID 2904 wrote to memory of 1124	2904	msedgewebview2.exe	109
PID 2904 wrote to memory of 5576	2904	msedgewebview2.exe	110
PID 2904 wrote to memory of 5576	2904	msedgewebview2.exe	110
PID 2904 wrote to memory of 5576	2904	msedgewebview2.exe	110
PID 4040 wrote to memory of 5640	4040	msedge.exe	111
PID 4040 wrote to memory of 5640	4040	msedge.exe	111
PID 4040 wrote to memory of 5672	4040	msedge.exe	112
PID 4040 wrote to memory of 5672	4040	msedge.exe	112
PID 4040 wrote to memory of 5660	4040	msedge.exe	113
PID 4040 wrote to memory of 5752	4040	msedge.exe	114
PID 4040 wrote to memory of 5752	4040	msedge.exe	114
PID 4040 wrote to memory of 6024	4040	msedge.exe	116
PID 4040 wrote to memory of 6240	4040	msedge.exe	117
PID 6240 wrote to memory of 6380	6240	msedge.exe	118
PID 5020 wrote to memory of 6956	5020	Ronix.exe	119
PID 4040 wrote to memory of 6508	4040	msedge.exe	121
PID 4040 wrote to memory of 6508	4040	msedge.exe	121
PID 4040 wrote to memory of 6572	4040	msedge.exe	122
PID 4040 wrote to memory of 6572	4040	msedge.exe	122
PID 4040 wrote to memory of 6848	4040	msedge.exe	123
PID 4040 wrote to memory of 6848	4040	msedge.exe	123
PID 4040 wrote to memory of 5624	4040	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start "" "https://discord.gg/ronixstudios"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ronixstudios
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffc2c6cc188,0x7ffc2c6cc194,0x7ffc2c6cc1a0
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,13737360939588680142,6892935970215821888,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10038252453869141731,3560598653421369877,262144 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,6767180533187409817,12479262573124745243,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,3817912555739572982,12725746026789313733,2097152 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,16515124450835408264,14238066913732850380,2097152 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,2186811742825046145,12380289904114415674,2097152 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,9577017192141466157,7714054319593714939,2097152 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,15388646689195364320,27847718194603362,2097152 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,12444673542697405162,17173215695700534298,2097152 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,4458664597160220632,2525802414316854724,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,1174196344400879015,14170790333513338221,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5632,i,16299699494986913211,7330708649885046834,2097152 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,13960983255763746415,7295384704898471111,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,9381192360980480170,3671925240180857864,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,2776901707915670641,853332572375719854,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      Modifies registry class
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5543161944842714250,2031498628471616151,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:12
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,9807667318113524197,12738782058920789086,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,9807667318113524197,12738782058920789086,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,9839473216202321201,7149197217175773713,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,11267880662214131166,8848503313445293042,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,10143121141280912269,15594708077925744479,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:14
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,11388227204530572630,11915777973917028545,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
      4⤵
      PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,12587922579339751097,14268503433988964680,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,17955655877819731565,1392496484351364091,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
      4⤵
      PID:784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,12087213855012270600,7679202248091130276,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,10469305835666460157,8214228268569513237,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,2879712908733797699,16936635171009222366,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16717264295460703326,1934021172893210600,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,16993630207794880619,16009154184748507024,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=888,i,1960004200616856930,996120600383239806,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,2394022330475471622,8639879953329956091,524288 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:14
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7488,i,15080555056721870477,15720358813817223561,262144 --field-trial-handle=2316,i,504885340204001073,17914300265434919123,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:10
      4⤵
      PID:6296
- C:\Users\Admin\AppData\Local\Temp\Ronix.exe
  "C:\Users\Admin\AppData\Local\Temp\Ronix.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5020.424.12497508861246206166
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffc1ac0b078,0x7ffc1ac0b084,0x7ffc1ac0b090
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1660,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:2
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1988,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2256,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2888,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4572,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4176,i,17178806394816071828,1827024761970330176,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:10
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
    "C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau
    3⤵
    - Executes dropped EXE
    PID:6956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1b84a03b0c54ce48a394b1b07344d38a1513d284455850bb790213333f3676b0
MD5 3fd462a9162e1361ef1df613c505a9e8
SHA1 328b62e6d3e571f8f91320c9d865e5536473e368
SHA512 45a7cf76cb1f59e17faa5c199e7dc27359ba5afff0e8279931485d9ff3d85751b179434dbddba529c0c7e5346f74d89e5c6eee0cdaea9d6a37323154c39ea59b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T1E9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 d0ee16563fee053896635338d3288ec0d8dcddb6dbca7754f5ab0df7536a0118
MD5 efd23cc51d5a67ce2a1d60a0da3efaa6
SHA1 c7be2b4986523ef4bfa30b7aabe7f6627beab046
SHA512 610982c94d52cc84823d5744e606e4e3bcb868d2900e98726a058bfb7dc633319134dfc59b95587876702a4cd57f80bad44c827bef0fd578a3acdbc624a0a7c6
SSDEEP 96:vZ8OdFm5F5gIV4FG43DynYrXQkxO/9VPDHOvlbPxK9hz1SVk88vAN:R820rxV4QYEY0s6jMllK9Z1SeD4N
TLSH
T1FB1281F845A18053FB90E0B6C1E77806317E86E6C57BEDC3C6906EB14B1DB7AD827205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d925.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d925.TMP
Size 3KB
SHA256 2ed7383df058da6e00ae6b2e25b14d41a35bbd4338f67c2f024165a3816de4c7
MD5 4490e0c362b68fc1811c45bd4d67e017
SHA1 925f862b5f05714a3e43778d9c3f68a665408df4
SHA512 cb9870a4c96c58c4cd3f779f18c297f2c943f961dace6435e7a2094c277d7755232eda4690ac5fef778c7f1c20adb4e549ca5c680d00c82c8a2c8a6901e631c8
TLSH
T1D771E6F846520493FF60F072A1E76D06357D83854A9BDED9C4A07EF15D16B7CDD68104
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8fd3050226a7bac821c74413dcc8bf3875741e495d7956eaddf4edad0959c845
MD5 7d2bb9053c66e26bdb70aaf74c027371
SHA1 a38d1220801d12700739b433d88c358b82cf6fa8
SHA512 b1972c325dd677ec65b993d25a2984dcf329ee83c68197336461ec131676462cfeee6bd061139155a1b2e6f30b421b27805944d943d40bf7225f21346d6ffb77
TLSH
T1CE518BF3C6D8866DCA1556F4AA187E2ACE2D0954431C3D5EC8D4AF5F93E2471F14058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f065e61cb0d1111678e8f4c1d88610d31f0a0cf98d2890cfffb2695662e27dcf
MD5 5327eef3b3c6f2de0753d067947ab48f
SHA1 575c86524eca7b3158080567b3f594b379307b0e
SHA512 5a53860fd07d4589b55ccb2c813b28e1094438d48ca26b3b1bc9aac12c8af24aa286257f9877cf8054713927b266a749bfd3b906178ab9913bb80a2c4fd6c1ff
TLSH
T1515176B3C6E8866DC91196F4AA186E2ACE2D0954432C3D6EC8D4AF4F93E2471F18058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f7f56fc99713d3caf6456d120d7f093040cdeb511154876d2af1b2da9f55e5af
MD5 550530640daab342f60f4d2ad3b39020
SHA1 287fbdf51557d92f5d15dbeb19cbd9dd1c124a03
SHA512 5d780bc394e4313a9cae59961aa885a54af0d85aaf1401332d380123fa8bf76f82a44324f11b8c0eac72de0d4d3173f78eb9b4e367d611b50342364de549b94f
SSDEEP 192:sxZPR8yM/jK1Ml8Mcf/f7iRs/5+ZYnEdpn0/W6+WNzLH/eBP0aJoLqIg4J:sxZPO0f/fosR+ZYk0/b//ea8nc
TLSH
T1F152EA16AB345977CDDBD209F655BF53D6F8056292900E48AAFCDA1C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3cc3a384280933aaf6cb8377fcfb24edcaab1fb0b84851307a24aff4c6f74ae5
MD5 01f944deca34f05a2621bd3c404b068d
SHA1 0b09736e514062b58a7434a6a9d301cea692f7b1
SHA512 98a25b16ac34980de102204d8dfbedab7003edb8b6d4630bd53f910dc8999464e819f64ba8127afeee70fa9cdee9f0c322a7d1a220351d506b4c8aaa393a0e55
SSDEEP 192:sxZPR8yM/jK1Ml8UQAcf/f7iRsp5+ZyBKIdpx0/W6+WNzLH/eBP0aJT2qIg5qJ:sxZPOq/f/fosL+Zyli/b//ea8RM
TLSH
T19D62E717AA345977CDDBD209F655BF93D6F9057292900E48AAFCDA0C01E6ADD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c390fe070499aece3b3fa5a43b12d41d34aad97e6968a238823c8be3ba3eed6b
MD5 7d2a695098f4380b749b595f43a0bc71
SHA1 a5d69f2f15bfe68599b88b5cc63e480e12e0931b
SHA512 8658e1e35c3512f24e8d148cb4667186e7a0fd1a519d24828190bb5f2211e282573eaf6d1f0e8c76d740f4b7ae1f5666e06eec7899ca7f4e927633fed96e1c91
SSDEEP 768:2h/zh8dF2WkWRmEcQhw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3YjLl/2c0VxJroXO:2h/zh8dF2WkWRmEcQhwu1jaKYjLp2tVn
TLSH
T1A9E20A3F280CC7BE4F844E9DEC2A6F966EE801CB66584D5447FA894C03C76DA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\83a2d7aa-5ddc-4b26-a545-074d7a47c94a\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 4ded55803e652b5d8d627ffc11cd1dad0e084bcaa13f028e30cead8cab941dec
MD5 7e61282bc7be253edcaf9d2ad7fa1b41
SHA1 78745f03c9816f5bed8e74043cf6c6e7ec28911b
SHA512 81b25c6fc8e1299988701a2a4a3b4020cbb635c33dc17baa28993150980ddea534d75f09a941f92abec9d116a709589e1ab23d7ebf86e42c76ec1fe8817ee36a
TLSH
T1B3D0975BE81C4050EFBB07A0066308EE8A902CCC8066848D9103352C2830B43B300FB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 b4be3d58f64e0fc344ffe9c00fa512a3862df8b188284555cb3d5e9e6e2fc2b1
MD5 033cedcdc55fdd7be61dc55000eee692
SHA1 71f6fc31bf60afb5a13f9c16b8da01963cdc1bd0
SHA512 2146e6a97c99f35e450627a05afe69ccb63d274b2125781f0687b46318283cf657ee84c4c2ec7fceb5b40c4b71fc2aa2943e8bc6d5f2e9ee0a27687c5c18ff24
TLSH
T155D0A75BA45C8151EFBB4B90166259EE9A503CCC907A948DA50206295855B53B341EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58631a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58631a.TMP
Size 138B
SHA256 cdd39e93f952107551de931113c6dc96841913fb537357c54d107857e1081655
MD5 4a03e929717347f0eb9f1ae2f7e87b1e
SHA1 d4902e842d041ebec082ef8e84f3248a55deb09b
SHA512 61edf1e9e643d90acb6e5aea1ed1df24e4ab3c486b232ef7afa0f821f4731f309c7b4d5c9e5fbe18871d522191db1e78ce5c942c37198f3e92507d5ea09c39f0
TLSH
T1A9C02BA7B0441414CF1503800332069D9F002CCC898BC44DA51331143030F133181FE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b4cdd64e51a3560cf57d625af5de3070a81b203923611ddc6ddc9b762db52eae
MD5 bf289de426cbec5aa24d737c5aa26018
SHA1 76ef3012616bbf2cace676b6d6a835d287400777
SHA512 efd306130cedf3ae88c083f391de1f86f1ec3fda129bab80f1d758c7ba9da6a58592e851494ec22da43c77dd8ac0268c650383183552a664969da9e4928e4458
SSDEEP 96:KEWgKvrYgKRyGqqEKLCAjSKg46GhiKi0y:2cD3OBhv
TLSH
T111D1156372B702113C3D2929A36497676A43B6A73418AD3B77B814B24E67F104EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594201.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594201.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 cbc927efc416892b4269409a891a8948f8f4d8e2b604f2fba539fa13a3e9866c
MD5 09507fd9c9f32a302f9f82d79dd46697
SHA1 37be5b7cd1dfcdebd4273f2b4d18f65004d343b8
SHA512 39ebd2e21cfc365776691c8cf572f15963f4aad35fc195acdc96340b23df2256d653d93d2bebf4329d57b9c195de8932236865360b02ef70e3dcdcadc75eed64
SSDEEP 384:nfiFIurQXin91ferC8NZ8TUNTUlIlY2bu2zH4atDf4HsqOO5SfVIrKQp6Sjc0msx:qFIurh9QrCswg9IBHsqOGSfVIrKT0mg
TLSH
T177B23A3ADC64DE3BAEE38786B74676879EF400A38AC85DC4D9C95E0C00876ED134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 efe6c99c21cb83c29f51bb9457a750dbc9c1ee181c948668ce551c2e57144d5d
MD5 ea449a48650a658437e96be4b0d64bb2
SHA1 c8391de7c1b096a99ca9095075d5e1cfbdcfd582
SHA512 cf340fcdceae58252e3c96cf2f928e3e18ef02cc9ab18f38b032f9a3daba54d8280da6a73975c196c61d60a8be40a493bfa8dde257f103121bd87de761b805e9
SSDEEP 192:BGNG6P2UOcQmiUypIUgqGv0qOOnwSv8U6:BGNG6eXsyIPqGsqOOPUU6
TLSH
T12802D839AD782CB79FA2AD45B98777134FD8206BE9952F84D9E81F0C00D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 705046954b7a304203bc29d3f287f805ead4ec3fed04022a538235d771c6498f
MD5 fc7c2ed9efa9bb90422158d084d554d6
SHA1 b29e380137902d468a823302bb1ebcf8d1efe9fd
SHA512 08ad44142497bec9be44641620c0d77cffcb2f843afbd356f7ec7c03cb545c9cb6ba4f4339fbfecf247b80d9cee4a59d13f053eb77eac12f29814a6fd67b41ca
SSDEEP 384:n9urQXin91ferP8NHP2bu2zH4ansqOO53fVIrKQp6Sjc0msxHD:9urh9QrPNIOsqOG3fVIrKT0mg
TLSH
T144927D3AAC396D335B929106F68736439FB810F7CEC41E84E5D99F1C019A7AC235B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 17da3ed471857513e8cb06160a63a14faf55af44da04aaf67e013e0baaaebcc8
MD5 5f2e5a9f9d11d8d82f98b1e5243ea4ba
SHA1 8309e5def5b546e29106f6f484f1c6a837ce8223
SHA512 b8cbe1bb1bc882dc3d68d6174ea8fa6a5a25422c4339892450af51b2fb6781ae313934940030827f80c8edb0dfbde588acf8a37c4afddf07102d43e2e73660ad
SSDEEP 384:nuurQXin91ferP8NHY2bu2zH4ansqOO53fVIrKQp6Sjc0msxHD:uurh9QrP0IOsqOG3fVIrKT0mg
TLSH
T120927D3AAC395D335B929106F68736439FB810F7CEC41E84E5D99F1C019A7AC235B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51a4ad2fd1c995238ab0368604166ee7c90f3abe54d562f97a8c4d0589a9bc7a
MD5 80441a87b68f1c0a88bc24ad2d451cb5
SHA1 a7eb0fa4a009b248bf9b89000d02e7348f46b4dd
SHA512 8b1e77edc06eba825bac62b949b5baf83889ff2692712ad69d9bc1e640b2d272cc7e5c21485d8d083c5407132286207a779db1e1bf55d8b08819e9c4ecdbf7c8
SSDEEP 192:BGNq6P2U8QmiUyGHEgGGv0qOO5/Nf0BjqzKjU6:BGNq6eXvH/GGsqOO5CfU6
TLSH
T1A11208796C68AC774E92A405B4C637538EA820B7DD896F84E5D86F0C00DBA9C374B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

6b72d158-e8cb-4ffd-82d6-b9bc3e8ced3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6b72d158-e8cb-4ffd-82d6-b9bc3e8ced3a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1b8a307e-ee48-4047-ba85-6b5c8d82ec4b.tmp

Path C:\Users\Admin\AppData\Local\Temp\1b8a307e-ee48-4047-ba85-6b5c8d82ec4b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

523a918b-aabf-46bb-87b5-d47be7332e77.tmp

Path C:\Users\Admin\AppData\Local\Temp\523a918b-aabf-46bb-87b5-d47be7332e77.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix.exe

Path C:\Users\Admin\AppData\Local\Temp\Ronix.exe
Size 15.5MB
SHA256 d2e1afef6561c5806b1d6438a886df3102449a8708cd2f7ea9a8ec27a9065385
MD5 b1cf36c7076e3bb998b309a125fae177
SHA1 c84dfc8557f7eac1a1a2d2e441cebd1fa4233cd1
SHA512 bd416af112268642f3ad9c87b85f202d182cc8203848d6d91f75edcf7492cad311d5bcb671e329eafe9b4089f624365ae7a09114b2440658a53376d20ab7b6be
SSDEEP 98304:nOsiN3uJmrP+tudDWREOgW+fiuWwEZAWTZ1rc/BEtzJyKzrn4U71HOCW17aW6YrP:OTuJm/DWRE+Jd1MKgU7sP1CCP
TLSH
T1F0F6F7247A5B996CD05BC474834B8A634A7530CB0B39B9BF448496382F6EBF46F3835D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4040_548257009\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

637afcfe-80e8-4944-a7df-f6a539019f6a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4040_793120673\637afcfe-80e8-4944-a7df-f6a539019f6a.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1ba4023fdfd0d9b5b3fbb0d21dcd6713c9493948f2406c7a269cb4796bff08e7
MD5 89c0476d822ce48388bb120b0794ea77
SHA1 e296fbe106e8434620590758c523634eb2fbf84e
SHA512 bd184880cd61b0d26b7b912f990fc405d8f6993a680bf45146b0073aeccb2f6bde5f36a82a5f231b41b39979278ec5507cb762cbe08e85d6c05bbb56fd53e60b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b132b5e795edc1dc72c8db51c49d632a81d5b7a7cb9adab65c4debf5ded5a23b
MD5 3383da572c497e7bb704fe878539a7c3
SHA1 1e1e772b371c231740b56f236712035d2ccff9b1
SHA512 fd54b06da4105c7f7438f08e9dcb5ce4515c97d06b18c72c128c6721f0e08851e6aa505e24ee2490762e5097f757e57bfd70b3635881158a0ffc7bbcfe54db89
TLSH
T1BCD0127373020534C41124B3111261280400C50B410540025828859D9A040600D06C52
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 2adcd03d12f97bb62fa0bd704b9562586ff3aff80be4d4209613bb8e17d45420
MD5 0bca72d783b907e1e8f616252e0f2a9d
SHA1 3e5e092f7caea98160594d72fd22af853fa05ea9
SHA512 4dee85e7a5a2498c0d51e50f96f791adbc1323fb425189baadca7fc880fdf9ce45f4e1841b329e38f0fbce56ba7afcbef91e55ffcf1d0578d75b45a787d0fb89
TLSH
T191F0A9F409E0898DFB938AB955EBB881B13234DA41776E0283EC9D785B023A1D016710
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d23f.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58d23f.TMP
Size 48B
SHA256 f208954e5925d6d03e5e170442d402eee8a4bc2d45d33b5f50a7c05c22b15330
MD5 910f35c5ab45e40db4ca77f7f0c38295
SHA1 b890ba259d07683724df08f6eb47e9b35bedd22e
SHA512 578b449e99ed64f61b5393a066ddcc1ff28ea3352f70a56ceb1aa1f47142f7d67b650b539912f1a0beafcf0aab289ed6838f8101aba75280451add9c1f225aa9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 d3761c23dd838fbe0671849987b8ed0ec6204aeb06fe9e5bd011ce348ef4b8c6
MD5 a8440df1b1f76d891bae591ea931bcee
SHA1 66ae4639c4459e9954ea8ede25d0423462b47800
SHA512 390e36a4a6fbea241d913bb795fa34f118edd5deeff6a81d3d7fe70f5ee8a250408cce65e2eb08e6cad208a94b1bc9884b73a3a40d6fc6e59f8187322a3f5dc6
TLSH
T1B8319EA2C3E4C66D895166F427347C17CC2D051992287E27CDDAEBDA67D2071D11164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe597759.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State~RFe597759.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences
Size 6KB
SHA256 6ff144c100b416491edfc14f5a99462897da48f8cb4f2c30be60ea5bd8110343
MD5 6c3a656d355e43a7800a0f11d33c50e5
SHA1 da1f2dee0948d4f7e71269f51787e3f41801ecdc
SHA512 6bc2fb1a5f3dd25897ef2a7f39e0012ba68e95215b6952db9be95e4a7b779c5822dd1a22c9a02fe1ad4890676f929581b9f891e5e0d39ec57748623b9dfd9f56
SSDEEP 192:sti0RBfwZ8paLP/S+WiTqMwxgCba9UvMC:stHRBXI/VTwxoC
TLSH
T1D4E1A603AF2869B74CC7E6197A35BF56E2F6112222D50E98ABFD870C04E66DD5207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58fae5.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences~RFe58fae5.TMP
Size 6KB
SHA256 2e90ac2d21260c90280fd20a040f6d945049c5adc276e2384881637a7fa17f27
MD5 57df08db68f9431eae0e53ff166410f9
SHA1 00521563e94bf462ef99c16b780024cd793e2c7c
SHA512 65906908f58dfc7c1692335a73b4997f180d0bba94e11021e26c1e3d3079c98bd57a924c22bfce94368fc0b8683d43fc7b3dda67515f07fcfea19160b9987a40
SSDEEP 192:sti0RHfwZ8paLP/S+WiTqMwxgCba9/vM8:stHRHXI/VTwx98
TLSH
T1DDD1C903AF2869B74CC7E2197A35BF56D2FA112262D50E98EBFD860C08D66DD5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 16KB
SHA256 f0fbb4e45bb2424989c0a5f57c87912a193ec01bd701c953ba307dd3fd15c3c2
MD5 a54043fdc0fb61d20ce3dde0fb06ff8a
SHA1 b07c49f811fbc8c62248f7abcf942458568e34a4
SHA512 9b460bbf0c0c36cab4f7e355a98da70c87cd839b41b9039d1bc9712f512a973f222142ec71e376e27496d07891160d76bcbb46b4d37401db1efddb9340d21445
SSDEEP 384:z9h6GScwr1UjPBasgirch4FWUN6h8jNbOLFYM1dZfzCZA:FwrOPBQWcu0UyXCM1Xx
TLSH
T14372AD3290606FB31CF3D494BA05272B177089BAE0607FAC9BED5F0D415B28D1797E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 1KB
SHA256 2799c38c6348df842d64e3be9188716134b3235d9a1160b28fad5c9dc9a32668
MD5 43d9d9edaeb40d6d0dab90c73fadec80
SHA1 e26cca606a064e6dd8070f6b916b1719d65891d4
SHA512 265866a4202f0dcbf6d59aea6888200ea44e4c3d524cc8318fbbb04afb9c5b7887acc1f4760020b6885f45c471361235ba9ef0b909d9b8eee9d68f3795673f64
TLSH
T16F318533E0643F729DD16106B3467E8B2E209126C2118F8C71FE171C02DA1DCA62BE32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 2KB
SHA256 c0b9fc3a9b6e8e3ea8065b923e74e2cc34f0a74f4bfbb4787d5196473f67c17c
MD5 3ee42213a700b394c3a5c3960fe07453
SHA1 a3e29e9786a4f30911235d9faae93e94d04890df
SHA512 c06d10ffa1780bd41aaa44f8f7e80f5814238410e6f1c2c3ff18ab4008a5503cc41e92eb0ecc2eb5b4fc1c1cc37dc9dac230fa20d1025020213e7bbce1259c16
TLSH
T1B651B433E418AB778AE35604BA4A3F576E3581619A612F98A5FE1B0C01CA19C2303C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 3KB
SHA256 1c9cef300d0b7923f80dffbcff916d4a5bbb69f27fad4528a033ff50fcd7cd0b
MD5 103325d284818418ae53400cc8823fb0
SHA1 e7cd720e6cccd75639b6f549968e554dfb20c99e
SHA512 4fdf60c4f11360048808a05303134f55f728faf59d1a9a92be64cbe98f21d5a2e50c8d690f5e97670f3bd4cd0f607b9b4546a78b348fa895144fae952ee24502
TLSH
T19F718423E528AA674EF39904B9862F0A7AA54137D5913F9CE5FD1F0C01CB2982342D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe585bc7.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State~RFe585bc7.TMP
Size 1KB
SHA256 9d1e50bcceb594f2fbe4a8d1b1944981c3601ea5a8ff5f897da14fa829d20d94
MD5 1abf1701380d722561885c32393a3748
SHA1 fbcbc6165fe782284c9e4e3e97ace45338a8460f
SHA512 86f7a785761999dbdb5753bdf67d72424c6fdadb6f85918e7d4921388b1d732b3806561cfbcdd5ff61b85f3b4e99ba023625bc6bb16fec42a084dcd63ff08b0c
TLSH
T15A213233D0683EB69DD55506F242BA8F3E60952696219F4CB1EE171C028A0DCA62BD33
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\hyphen-data\120.0.6050.0\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Loader.exe
Size 223KB
SHA256 c10a44bcfbe74b002301d8d1db86a86514991ffdd653db18403b12c999995314
MD5 c20889e76b60471e064140799e84036a
SHA1 cecc0b65bcc0a985c627859ced705e3e359b8a9d
SHA512 9191bb59338d1abcaf72a6675965113570772d21205a9ecd72fd44497ae0748c83c033e51fe60c2927b0a68aba7311a62c131576b83d8081d4a6f9893804fff6
SSDEEP 3072:IY9zMO9UUu05Lph1QS+usYmaMjBwbO1GB9MdE9M9DF78FffdJeD:IY9wNH0531YYHMjAzM+9sM72
TLSH
T12F248D1A956108F8F7B399BCDA164E22CAB27C954FF4B65F5BB44AF24E135808F2D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix-Module.dll

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Ronix-Module.dll
Size 8.5MB
SHA256 de7287a89bd6d1b10564c032c94c9df33bd884debdb753c04b7233012efb0835
MD5 bf117c333855c1af1a16f3b6d0c94ee7
SHA1 f8c1286f191a1e5a157d8b0eda2c0461d6bad6eb
SHA512 2a7697ec36d5f86fdc62735821e5924f3d02bfcc5fd5c2e809ff695d103aa07a8226cd9323279fe1bbb5471bd2c6f3a007e2937d7cf8f00c51191d1ee3c580d1
SSDEEP 98304:VcuLnZiPcnT2Oruc5ysp1bFcevGFwrhtygT:JbMPiT2Op5ysp1bDeWj
TLSH
T1B4969E76B6A401ACD87BC13CC6579A13E7B2B815133097CF16A4567A1FB3BE41A3E390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau
Size 751KB
SHA256 865db5fde51da9f777a1d440ee7adc8a0a4558115ce92401f4ed6396849cb32a
MD5 44e499e66ca7981360919550ee39ccf4
SHA1 ac004a21f5d7c04041405521f5dfb27929b998ed
SHA512 1dce81dba5dad264ea7d534e0329459775ee7f0a23adc7897d3f414e69229275661a9090017ceea2131ba63c1b304df53542ccb6c3377e3efe67907aca1d6323
SSDEEP 6144:UogNZUqKf4qX2CZ6zBXlpvGbtoJQc3zVvDtTmRGy6FY/OSRlXACAPplC6fTU2Agc:AJQc3zVvDtSDnRXHb
TLSH
T1ADF4441DF6047130194F53F6A9AF8844ACB1A2C6916C50F8D4FCB7891B7F87D22A6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
Size 10.9MB
SHA256 dd16dfc077156df6795a69a4bbb753a0201de9513e6614741d8f1976ca9e8b7a
MD5 16de28c93995a988aaab6eb1c409038e
SHA1 424666825b9a2970a0d7663fbe66f9e885e5215a
SHA512 2ad14445e7cf7df46251d2978757ad2c73a9b0fd143d7fcae8cf9d78af1702c7a991be69330535a8cc664baa85c59ae0b1fdb8bca8354e1fd8f5bbece25ac074
SSDEEP 98304:gJeV6UHLvpVTLS0wRlgF8MkaQW0Dlems/Dt3:gJKXfS0s6QW0xemot
TLSH
T161B67D37629C11D8E0BBD07D8B8B5D93E7B2340903719AEF05A046965E1BEF94F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\version.txt
Size 5B
SHA256 7fbd210ebec11f65a97190ef900795c4b8da3805af3f5a1b8d1d272556b292ca
MD5 7d23ff901039aef6293954d33d23c066
SHA1 528cf42af97409ff91db4e7793a81bc5f447d215
SHA512 d3c38b72c045741693569bdf0ffad7c7f2135a98358bdc26a31ba654110d6347b32797b54e0fa41dc336c532fee9c843fa0ae7fc62162c3658d1ecf947cdffe2
MD5 SHA1 SHA512

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1882599753\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_907718340\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_907718340\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_1256269826\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_1648226460\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

main.lua

Path \??\c:\Users\Admin\AppData\Roaming\Ronix\scripts\main.lua
Size 25B
SHA256 761d0ba13957885dc4f35ecd2f6fe9ec62138c586766f4f8a5c03706efbff2ab
MD5 01999e84d8107b5efc0d1b93d566ab46
SHA1 19dd9037aae46c141e02d5eee0b656b3411779a8
SHA512 0df3f23b2d14989e034d50ea19aff0369c21c76e061cc65969e9f051892b31e7578ff9adbc37a97dbc1c84088f44bcd47bfea3d8e0d2aeecc3f639514c072a32
MD5 SHA1 SHA512

Submit Download

memory/1412-1210-0x00000198E1F90000-0x00000198E1FB9000-memory.dmp

Download

memory/1412-134-0x00007FFC3A740000-0x00007FFC3A741000-memory.dmp

Download

memory/2076-6-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-3-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-8-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-9-0x00007FF67F8FC000-0x00007FF67F8FD000-memory.dmp

Download

memory/2076-10-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-61-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-99-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-0-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-5-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-1-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-4-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-7-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/2076-2-0x00007FF67F3B0000-0x00007FF680229000-memory.dmp

Download

memory/5424-1930-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1938-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1940-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1942-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1941-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1939-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1937-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1936-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1931-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5424-1932-0x000001C46A530000-0x000001C46A531000-memory.dmp

Download

memory/5576-239-0x00007FFC3A740000-0x00007FFC3A741000-memory.dmp

Download