roningloader | b0521ad45fd21cdae26afdc74307870c5859421e049bbff2a545852b0ccf0fe6

Analysis

max time kernel
150s
max time network
167s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/06/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.exe
Size 3.2MB
Sample260610-ag12ksa16w
SHA256 b0521ad45fd21cdae26afdc74307870c5859421e049bbff2a545852b0ccf0fe6
MD5 73a84cba28d14625441e1b0eac2a67f1
SHA1 813c1de6102e1cc953f86567e972d0e19d9e530a
SHA512 48f25839fe5d5b7f8004f63731380bd1e99f5ee27a835dea1590ff1207d322d4a4c99ac3a736ebc3ac56fd3e7a04a6de1db1e5109674b0ff79c06ec8935a3338
SSDEEP 98304:dhzAJ3UifrjsG4SbcC2K2pSW7hKaAkFF41o4wr4d:dhviXsxKqLp/1K7kE6r4d
TLSH
T14BF52349E3A0D357D0314A7C097E8FFD697AEC322865B7DB5B41B262D2B2B6CD807502
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

dragon_breath apt defense_evasion discovery roningloader loader

Malware Config

Signatures

Family: RoningLoader
RoningLoader is a multi-stage malware loader used by the Dragon Breath APT.
loader roningloader

Detects RoningLoader loader 20 IoCs

loader apt dragon_breath

resource	yara_rule
behavioral2/memory/5876-35-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-34-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-36-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-40-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-41-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-43-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-47-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-46-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-48-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-49-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-45-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-44-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-50-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-39-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-37-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-38-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-42-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-32-0x0000000002910000-0x0000000002BCA000-memory.dmp	family_roningloader
behavioral2/memory/5876-87-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/5876-88-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader

Executes dropped EXE 2 IoCs

pid	Process
5876	66VOAk0O.exe
3748	vmservice.sys

Loads dropped DLL 8 IoCs

pid	Process
1668	1.exe
1668	1.exe
1668	1.exe
1668	1.exe
1668	1.exe
1668	1.exe
5876	66VOAk0O.exe
4820	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{31351756-3F24-4963-8380-4E7602335AAE}.cip	66VOAk0O.exe

Enumerates processes with tasklist 1 TTPs 15 IoCs

discovery

Process Discovery

T1057

pid	Process
1920	tasklist.exe
1096	tasklist.exe
2848	tasklist.exe
3260	tasklist.exe
5788	tasklist.exe
5892	tasklist.exe
5868	tasklist.exe
4772	tasklist.exe
4168	tasklist.exe
1124	tasklist.exe
1200	tasklist.exe
5036	tasklist.exe
4468	tasklist.exe
4956	tasklist.exe
1864	tasklist.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\D3D11InstallHelper.dll	1.exe
File created	C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\66VOAk0O.exe	1.exe
File created	C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\uninstall.exe	1.exe
File created	C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\9ZUPMq.3w	1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\windows\yeFEacjaeW.bat	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Process not Found

Delays execution with timeout.exe 15 IoCs

defense_evasion

pid	Process
1128	timeout.exe
3952	timeout.exe
3084	timeout.exe
2280	timeout.exe
5712	timeout.exe
5136	timeout.exe
3232	timeout.exe
1616	timeout.exe
1044	timeout.exe
3588	timeout.exe
2124	timeout.exe
4728	timeout.exe
6112	timeout.exe
1744	timeout.exe
2488	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1668	1.exe
1668	1.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
5876	66VOAk0O.exe
1492	elevation_service.exe
1492	elevation_service.exe
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found
796	Process not Found

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1492	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5876	66VOAk0O.exe
Token: SeDebugPrivilege	1492	elevation_service.exe
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeDebugPrivilege	5876	66VOAk0O.exe
Token: SeDebugPrivilege	1200	tasklist.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	1864	tasklist.exe
Token: SeDebugPrivilege	4468	tasklist.exe
Token: SeDebugPrivilege	3260	tasklist.exe
Token: SeDebugPrivilege	1920	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	5788	tasklist.exe
Token: SeDebugPrivilege	5892	tasklist.exe
Token: SeDebugPrivilege	5868	tasklist.exe
Token: SeDebugPrivilege	1096	tasklist.exe
Token: SeDebugPrivilege	4772	tasklist.exe
Token: SeDebugPrivilege	4168	tasklist.exe
Token: SeDebugPrivilege	4956	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
796	Process not Found

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 5876	1668	1.exe	84
PID 5876 wrote to memory of 820	5876	66VOAk0O.exe	10
PID 5876 wrote to memory of 820	5876	66VOAk0O.exe	10
PID 4820 wrote to memory of 2636	4820	regsvr32.exe	87
PID 4820 wrote to memory of 1492	4820	regsvr32.exe	86
PID 2636 wrote to memory of 2848	2636	cmd.exe	93
PID 2636 wrote to memory of 4016	2636	cmd.exe	94
PID 2636 wrote to memory of 1128	2636	cmd.exe	97
PID 2636 wrote to memory of 1200	2636	cmd.exe	100
PID 2636 wrote to memory of 3164	2636	cmd.exe	101
PID 2636 wrote to memory of 3232	2636	cmd.exe	102
PID 2636 wrote to memory of 5036	2636	cmd.exe	106
PID 2636 wrote to memory of 5164	2636	cmd.exe	107
PID 2636 wrote to memory of 2124	2636	cmd.exe	108
PID 2636 wrote to memory of 1864	2636	cmd.exe	109
PID 2636 wrote to memory of 4212	2636	cmd.exe	110
PID 2636 wrote to memory of 1616	2636	cmd.exe	111
PID 2636 wrote to memory of 4468	2636	cmd.exe	113
PID 2636 wrote to memory of 2132	2636	cmd.exe	114
PID 2636 wrote to memory of 3952	2636	cmd.exe	115
PID 2636 wrote to memory of 3260	2636	cmd.exe	116
PID 2636 wrote to memory of 2392	2636	cmd.exe	117
PID 2636 wrote to memory of 3084	2636	cmd.exe	118
PID 2636 wrote to memory of 1920	2636	cmd.exe	119
PID 2636 wrote to memory of 5068	2636	cmd.exe	120
PID 2636 wrote to memory of 1044	2636	cmd.exe	121
PID 2636 wrote to memory of 1124	2636	cmd.exe	122
PID 2636 wrote to memory of 4852	2636	cmd.exe	123
PID 2636 wrote to memory of 2280	2636	cmd.exe	124
PID 2636 wrote to memory of 5788	2636	cmd.exe	126
PID 2636 wrote to memory of 5700	2636	cmd.exe	127
PID 2636 wrote to memory of 5712	2636	cmd.exe	128
PID 2636 wrote to memory of 5892	2636	cmd.exe	129
PID 2636 wrote to memory of 6124	2636	cmd.exe	130
PID 2636 wrote to memory of 6112	2636	cmd.exe	131
PID 2636 wrote to memory of 5868	2636	cmd.exe	132
PID 2636 wrote to memory of 6044	2636	cmd.exe	133
PID 2636 wrote to memory of 1744	2636	cmd.exe	134
PID 2636 wrote to memory of 1096	2636	cmd.exe	138
PID 2636 wrote to memory of 428	2636	cmd.exe	139
PID 2636 wrote to memory of 4728	2636	cmd.exe	140
PID 2636 wrote to memory of 4772	2636	cmd.exe	141
PID 2636 wrote to memory of 3148	2636	cmd.exe	142
PID 2636 wrote to memory of 3588	2636	cmd.exe	143
PID 2636 wrote to memory of 4168	2636	cmd.exe	144
PID 2636 wrote to memory of 2252	2636	cmd.exe	145
PID 2636 wrote to memory of 2488	2636	cmd.exe	146
PID 2636 wrote to memory of 4956	2636	cmd.exe	147
PID 2636 wrote to memory of 5388	2636	cmd.exe	148
PID 2636 wrote to memory of 5136	2636	cmd.exe	149

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:820

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\66VOAk0O.exe
  "C:\Program Files\\Snegreijsmaity\RDKl4OR6\Kyl2lh\66VOAk0O"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5876

C:\Windows\system32\regsvr32.exe
regsvr32.exe /S "C:\ProgramData\Roning\goldendays.dll
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\system32\cmd.exe
  cmd.exe /C ""C:\windows\yeFEacjaeW.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:4016
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1128
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:3164
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3232
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:5164
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2124
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:4212
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1616
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:2132
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3952
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:2392
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3084
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:5068
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1044
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:4852
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2280
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:5700
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5712
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5892
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:6124
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:6112
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:6044
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1744
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:428
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4728
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:3148
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3588
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:2252
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2488
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1492"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- - C:\Windows\system32\findstr.exe
    findstr /i "1492"
    3⤵
    PID:5388
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Users\Admin\AppData\Local\Temp\vmservice.sys
C:\Users\Admin\AppData\Local\Temp\vmservice.sys
1⤵
- Executes dropped EXE
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

66VOAk0O.exe

Path C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\66VOAk0O.exe
Size 207KB
SHA256 1bda9c50d3b02def945d52318fff7e35844f6842772d0fc8c7d80c7af37bcbb9
MD5 082cb645d7b4fabd2ae92ec334049a3e
SHA1 ec25e8244d642fe64bb8d35a0531cbb3a7a9d904
SHA512 27375662956a0d69d198bf4304e1ec1bff68126fd5c01397057bdad457549644f54582bf837d9e5983a8bb0922a974ac4cbdbf7162ef936e39fff51222781048
SSDEEP 3072:YITdqmTlh5BxjqWREzZLqTQDGM2P1ABv/rzrxXGNt8gixrxBhzAcMvh95n:HhBTPDxjqkEzG4qPQwR
TLSH
T15724501127FC4225F0B36B39A9B543A65A32BD52AF35C6CF6620354E1930ED0DE35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ZUPMq.3w

Path C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\9ZUPMq.3w
Size 2.7MB
SHA256 c497b58ff068c3ac21d3b30fef5af2c7d6182277348ad96928f7b28e410e862d
MD5 fa7298ceff285e62268fd337b532894b
SHA1 02ec8e672ee8900b4f155ac5503cf1655d808ac5
SHA512 b3c57acb73f11d6a2dc7f687cf2b93d7c949fda38f7f8e238869c783b3f81c6ba9055b46d914b961d776c1a1ea2dc6eea5f01405ba9f5afd17fabd759b020db9
SSDEEP 49152:Rj+ip4ZYYiHOK9YMcQxFfbiaiJrAfKXY9YpWE2aQNmdjLQw90xiAB+Ni:lNp4OYiuKmMcQPODfxpWEPQwdjLQlB+w
TLSH
T183D533204CEBFF15B64B3EB46665CD8C06C9350317EBE0BC59DDA78AC19A3461892E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3D11InstallHelper.dll

Path C:\Program Files\Snegreijsmaity\RDKl4OR6\Kyl2lh\D3D11InstallHelper.dll
Size 242KB
SHA256 78b0a1c7847506452ee518b03f8502ecc4f5d746a87d1130157383dd9a6e0e57
MD5 4c153ab7598fc93fccbbd3239375ffa0
SHA1 050ec34368bd23a49f5f72a273daf551fa1fdfb2
SHA512 cd37ef7299ab2b6cc643d7104db62a6b471ac7c470af3d015bb751f6f94cc41080713c1aa60f17c21bef7540e21df24aab904eb6736633b934c25f69caaf9eac
SSDEEP 6144:Mq+cs2A7sAbzZpbTEGQBDGdg1/lVBymrgfbz:Mq+cs2A7sAnZ6hBDAgrymrgf
TLSH
T175345E1576A44C79E957C07CC7474A56ABB27C860722E9FF03A002396F2FBE56A3CB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enpug.bin

Path C:\ProgramData\Roning\Enpug.bin
Size 170KB
SHA256 a696f2543cdfd0578f96d458816051e65ed25e757502ed190182e5f85ef522cb
MD5 786680a4c3714af139623b7ad67f71e9
SHA1 e41b1aea6db5918d48ad2db1b24fdb83a28859f0
SHA512 cc99dfdcef56663b486ff28f152f045a1cccc83af0d800128c8b6747652311d8f81fe6dd3cc12bda1371993a6a831107f5ea1a71d4d1b44ce98993e36a8efea2
SSDEEP 3072:tC+U7Tz+HjTejTUvs/Sa1DHt3p3makuDozRNd8suZ100oYd:tCzz+DTejIvuSkHtZdp0Fb7R0
TLSH
T187044946339432F5D46B8278C9924B17FBB27876477157CF46A482BA2F233E16E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goldendays.dll

Path C:\ProgramData\Roning\goldendays.dll
Size 258KB
SHA256 33b494eaaa6d7ed75eec74f8c8c866b6c42f59ca72b8517b3d4752c3313e617c
MD5 d920c1a909744e206405ec13539ee01c
SHA1 bf778f27c8abc9bd44ca484bf18d45cd17f7bbc8
SHA512 f0b30c2ea0dac44661f88b72861da1a25f9c826fd840b093ce36fa77be22856a3592c9e2c05e62a433fa2a294745c3aa923049ed0262170b078d95ea12f403b7
SSDEEP 6144:aKzJW4g+lZ1WJrfO6F89mJJSbznohoHF6nGj:PHgi1WJfOixvSfnoIbj
TLSH
T15F446B1972A50CB5E977823DC8535A06E7B2B84603A0DAFF03A0875A9F377D0A53FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trustinstaller.bin

Path C:\ProgramData\Roning\trustinstaller.bin
Size 142KB
SHA256 fc63f5dfc93f2358f4cba18cbdf99578fff5dac4cdd2de193a21f6041a0e01bc
MD5 00893b7c3e8c39d4663257ddec678aa9
SHA1 97e2a79af66c94fadb0f039fea405c1e612d6729
SHA512 dc324c1a84f3b8e7be18659ca5e589feb7bf9b91d1c3e962620186eecaf210955dfe44b893d51800e563d6d2d59d21aa841bf1b55a529e1a0db6e3ef6f595e4d
SSDEEP 3072:d8rLABJ/oXQJioZSv6Qgzsw90cGi6adqhI:JBJ/ogJiogSQgzsY0YU
TLSH
T106E36B57B7A530F8E5769239C8605602FBB2783647349B6F03A443661F233A09E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz505F.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz505F.tmp\UserInfo.dll
Size 4KB
SHA256 4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7
MD5 d458b8251443536e4a334147e0170e95
SHA1 ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3
SHA512 6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1
TLSH
T18D8173BB93E00CF3D0A44BB740A71CE362B5DD201B62001F4A478EA92590B67EE7E715
MD5 SHA1 SHA512 TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz505F.tmp\nsis_tauri_utils.dll
Size 32KB
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmservice.sys

Path C:\Users\Admin\AppData\Local\Temp\vmservice.sys
Size 50KB
SHA256 627169b1bad0744f636c72a86f6f8e0ff1f4fbb475e8629576a2462a0341ca4f
MD5 5b3bea02989eaa3c91cc0529b28c0fdb
SHA1 8b938dda75e9c72be2e34be0a3fd855b09d780c2
SHA512 5d983c0fe38daed7bab4904dbce99d765119e4a96464b67aa887b8329272f1e1a7168ff70e5cc0512c4ab1a5f486cba8fdde8792d49cad5cb7d8b2e688bf84d3
SSDEEP 768:dnqcG6aNG2dYzLlhrO5YB3f0wXNEuLSoQu7aYzLlhrO57qW:dgdYl5pewXpL7uYl5JW
TLSH
T106337EA28A146CD2FE579E30E1D88627EEB1B2822F5189CB2114C5D91F837D53F7C25D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yeFEacjaeW.bat

Path C:\windows\yeFEacjaeW.bat
Size 299B
SHA256 4a07964133f4d3624d898b08179dc28d4ee5bc56603675c8ea9deac58951b6af
MD5 5319fccc535e20642c410b2c64e1eb56
SHA1 4e511f8dfb68469497a4a9cd542fe1ee21e3fa3d
SHA512 0bcf4ff2088aec44e634715147aa54d6347138b00e8b4062366d31c735b41dd3e5ea5f581505529dabec515e2977f147196dd79ece5c8301a3c91393ca198467
TLSH
T130E02B2998DEDA325778853F0A0F5554F44721936A0014B4711DA7F98F17163C9E80C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-80-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/796-77-0x0000024A2AA90000-0x0000024A2AABB000-memory.dmp

Download

memory/796-84-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/820-53-0x000002631CE90000-0x000002631CF0D000-memory.dmp

Download

memory/1492-66-0x0000022066380000-0x00000220663A4000-memory.dmp

Download

memory/5876-40-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-48-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-50-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-39-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-37-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-38-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-42-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-33-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/5876-32-0x0000000002910000-0x0000000002BCA000-memory.dmp

Download

memory/5876-45-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-49-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-44-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-46-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-47-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-43-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-41-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-36-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-34-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-35-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-87-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/5876-88-0x0000000140000000-0x00000001402BF000-memory.dmp

Download