e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ronix-Installer.exe
Size 5.4MB
Sample260708-zyemcahs7j
SHA256 e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634
MD5 00e7c93d610841d179eb75683b05f1f7
SHA1 fa51d17b3e8edc2315341f46c72201fa3506b564
SHA512 639892febf0c3a56020f063410dc63bd8ed72528b0796f489aed01fa068f30213d34a42dfad6b683f60a26c80a2ffc05e61c9e50c3a239d953d6ddb1cf3cfcb3
SSDEEP 98304:juRO1zNIfko55jRMmro9B+iHR9lRu1Ux6ONgwKo/lgAVbNbEYL9kA:juW5MjJw+ix9378OaFogA19Jz
TLSH
T1B346336E42C63D91F2918BBA6D7519898C12EE375F46C43EE61F06A6081C35ECF3768C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe

Executes dropped EXE 2 IoCs

pid	Process
3420	Ronix.exe
108	lsp.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4292-0-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-1-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-2-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-3-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-7-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-10-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-6-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-5-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-4-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-8-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-27-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida
behavioral2/memory/4292-75-0x00007FF657420000-0x00007FF658299000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix.exe

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
30	discord.com
32	discord.com
47	raw.githubusercontent.com
48	discord.com
120	raw.githubusercontent.com
2	raw.githubusercontent.com
29	discord.com
38	discord.com
71	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1654910967\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_385145659\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_1400108455\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_816209164\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1654910967\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1654910967\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1654910967\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_1400108455\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1760065982\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1760065982\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_179283970\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1760065982\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_385145659\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_816209164\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_816209164\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1760065982\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1760065982\_metadata\verified_contents.json	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4084	msedge.exe
6524	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280186255788335"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{F830ADA6-5F78-4EE6-B98B-76887D4F2CEA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{CC1709E2-A06F-433C-8F5B-38EE6EEC0C93}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{AAFDCF16-0938-4CF2-B08A-2154983DEF54}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4292	Ronix-Installer.exe
4292	Ronix-Installer.exe
4292	Ronix-Installer.exe
4292	Ronix-Installer.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe
3420	Ronix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
4224	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
856	msedge.exe
3420	Ronix.exe
856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 5416	4292	Ronix-Installer.exe	89
PID 5416 wrote to memory of 856	5416	cmd.exe	90
PID 856 wrote to memory of 1900	856	msedge.exe	91
PID 856 wrote to memory of 2076	856	msedge.exe	92
PID 856 wrote to memory of 4084	856	msedge.exe	94
PID 856 wrote to memory of 2076	856	msedge.exe	92
PID 856 wrote to memory of 2076	856	msedge.exe	92
PID 856 wrote to memory of 4900	856	msedge.exe	95
PID 856 wrote to memory of 4900	856	msedge.exe	95
PID 856 wrote to memory of 3144	856	msedge.exe	96
PID 856 wrote to memory of 3144	856	msedge.exe	96
PID 856 wrote to memory of 3144	856	msedge.exe	96
PID 856 wrote to memory of 3548	856	msedge.exe	97
PID 856 wrote to memory of 3548	856	msedge.exe	97
PID 856 wrote to memory of 3548	856	msedge.exe	97
PID 856 wrote to memory of 1144	856	msedge.exe	98
PID 856 wrote to memory of 1144	856	msedge.exe	98
PID 856 wrote to memory of 1144	856	msedge.exe	98
PID 856 wrote to memory of 2604	856	msedge.exe	99
PID 856 wrote to memory of 2604	856	msedge.exe	99
PID 856 wrote to memory of 2604	856	msedge.exe	99
PID 4292 wrote to memory of 3420	4292	Ronix-Installer.exe	100
PID 856 wrote to memory of 1848	856	msedge.exe	101
PID 856 wrote to memory of 1848	856	msedge.exe	101
PID 856 wrote to memory of 2004	856	msedge.exe	103
PID 856 wrote to memory of 2004	856	msedge.exe	103
PID 856 wrote to memory of 2004	856	msedge.exe	103
PID 3420 wrote to memory of 4224	3420	Ronix.exe	104
PID 4224 wrote to memory of 1296	4224	msedgewebview2.exe	105
PID 4224 wrote to memory of 2348	4224	msedgewebview2.exe	106
PID 4224 wrote to memory of 2348	4224	msedgewebview2.exe	106
PID 4224 wrote to memory of 2348	4224	msedgewebview2.exe	106
PID 4224 wrote to memory of 2348	4224	msedgewebview2.exe	106
PID 4224 wrote to memory of 3268	4224	msedgewebview2.exe	107
PID 4224 wrote to memory of 5156	4224	msedgewebview2.exe	108
PID 4224 wrote to memory of 5156	4224	msedgewebview2.exe	108
PID 4224 wrote to memory of 5156	4224	msedgewebview2.exe	108
PID 856 wrote to memory of 4436	856	msedge.exe	109
PID 856 wrote to memory of 5648	856	msedge.exe	110
PID 856 wrote to memory of 4436	856	msedge.exe	109
PID 856 wrote to memory of 5648	856	msedge.exe	110
PID 4224 wrote to memory of 2032	4224	msedgewebview2.exe	111
PID 4224 wrote to memory of 2032	4224	msedgewebview2.exe	111
PID 4224 wrote to memory of 2032	4224	msedgewebview2.exe	111
PID 4224 wrote to memory of 2032	4224	msedgewebview2.exe	111
PID 4224 wrote to memory of 2032	4224	msedgewebview2.exe	111
PID 856 wrote to memory of 1520	856	msedge.exe	113
PID 856 wrote to memory of 5336	856	msedge.exe	114
PID 856 wrote to memory of 2480	856	msedge.exe	115
PID 856 wrote to memory of 5336	856	msedge.exe	114
PID 3420 wrote to memory of 108	3420	Ronix.exe	116
PID 856 wrote to memory of 6884	856	msedge.exe	120
PID 856 wrote to memory of 6884	856	msedge.exe	120
PID 856 wrote to memory of 1600	856	msedge.exe	122
PID 856 wrote to memory of 1600	856	msedge.exe	122
PID 856 wrote to memory of 6932	856	msedge.exe	124
PID 856 wrote to memory of 6928	856	msedge.exe	125
PID 856 wrote to memory of 6940	856	msedge.exe	126
PID 856 wrote to memory of 4432	856	msedge.exe	127
PID 4432 wrote to memory of 1496	4432	msedge.exe	128
PID 4432 wrote to memory of 6556	4432	msedge.exe	129
PID 4432 wrote to memory of 6524	4432	msedge.exe	130
PID 4432 wrote to memory of 6556	4432	msedge.exe	129
PID 4432 wrote to memory of 6556	4432	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start "" "https://discord.gg/ronixstudios"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ronixstudios
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffaf635c188,0x7ffaf635c194,0x7ffaf635c1a0
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,5472625923100590546,1928860817304748783,262144 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,3058443167473887890,16998708206250111345,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
      4⤵
      System Time Discovery
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,13072021182986662303,14832897468772772188,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,9190163955193332445,2447167259940569158,2097152 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,7431044172379837056,16479012236076462853,2097152 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,8846722996122404713,5775869730828798145,2097152 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,14287245409211955238,2282143504905934702,2097152 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:9
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,13345650332246931410,4913008771622750606,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5460,i,12481383570030734730,17295434946460510354,2097152 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,10969941571439341964,11623338522988631373,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,257489999466264507,9574455290331898127,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,2194414044472393692,698979521606991135,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,2194414044472393692,698979521606991135,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,6056538647138934838,12383846821514480703,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:12
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,3305640904670956112,5655837496428576090,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      Modifies registry class
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,7314298315536678221,15784888654455391448,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,166211282580197263,7678526987142125238,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,1694820870924297465,2618948991073210597,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:6932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,749867841270697282,4114963440061597037,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,11992518840550061101,7352601131903396692,524288 --field-trial-handle=2456,i,10843095042634619266,5381605547793849306,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
      4⤵
      PID:6940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x328,0x7ffaf635c188,0x7ffaf635c194,0x7ffaf635c1a0
        5⤵
        
        PID:1496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,17628514036517392838,12471456575055961315,262144 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        5⤵
        
        PID:6556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14452317154235012512,3350769836192118522,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,1284584494213643002,17902367130574856569,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
        5⤵
        
        PID:6656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,2812292473466018855,16757711780811067702,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        5⤵
        
        PID:6868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,2812292473466018855,16757711780811067702,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        5⤵
        
        PID:5072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,13984971534118935626,2294473485495244208,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
        5⤵
        
        PID:5264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,10184830781309200411,5881427100502875340,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
        5⤵
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,7341637870462091135,1828572811292772235,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
        5⤵
        
        PID:6420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,4932967841519252927,16627010883996490451,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
        5⤵
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,8125992199883926101,3095532665286831350,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
        5⤵
        
        PID:6824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15466174653315029419,14508526805225325231,524288 --field-trial-handle=2244,i,14899053623632522126,7715920861506933022,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        5⤵
        
        PID:2980
- C:\Users\Admin\AppData\Local\Temp\Ronix.exe
  "C:\Users\Admin\AppData\Local\Temp\Ronix.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3420.3068.4708607345732757111 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView /prefetch:4 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ffae63e5fd8,0x7ffae63e5fe4,0x7ffae63e5ff0
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2572 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3440 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210 /prefetch:1
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4504 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1752,i,3856712455557055510,18036796708440070844,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b60dad8b73575a645877be03b46d2d703686d210
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
    "C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau
    3⤵
    - Executes dropped EXE
    PID:108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fef950a684ea83d2019c2cc668db3faa672ab4f949d5a5c6e70f1e4826b25e0
MD5 e3521c2c06c8c0229dc7caa6b8f76df9
SHA1 9d14ddfce82131f66b788078c2428f87eab34a30
SHA512 767391b1ba2bef511374c9709aced1f967c2bab8616fe473d664d7dc47004799788a5062ad5aab954f63e89463406e7a879e1e73089a378027fe86e819a650e2
TLSH
T111D0A758666ABED2D528207594208701AA29A653312D8245A115440CCC7848196867FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2d70000d3d2164409b093e3fee8d7a3e7c3db56313020c88f846d360e89aebf
MD5 c8abdb09923cd241af782db788f8b607
SHA1 dd21f218f6aaad6b0a656ea6eaea1c1aa35007be
SHA512 a69f82c3c0ce7b71cffb2d07087e80640a65507aee7f31dc0d6ac759e5ce772da776278c16f2340c33fa1a40c1e845c103f8230eb873bcc4aeba7af5f2abe680
TLSH
T163D02368777E7D52CB1A34306410C3037F65F352352DD591D125400CCC75591978E2FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

19a5e02e-5a72-453c-842c-e2226a77677c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19a5e02e-5a72-453c-842c-e2226a77677c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a72baa2769fb232dc3f41add4cd5835f75e48cc8f2c163d02910ad0529e81bdb
MD5 0ad325105fe277071091dc51afe2aa9f
SHA1 1e6fa778ce3ded87bad81ce91f10a3b2a494390d
SHA512 8daa13f35504719a737949231a40280283b576c19bba413f48a7bd823c197a8e01f86082b4ac2577d916f8a4fe37f7443b2890fb7911a325f792afd820b0112c
SSDEEP 96:LPSnEhfg6Vz8XUENv8HFOoPTlanwaNDDq8S7whqhqD91DZFvwp:D8WlIvIDL0wuy8SNMZ2
TLSH
T146D19AF323BA87CACBC12F7D98D029D43A74AB4B465F6D49D444AB311D0ABC613EC068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 cab6fb8fdd084689c5d1c4d6af298ca8ce6768ab5d9861b1c6b3d0c9a5e5357b
MD5 5579aa25371e8c372eec23f7134afc0c
SHA1 44690814feb822121e7817e60034bf82e435b8de
SHA512 8d076e721402e211dc7b4e830f2e593997449b85d04278db66cf799f33d955e6663b6acf3550fc3b1da5334d820b0e89a4ce28d3afd3374413d5cced8a55ff8a
TLSH
T16BE0264825C8C239911478A7837943CCDBD23893A2C83D021B489888A141B41A3CA6E0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 44348d74dc89dc377609700e9f91430c60f1d7827101014c06119ab4940fcad5
MD5 d764f5019c6d80ad7bc56561f2d6c577
SHA1 047c94e8ae0de57fab7c6459c4e14b54f898a7c0
SHA512 ce8bfb0d78dc3b6a8a13407d7dafec91063e331651f76b7757747f2209815cd15aa6e583912a70615ecda5cf97e7435d82e5dcbabb890903bb03d31231dc70b2
SSDEEP 48:uzBmw6QU1Pz60wJOrZjrte3FJu4yeRvXyGg12AxyU4H:6BCxlwAr5M3FJu4yYvXyz1Xx6
TLSH
T1E692B7470E393853EB451B7A272B4879CD7BE19CBFA5CC85312950741EF8252A03A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 982d33c1b9ff26ab07913fbb519710206af08d8ba8a6b5a1152093b12ecda44c
MD5 7385fd825375f6fb54927d7f5afd368b
SHA1 b2a3238ca5c7cf533757da8ff7e1e5d880e19cf9
SHA512 99a3f419522b3e2932d2ad5c6f9425c4ac087b518c5e3e387a11c611a2d3453dc8ba7a6eb3a8be3a4f6d2353807ace99922f5b14b8cf6425989551bea9d61af5
SSDEEP 96:R6oHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/pubbEOVpZf24JkMfXSFR+CFqD:R6vH+bF+UI3iWGVoWN3qL/6VVV63
TLSH
T11B24101F5F243722CDBD913669E744A35C6DF03F8B5366DA686114B4CEE3642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f89e4d9bb9a5a0ddb38e03613c72413542e5a971eca32872e6bcdc78116a407e
MD5 89c9ec1e3d3e4b103c2aa9c27f086fe2
SHA1 8c360254a062fa129e568f95d716346941e2970e
SHA512 ca950987e86102750842c8a48e03f4b2902dc8a7a7bce3bbbd302600d2b2893e40141b9d4c9babc3c0854e292fa2b8e342a287afa51499cac5811915bb083d54
TLSH
T1EA61AEF387E8862DD91156F4AB183E1FCE2C0954431C3C6AC9E4AE1BA3E2471F141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5e61f2bd0304ddcec401de495cc716db7b855dc6792ca1ea4f24f072ea67d486
MD5 81421381d916acffa01c5c9c525c75e5
SHA1 1a525abdcd1b5223cafa49b1e31d36f3151d67cf
SHA512 47b80fd1aed25969b1a390fe0b194940e40410f92cf5a1e7ec46e31eabcfefa10c51ad5649abccab18f0842fc9dc77e196ebd4918d91b5ee0670822b0b9eafec
TLSH
T12621CEF7C3F8557D894182F477142E1BCE2D0914431C3D5AC8D4AB6BA3E14B1E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b87856efedb9d8a4bdc8a81104232eacd6832a71155d0f76f995fc850393424b
MD5 04bbe85be4e1a259dc39880dc327381e
SHA1 8625839c641972ae6400008fc6e002c3760df613
SHA512 555f37dccdc5c716cc948baff263f1b01efa81cde81b990b014bd19db5aeccc18b975c83ace3e91b5e040b857abc6468db8790330339841f1b10a4b1faeee77c
SSDEEP 192:sxRUR0CL/fQssoa/e3mq8xfzoA8plu/g6+WNprL/YD1IGrGIgFJ:sxRUVL/fQssra8x2c/5V/vv
TLSH
T11E42B7066928993B5CC7D21DFA657F53E2F91032A1D41E48BBFC8A1C05EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 01906e0e209d0b5d303f69350a2945ebb9c876baa8e085731f7a2bb3b3373a15
MD5 446f2de40308a32f5a1b33d96cca8127
SHA1 18700bf2d1e66e308846186d5ffc4173c54a7206
SHA512 5640f3f6aac4757e98204e71d783b1c4d58d5dc03134e7090862795033e279be4a1ce2e7696ea62a0b8d290a6dd4c5b1d9a96bde183150ee707f59aadea92997
SSDEEP 192:sxRbRUyM/jK1Ml8wCL/fQsRoa/LZBq8xfzoA8plu/g6+WNprL/eB2D1IGrGIgDBJ:sxRbm8L/fQsRrlBq8x2c/5V/ej3
TLSH
T11C62EA06A63499778CDBD20DFA557F93D6F81563A2941E44AAFCCA1C00E7ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9ee0b93c477bf11718ed61d0d023c0fb6fa32ec8054fc5db320879fea362b8be
MD5 5d035b29ea5ff474e74ca0988f4bbd1d
SHA1 9883e666c62b2ef442372848412d7ee1d14b1f1b
SHA512 6a4c9b2600ba75c158f66431c895ca9886659d4c9f603d10a33936447a3a0c6e0fdcaf25dec98fb340275ac8199fc1fa05d93d7ef16a699eb2d641c1d0a398e1
SSDEEP 768:fLe+ZH7pLuL7CDWgb/fiI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvInsBroZuF:fLe+ZBE7CDWgb/fiIu1jasws6ZuF
TLSH
T1A5C2EB7B640CCA7F4F804A9DA8197E9F6DA802CB9698DD4047FD950C03C7BEE91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0e6c25365ca069f836a08678807418f70cb0ab6306a8173d95e7315cbc9b22ba
MD5 9d0adc9088afbc81bba430629c9db2ed
SHA1 de3d7982fdb893b23a3e4d2e00b43cb7e5e3be24
SHA512 dbcda092b9e78d2f1081fadf133bbad54380c7d4d8341ff884f8c79a4cf05c740bb6c0a1398d7b1aba83f42502b656c86c51b97e38af198c6a1eaa08782f227f
SSDEEP 768:f+4+zH7pLuL7eDWgb/f9I8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7HkIn2Bro7Zr:f+4+zBE7eDWgb/f9Iu1jakHkw267Zr
TLSH
T1E0E2EB7B680CCB7E4F404A9DEC29BD9A6DE801CF9698C95447FA880C03C6AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\9c7529b2-d7b2-44b9-8460-ded63bc24eae\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 6973e6ec9444fd1217bca4a69699f4882361a93a53934ade2180cd3373cf699a
MD5 5ca0e4d0f2f80ea48f9a9635230b3023
SHA1 d9761e5efc28a4779ee3b099868c1ff4ff2eb7f9
SHA512 e117c5116b743bb78b406c31ab39c156929185f03e2fc9f0a14461bfb8139a0eccf4fa9759c3df6f10b082c7a026b4bdc5a14f7b9e26c01050fa7ff0d61f720d
TLSH
T122D0976BE1051040DB660A938531024E07282C880841508CA012625C5876B878225E83
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 1ce89b4963ccd2b3bf9bc5bb416f6bfb94210f832261449a6b01ceac3a74aa4b
MD5 2668280ebaa772a03981b97e20fde07c
SHA1 272f754b5922504e6e16e7124ffb64c8526dc607
SHA512 b27ae809cda008ce0b7ccbe726ca0083759129e0542170c4848f002a4f8b54ffdb1a6e8842391ac9738121534903672eafa64d8207f34dc24e44023a17c21450
TLSH
T1B6D0236FE2081140DFAB4FD38521021F07283CC81055408CB012435C8C76F474306FC3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59b339.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59b339.TMP
Size 138B
SHA256 bd0d4266b57698d3ddce3cab65b6924eeb264be043141979689644c7cf6a5f08
MD5 cdc702bf86a2eca5210b07e23379b14c
SHA1 4012499ee352ce835c4d3dfd44f8887bf65867e6
SHA512 76dd4c4bfdf3d4443fb64be5ba225a84b7b7749e3dbe1c1a3f219c81529ef92fea46d76ed06b64bc6f94b0201c857a23af1314d8d5696366663a91c45f3d2573
TLSH
T1D4C02BB7F00402018F5506D08232121E47053CCC0886808C7043307C1070F172202FD3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 451ebf30dec591a43f124e1903d3b76f8154ef185ac145dd602c6622db70500e
MD5 e27c146cb85f7850c468b74cbb80c3a5
SHA1 eb27c567793a2afafaf1089aa4a7a443d1698831
SHA512 759a174a2166eabc6e8274880c72036519a101a9370f2e9d26ad2e72c1cd875bb04c391637cba04f7be7a425860a84eedf7fca89a26a152717d2d163126b0cea
TLSH
T10CE086501BDAC3BD7016209B0274934CABEA7827D7C83D023F88DE58A592554BBD65F5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 961b26a7f073aa7ae8d14cd2981cf59afa0a3d01f365ecf57872b13d414b2683
MD5 f86c66962477c128ce69ee9cfa4a88ed
SHA1 03df6e89d803bb03b694325de2a33a93261c9a27
SHA512 593fb1526e7d7186d8d7fc1590459691c86609ef6477ddc218c05cdc33d6cda22d5fba5bb38a92cec42ec44518e08e4bccfd60e297aaf9cd15f7ea7dd76e4ff4
TLSH
T112B012943B208B12D8C444B307E18B80774CE0253481D513C84CCF925F057D83F658C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 c5a874747a629d93492fa7bc1cd342a7d47200a4095d17fec603f7b467fa692e
MD5 2cc6b30d4c67506a3d45aabd47e83d33
SHA1 0af0b9cc99247409d5fadf135669bb6b662c6e9b
SHA512 999720ada8ad1c4ad9eb9da9c8659b71238d2b04955b8a7b0e7f4b34be795f72760da2edad5b9e97fb4f4d2bc5607ec6046709bdcfd75ebbef99259dbfea3616
TLSH
T1A4E0D82026CAC37A6185209B8238D34C99E3B816D7C82E21BF1D9584A24624477935F1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 98753cefa8d6a787d7a4b88316f3439c05dc21d6b0bc6c933eede450036c7241
MD5 60d6ef2d6262b5048938d9fb9717d324
SHA1 46bc117828d6d563c8ad7866ac1f13927d138ef0
SHA512 ad1c18378441b0227dc4a4a8c3bb316690d6774b859192fceb4d2cf118f43ee3ce608c966e44f5ad276a2ca3d31171ebe9a61571858dff2f374b2b645d0d8066
TLSH
T134E0267066C8C3799108A09743BCD7DDDAF17D56A3C83E025B0C5448E501608BBE69E0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 037d2dee8dc69edb23cdb05fb77bfd858358c6ed9197fef596f679a39621e21a
MD5 99930c35d6fe3fc6df5136273af88e00
SHA1 d2ca500866effef25f4d762857d38917904f2e38
SHA512 9cd9079bd1026b254ec608788b92b2ba55de9509578157ddf4c13b9ec977fcdcee1d8d53827424af57e9869d4ef3ebd23959329ff4a49f1a697d40defe0932ef
SSDEEP 96:KRrjrsrJr9rrrhrhrdWr1rarQgrlrdK4rcgrLrdcrzrLrirVrhrmHqP2qc8cKWkv:C/oNJ/9d8pGNxbYgf+HPuxdyHqP2qc85
TLSH
T123911155357A07C03A3D290890689C56F6C274A2311AB92F3BF813E55F6BE128EFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c08da0c8-280e-4174-b666-ae905dea923c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c08da0c8-280e-4174-b666-ae905dea923c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c99eb887-c21a-4724-bf41-512fa768011b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c99eb887-c21a-4724-bf41-512fa768011b.tmp
Size 414B
SHA256 1f19d73cb10d5935ed6184fdb4a1c8fc799e1b91dbede9f74e67e2a03faec8ce
MD5 531f361037e1f547aeeabe846ba73b04
SHA1 96fcada93c2891f17abeadae6dd81179064fee7b
SHA512 e6c39e357523ae19dbde44679ae00c3b99a3da65bf2ef65c1aa250764941acc7541f98d16df4d579cdeea449fc7ffabc1e150fb3a2183049b82b1dca9cc41d1c
TLSH
T165E02BAAD8229C371CFD1B692040074BEE50135B2B80C95F7B3C810C9FB167E569296C
MD5 SHA1 SHA512 TLSH

Submit Download

dd6c19bf-9a04-4eb0-be64-d91bd75df8fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd6c19bf-9a04-4eb0-be64-d91bd75df8fb.tmp
Size 15KB
SHA256 8fd7190f3fcc7f0c360d435bcbcae7aa432024d4aee8a2b0cf25c7c544ba520c
MD5 f0c69f353434685f04833e11ad2c4df7
SHA1 c7748bcff0782a5a916df57a04bcad7a2372b768
SHA512 818a147b2fae6e8cf63fb9b69dedcffe2c6f1f54c4ab09d100243fb3aa856654cf993eb23cb9bd7a0f7f4aa0cac5752e312ce54f8c374c62084f562a1cc23b4d
SSDEEP 192:sxRbRUyM/jK1Ml8RCL/fQsDWpVYoaSLZBq8xfzoA8plu/g6+WNYzrL/eB2DX+grY:sxRbmJL/fQsDWvYmlBq8x2c/5C/eBR
TLSH
T15372E806A934597BCCDBD20DFA557FA3D2F91562A2901E44AAFCCA1C01E7ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 afa93364aaa84674c40bf454b609bdf426765a2d1c490959a1560e95694f435e
MD5 4087d85be786959df994c9655ed4bdc1
SHA1 f1e5d7b2e1fad96b2a869389de03a4516bf0c239
SHA512 7976689c9e70b93024b4ebdba413bcdda483a3625b1ff4f89f371cf9cf139a5167af243ed8170a5ce603bd598980d8c32dab3f36ba41fd3815f40755cecd989f
SSDEEP 192:ZPQSQIIIGb2MIMwxYcYiXn0O1lAscl8BDQ2sOE:ZQSQIIIGb2MIMyBvT1WsGl2s
TLSH
T12542955A66053B77C8DF5B361362C6505BD858810072223D32E62D1F8EF3EE78AC52F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 c7b21f65841c218ef001f5fa72e5140771099145bb08a818d53a4d1c487abd60
MD5 0005a22337a81cf0d2d7ed5b8b4b4e84
SHA1 b030e13b675ccdfa6ae17f8a52cd824f601b3b2d
SHA512 bb088908e9cd8cce9b8bc57d89088a4220a5ec6b1583cf0d424e165720407b3cae4b7968cc29804e16271f12a2a5c9266197faa8e5a18f4ccb525381d759b642
TLSH
T1B2E02610BBC8C2AEA05530EB023543CDEBC23C63EAC83D061F08EC48E041600BBC65F1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 a5cf989c89206b40568837626aa14613cc211377b009d40df3cd0dd1b107f1b8
MD5 7b953dca46de75ae3a17c871d696230e
SHA1 8e13c5744654b8284a7482630ac74db70dd52ba9
SHA512 a79410a21f35c21a726f8950482eeb82f0be600e0da2acb5a065c3aae4a88f45aa57268ef997c087c68122ef2e2e79f3fccec6700a3e998a28e76c18642aad15
TLSH
T147212655F330C109E14A867E507F9B361735D8258FBCEC0F51B920346E76B000E4B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 cc2eb8ab34e42e59bb6f713c13de2072c4c8c3879a11be400ed06b88c1b22916
MD5 d330d9d840b8ba2519507d9fdadfc346
SHA1 3d4ba7f18e59bdbaa158bce136cd030a9636f391
SHA512 e71bda170e25a412d004b7ed225a724d4ee7f937565504848287046249724b4a4bacf92fcbbe63d0839c5197010b07f92663b26bc4170e62fa06bc163fb626a9
TLSH
T19DE0DF10BAC9C2AF901160E7037493CDEBE23C93EAC82E021F08AD5CA241641BB8A5F1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b0cdd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b0cdd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1686e53fb7796e0e20d7b7a7b74c4e9c70928b8ba18d3120128314c8cc460b12
MD5 abb5ffed99bbb7a95aee3c3553ee8d37
SHA1 f0569d2131131934a49fe061e80b940dff54f274
SHA512 bd27eb5fbe4abc0a18894efbd1046d7961757672ff8e5e919188b36cbd711b3e0f915e7dade3c3a8006212301eb2db1539b03c807e4969f2b33e6b5b8f1fcc8a
SSDEEP 768:zj+9c3vv7Owifi3MXiaHuVboPzkZLNx9OF8MjSl:W9c3vV0HOawZLNqGP
TLSH
T1B5F2AF71B8619D239D9A928DB24A36D6EFF0116388C01F88DEE86F0D04D75BD1B1BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3d16025f43a81c003910129fa6b4c3284e161224e50c64e22331363c77aee340
MD5 37252b061ad254dba8fe9efd3217b50d
SHA1 62360d5e513c886da182a9f1045e989f9932cff6
SHA512 b0cb398dcfb7aa196c69780d81523079c0d78cf14daeb13a2026c525eee975f0509a86adb530642907ae2840785eeeaed4516bcd7575b30485cdc6eaf7afe885
SSDEEP 768:Orv+4UNbdW3797Owifi3MXiaHuVboPzkZLNx9OF8k:ObsbA37f0HOawZLNqGk
TLSH
T11703AF71B4759D33DDAB9688B24A76837FF0205388C40F88D9D86B0D055B5AE2B0FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6987ec71293a81171bdd0494044b32e5f574b0b446160836e5d4397bef8a4318
MD5 52d3af06d4040494e6274a952253c9d2
SHA1 82c48623625a487eda4f15da04ca65dfd67aa5e4
SHA512 7bb275237aa58823dd66dfe78f4488b4d556dfd2f623132c8745598c22e90732772e80c368216bd263fa9221c2dca7bc66566f76fcdcd28eab9079a2964c0497
SSDEEP 768:lj+9c3gR7Owifi3MXYaHuVboPzkZLNx9OF8U9m0MjSl:Q9c3gjuHOawZLNqiV0P
TLSH
T106138E7DAD618D3F889EB78C720E2AA69EB40233C4B00998DBD45B0DD07256DFB07D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 72bc442468fbc95b30d0282a3443a04f780500b574e26f1932f3ebaac23e67e3
MD5 44aeed70b5e8881debe8a1537bcf23f1
SHA1 22320504a428e2eddb1eaf79da509a874923f112
SHA512 6b8978417136cdd46caa04118d68d58b95f84e61c304fe24dcc13b3080116373ab695f14836b9c0e41307ace88a2538bf58899addcb1f32fec5a2ef89ef8568a
SSDEEP 768:oj+9c3BH7Owifi3+aHuVboPzkZLNx9OWbtR8kXCZij7J:39c3B9vHOawZLNqWtqkSZI
TLSH
T19503AF39AC614C7F8C9F6789720E2A96AEF01133C5841F98DBD86F0D81B75ACA707D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d3d459e45fac5b2ff932860cd0e71b6650f07ddbd282d31d6085870f3aecf54d
MD5 72fa982c36717493b774b213a09e6b81
SHA1 a9831c6ef61418db7f14ae4f0c46238ff7478c67
SHA512 3516e4b7206c1244321253d83b1210db98eccfb2bad8458a4e290702d0d65b9625ea561d881bd5aacbe253e90ad3e323afce2c29790f48cde9c3d14ab2bfdd23
SSDEEP 768:0rv+4UNbdC3jNTwifi38aHuVboPzkZLNx9OZrUik4K:0bsbs3jKdHOawZLNqBUVr
TLSH
T16603B036A8749C37DDE79289B24B7A477FF4211395C00B88C9EC2B4D45AB4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 61KB
SHA256 bbdefea396fd8098a4530161b9e4e60cc137c7aa89c1b711575be925226dd8d1
MD5 6edf75617127502a71273e072e55920e
SHA1 e45189bf9b14186efb15d552c82915e959917bba
SHA512 aeae418f728fbd6e09804fc416a9c3b44c789fe19ef7853787040aa6d7748e0503322ff2e0ae4980cf22116397cebb7468469deb039065bd90193c6cc174c9a5
SSDEEP 768:UFXj+9c3lwgjX7CraHuVboPzkZLNx9Oq1HyJkcoooJ/KfWLyjbtR8kXCZ/j7J:N9c3PnHOawZLNqq1HboMxyvtqkSZB
TLSH
T193536CFA98E3893BC89E5787633D2D459ABCC153B1980588F7C85E0CCDA21BFD706911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 488181b7651e9cba588d485e79c81afef6010c0605e54bacbb858359dabd8e07
MD5 e3d61b78616f214b864aeb5c2a325013
SHA1 1a849f15998eba798808f85d504f54bb802ab670
SHA512 992da714c05de84c86673ea2ff9e62195cd4e3f882edd1631e09af91d950b744f21996dddf3dd3479ce23bafad07c88d2cc254a79dde3b856fc3d6b5c1a74b19
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isQQQtydyzA7dIqUM:TL+j0afDdWec9sJVUObKq7+jy
TLSH
T18192DC2669352033E8DB4B76B89349900EBC025E8AA77855CED44C220E61BC2A2552FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 459f2ea959521d89e717eb51747dc68302bead739405de32ad6caf94e359713b
MD5 3421dd0410e2a32655f64181c43ccb13
SHA1 4be97b22b0906fd0e45e7b5fc27ad0c5081f100d
SHA512 da8f910067acd9dc27146479a9728e20cc89216a0bbca439d187ce3282f638c4c87820f35f44fafd966a4d97d50493bffecc5e4a5840be4ef3d1737593d888bd
SSDEEP 3:MsEllllkEthXllkl2zEelUhl:/M/xT02zNU
TLSH
T1AF44041D7FDC1507D5541C34C011F3500371DC100531574334D504535CC7F400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

e7085c5f-b85d-4c0d-a42b-e60b98eb9893.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e7085c5f-b85d-4c0d-a42b-e60b98eb9893.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Ronix.exe

Path C:\Users\Admin\AppData\Local\Temp\Ronix.exe
Size 15.5MB
SHA256 d2e1afef6561c5806b1d6438a886df3102449a8708cd2f7ea9a8ec27a9065385
MD5 b1cf36c7076e3bb998b309a125fae177
SHA1 c84dfc8557f7eac1a1a2d2e441cebd1fa4233cd1
SHA512 bd416af112268642f3ad9c87b85f202d182cc8203848d6d91f75edcf7492cad311d5bcb671e329eafe9b4089f624365ae7a09114b2440658a53376d20ab7b6be
SSDEEP 98304:nOsiN3uJmrP+tudDWREOgW+fiuWwEZAWTZ1rc/BEtzJyKzrn4U71HOCW17aW6YrP:OTuJm/DWRE+Jd1MKgU7sP1CCP
TLSH
T1F0F6F7247A5B996CD05BC474834B8A634A7530CB0B39B9BF448496382F6EBF46F3835D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir856_1477768448\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8f6dbbbbf25e2aad2a29a48c83781378fee71840ddb502161867d17af67cc843
MD5 16cf3202a3b613227fa459e98ab16268
SHA1 01b6743dbf53421f183f6e996c4e71cb0c92fad3
SHA512 091ef52bbe919c730921fe0ada289f53564e701bd5373b6148780c5a03eb5e71dffe8db189a1f1eabeb1d4e6b6e41f2912213eaece7ffde1a4c083882227dcc5
TLSH
T1C9D012523A01027CC81428331082A94C1554D24B414541005429851D3F440540913842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 be44b0e1af51ea392eb92f8cab660afb6556bc8f3f578bba645dc5f826681565
MD5 a6f7c25a7064ed0f8cba8a80eed89a24
SHA1 f00369d4b37fa2e401409b7bd63fa1f84ea5b908
SHA512 a56e6c8f441ed0a41e018a9086df5e4e372a3fb0a8690a734137abc9e578569e725df33c741508c851790b3b15f3fa8a251da6f930f744b3b01c9f30fd8dd49e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 23eb42ccd22e7356c080e2ab0710902722db538e2959b5e28855fd03dda5739d
MD5 6050e508b7404479999a293eb7f3af3b
SHA1 48963e3a3bcf5c8ab6f0c62fb866a025d18ce365
SHA512 ce298a0ea4f6670f0e117915193ba78763bf0b1fca8f2b8926d3f732b8d648d94e5e1f0350cb8e240b7f6c715fef9cb1bb16a2fa05db497dfe3911a8c11ad3b8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 b0a026cf44fb409e8d169f18f7384f9526db3a54c120b65d0f2bdcef53090b86
MD5 dec34266f58360b4d8ebad588ac258a6
SHA1 3f005646904559676cc5bcb03277a29a3ddef71c
SHA512 68254b976b9f838adbce8d5436d9eb67ebd286b372d3ca9890e0e84d7f9282234a9a3b23f4d55b727b90d8f4d4ca1305850b7c1e7fcf767a4fbda960a5d4c273
TLSH
T1EDF0D8A51BA084D7F73147FC05F77DC171756B86829BBE53419018FE580A3911385D10
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 9ee98f26113a24a16b7386ab433ab7f0935e9d11225177f1938a15868c2840c4
MD5 a91739e897c9c2d9cab13513f711a794
SHA1 cf44445bf3a706cab0dd22307e80f6a15bffc96f
SHA512 5a4247b9cb15fd3c16068051d7dc00f485a818b8a11c4b9725e05117acec97fe571111d3c994a344a588dd094d3e359006d57fb966af52c164b8bb558bdca078
TLSH
T1BC31A0E2C3E8C66D894166F427347917CD2D051992287E37CDDBEBDA6BD20B1E21024F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ac16d.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State~RFe5ac16d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences
Size 6KB
SHA256 d2c46b2c174ac2063aba63b738807ef3fd84f9c65de0a6de32536820aa10c7fc
MD5 8f98d68e590bec3a618ce350e778a2a5
SHA1 4638cbe1d5665e1b476c0f8c542d2911a74f6faa
SHA512 18774368bbc622194b6ae7406ff7893da38790cf3ab18bb40ccff6f4bd190dca7e6bcbd0afcaa793f4f9ae3e3c2ac1a53351d9f87eb32bb08e7ccd317a4d4d23
SSDEEP 96:stG/dJ9qG3Ub9vkdo5h16Z0Js7/x+6MhmuecJkTMFNjejK+gPw+28XM1C7K:st+rqOonJsV+FdkT2jBdw+G6K
TLSH
T16BD1B6025E28687B4CC7E518BB39BA47E2F5607271952E48EFF84A2C04DB6CC231790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences
Size 6KB
SHA256 46b3d66286270c215b8a1121a461f2c645d1c0bf6112790682cf883de59d8437
MD5 01410134694f822af80e7d48c4f8d267
SHA1 6ac6e72f1da92f22665b4af93e628c157cb7125a
SHA512 11f311cdf27074450af7bbc7e3be2984cef2e9fbb7ad7ba41b98e2b5acf6ed4b6ecb8038597b80dd1819143fb83f7967c7fe5c9fa7f721cb8d05735b6414f9bd
SSDEEP 96:stG/dJ973Ub9vkdo5h16Z0Js7/x+6MhmuecJNa1ejejK+gP+28XM1C7K:st+rkOonJsV+FdNaQjBZ+G6K
TLSH
T1C1D1A6025E24687B4CC7E609BB39BA47E2F9643271D52E58EBF8462C05DB6CC230790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59fdde.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences~RFe59fdde.TMP
Size 6KB
SHA256 f7b16ece6eb321394e6f47750246fc5bd4bf048b11e376173b9fd413686f2d52
MD5 96789e7e71e7089455c6d46a56dc5133
SHA1 91d731d6560bac6e61696656acbdfafcc4d458c9
SHA512 1b30f3fb922bc9c20fdf53502f24bfbd4dc01f5568dfecf05a1c5e720bcef8e8ba861710bf68b10cae59d556ab4dd51c04012b1545ede44e3aa62f0549890245
SSDEEP 96:rG/dJ973Ub9vkBdo5h16Z0Js7/x+6MhmuecJNa1ejejK+gP+28XM1C7K:r+rk2onJsV+FdNaQjBZ+G6K
TLSH
T121D194025E24687B4CC6E619BB39BA47E2F9643271D52E58EBF9462C05DB6CC230790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 4KB
SHA256 316212f4bb9a9e17212477ec1fc9d19283fb7909014199e65051e74dc63a9489
MD5 fbd9e6809c85a12a6b73de9d9fa0ce36
SHA1 5da8c39f646294c38980e00dd119431f8d27b5b4
SHA512 4b45b2a0d4f60e07ef41a0d46e86d7a63ff8b8cf1351b6323ab3504c2804ce4ee2a326cf14a2c903ea0b71a316bf8cc3d9d635ac641b651bdc9cc20d2bc3f0cd
SSDEEP 96:HNkGSCzRfabvaN5k8kh/cI9URoDoto+54hBP7r6+cZMZmTfJga:HNBSTbvGieoDUhmP7xup
TLSH
T1C481A767A860A97749F3D9097D8A2F46F7A15067A6823FA4CAEC0F0C01DB3CC2353917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 2KB
SHA256 b4c2b499b2e67b971a11ee4c4b8e082118322e4a96e455e498713f0de8a14cb1
MD5 8a738a1c6478316707b32e0c2dd4bd13
SHA1 b6753aafba38405de0010f6c77491652bc2f0c5c
SHA512 05cb0762f2be9c860fdfb8cea8039f7c26d835057d704fa939ed20b824d67accd16bd9a3db55c19345567aebe5a78503bd0bcbcfd410441b720bf6a09260fd54
TLSH
T1F85196B3AC10A67A85E39A047A4F2F92DE7690A1B7432F60DADD170801DB68C3353C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 3KB
SHA256 398a2ae79cb39d7e0ee923aa8bcdbc27025568f9ca0c848ea19879ac2cd7d3f2
MD5 3e5c430f97778e03f749263738c8f928
SHA1 c43a2abc9cb0211af93be24206a7d1f35bcb7694
SHA512 34eda2d7c246956b50d45fb32272d500c74cebae4ab3b4f87c2ce5c14e137c37a6231d824ae0434714287d39e9519ab0244640ba42911b75d662de27a70a3b9b
TLSH
T1E17198B79960E53B49E39904798A2B46E7A15066F6C23F64DAEC1F0C01DB3CC2353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 15KB
SHA256 d4fbf021f7e5cf8affdf555537519a16fb3fdf283b6816947e220b71a009aef9
MD5 a9aef930ff5cf78e0163384a12e73c91
SHA1 c45bff02d10b0ae361fa86624c4a64e9e44d133f
SHA512 c44da5380e05d5509dfe829de7c1e77fb39b2526390edd9a33ce49303e61e0af4f83994cda812222745e1fc2e23dcd89ca9166881d1915694c429214e4280b36
SSDEEP 384:tsrv+89zHqlDNP9oid6NBST6yRDYmIVYNP:6rv+4UNbdJF0mIONP
TLSH
T12B72AF73E538A73799B29D05B48A6E077B786096A2C30BA4DD991B4C81CB0DD3307E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a629.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State~RFe59a629.TMP
Size 1KB
SHA256 f06f436242469b28a92845056ccbd05e75e0d961e867afb911ebfed6944444e8
MD5 ba9c61ba04b2e06943ccc55bd0731d34
SHA1 3fbab1dbe1a81f933c5c8313e958f3e8d052d0af
SHA512 6919d8b8536b41524d210782af6192f6810d23cb10e1435157d4f407342db3535b2b9d7821f0d2b1b42abe3f0a8f43b6915e619519db386f8b8a6dcfc4c89fc3
TLSH
T1DF3154F3D950667668929546324BAED7AF22506A63420F10A5DD060812EB1CD7777D32
MD5 SHA1 SHA512 TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Loader.exe
Size 223KB
SHA256 c10a44bcfbe74b002301d8d1db86a86514991ffdd653db18403b12c999995314
MD5 c20889e76b60471e064140799e84036a
SHA1 cecc0b65bcc0a985c627859ced705e3e359b8a9d
SHA512 9191bb59338d1abcaf72a6675965113570772d21205a9ecd72fd44497ae0748c83c033e51fe60c2927b0a68aba7311a62c131576b83d8081d4a6f9893804fff6
SSDEEP 3072:IY9zMO9UUu05Lph1QS+usYmaMjBwbO1GB9MdE9M9DF78FffdJeD:IY9wNH0531YYHMjAzM+9sM72
TLSH
T12F248D1A956108F8F7B399BCDA164E22CAB27C954FF4B65F5BB44AF24E135808F2D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix-Module.dll

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Ronix-Module.dll
Size 8.5MB
SHA256 de7287a89bd6d1b10564c032c94c9df33bd884debdb753c04b7233012efb0835
MD5 bf117c333855c1af1a16f3b6d0c94ee7
SHA1 f8c1286f191a1e5a157d8b0eda2c0461d6bad6eb
SHA512 2a7697ec36d5f86fdc62735821e5924f3d02bfcc5fd5c2e809ff695d103aa07a8226cd9323279fe1bbb5471bd2c6f3a007e2937d7cf8f00c51191d1ee3c580d1
SSDEEP 98304:VcuLnZiPcnT2Oruc5ysp1bFcevGFwrhtygT:JbMPiT2Op5ysp1bDeWj
TLSH
T1B4969E76B6A401ACD87BC13CC6579A13E7B2B815133097CF16A4567A1FB3BE41A3E390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\globalTypes.d.luau
Size 788KB
SHA256 29c1d015c1c5bdaaf5ed45f575431fe58140900547f8273d1206642fe84a753b
MD5 deab5fe81aa653c4ad52db6f39fef534
SHA1 ca708a714a7105eddc3c4841bc7785b782926d62
SHA512 613a39b3b166aaafaf40b8c27090af9c1da6c165ef68dfb40e5c89732fa32a2507a631897fbbb4b271f2068b5b06d5fe6b9b35c709a3e70f71f727bae71a5699
SSDEEP 6144:6Ik1ZUqKGQqF2CZIzBXlMvLbtjxQc3zVvD5rWRGya5FY/OSRlXA+APpl+m3TU2AS:0xQc3zVvD5ADnmXsw
TLSH
T16A05450DB604A130594F53F66E9F8884ECB5D2C5612C90F494FCBB461B7F83E26A6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
Size 10.9MB
SHA256 dd16dfc077156df6795a69a4bbb753a0201de9513e6614741d8f1976ca9e8b7a
MD5 16de28c93995a988aaab6eb1c409038e
SHA1 424666825b9a2970a0d7663fbe66f9e885e5215a
SHA512 2ad14445e7cf7df46251d2978757ad2c73a9b0fd143d7fcae8cf9d78af1702c7a991be69330535a8cc664baa85c59ae0b1fdb8bca8354e1fd8f5bbece25ac074
SSDEEP 98304:gJeV6UHLvpVTLS0wRlgF8MkaQW0Dlems/Dt3:gJKXfS0s6QW0xemot
TLSH
T161B67D37629C11D8E0BBD07D8B8B5D93E7B2340903719AEF05A046965E1BEF94F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\version.txt
Size 5B
SHA256 7fbd210ebec11f65a97190ef900795c4b8da3805af3f5a1b8d1d272556b292ca
MD5 7d23ff901039aef6293954d33d23c066
SHA1 528cf42af97409ff91db4e7793a81bc5f447d215
SHA512 d3c38b72c045741693569bdf0ffad7c7f2135a98358bdc26a31ba654110d6347b32797b54e0fa41dc336c532fee9c843fa0ae7fc62162c3658d1ecf947cdffe2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_816209164\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_816209164\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

main.lua

Path \??\c:\Users\Admin\AppData\Roaming\Ronix\scripts\main.lua
Size 25B
SHA256 761d0ba13957885dc4f35ecd2f6fe9ec62138c586766f4f8a5c03706efbff2ab
MD5 01999e84d8107b5efc0d1b93d566ab46
SHA1 19dd9037aae46c141e02d5eee0b656b3411779a8
SHA512 0df3f23b2d14989e034d50ea19aff0369c21c76e061cc65969e9f051892b31e7578ff9adbc37a97dbc1c84088f44bcd47bfea3d8e0d2aeecc3f639514c072a32
MD5 SHA1 SHA512

Submit Download

memory/2032-205-0x00007FFB0A580000-0x00007FFB0A581000-memory.dmp

Download

memory/2348-722-0x0000027F04E80000-0x0000027F04F28000-memory.dmp

Download

memory/2348-173-0x00007FFB0A580000-0x00007FFB0A581000-memory.dmp

Download

memory/4292-2-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-8-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-0-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-1-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-4-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-5-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-6-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-3-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-9-0x00007FF65796C000-0x00007FF65796D000-memory.dmp

Download

memory/4292-27-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-7-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-75-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/4292-10-0x00007FF657420000-0x00007FF658299000-memory.dmp

Download

memory/6364-1365-0x00007FFB0A660000-0x00007FFB0A661000-memory.dmp

Download

memory/6364-1364-0x00007FFB09360000-0x00007FFB09361000-memory.dmp

Download

memory/7120-1487-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download

memory/7120-1491-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download

memory/7120-1495-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download

memory/7120-1493-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download

memory/7120-1496-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download

memory/7120-1494-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download

memory/7120-1492-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download

memory/7120-1485-0x000001F465DA0000-0x000001F465DA1000-memory.dmp

Download