e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634

Resubmissions

12/07/2026, 00:29

260712-atcvhsdy2x9

12/07/2026, 00:27

260712-ar22madx9t9

Analysis

user interaction
yes
max time kernel
343s
max time network
342s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/07/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ronix-Installer (2).exe
Size 5.4MB
Sample260712-atcvhsdy2x
SHA256 e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634
MD5 00e7c93d610841d179eb75683b05f1f7
SHA1 fa51d17b3e8edc2315341f46c72201fa3506b564
SHA512 639892febf0c3a56020f063410dc63bd8ed72528b0796f489aed01fa068f30213d34a42dfad6b683f60a26c80a2ffc05e61c9e50c3a239d953d6ddb1cf3cfcb3
SSDEEP 98304:juRO1zNIfko55jRMmro9B+iHR9lRu1Ux6ONgwKo/lgAVbNbEYL9kA:juW5MjJw+ix9378OaFogA19Jz
TLSH
T1B346336E42C63D91F2918BBA6D7519898C12EE375F46C43EE61F06A6081C35ECF3768C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer (2).exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer (2).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer (2).exe

Executes dropped EXE 2 IoCs

pid	Process
3360	Ronix.exe
5068	lsp.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4284-0-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-1-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-2-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-4-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-3-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-6-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-8-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-5-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-7-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-23-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-61-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida
behavioral2/memory/4284-73-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer (2).exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix.exe

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
33	discord.com
37	discord.com
75	raw.githubusercontent.com
169	discord.com
172	discord.com
29	discord.com
30	discord.com
42	discord.com
43	raw.githubusercontent.com
76	raw.githubusercontent.com
170	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1338080668\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_400744077\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1912114056\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1338080668\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_111299856\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_172450733\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_407531790\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\wallet_donation_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_111299856\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_407531790\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1013205424\_locales\gl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3872	msedge.exe
444	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282898332464739"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{A0455825-DF3F-4EDF-A90B-116705BE5816}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{EF07F857-5F6A-4525-9FA7-FB7A6428E840}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{08E687B5-D581-476E-95BC-FDED093A8362}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4284	Ronix-Installer (2).exe
4284	Ronix-Installer (2).exe
4284	Ronix-Installer (2).exe
4284	Ronix-Installer (2).exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe
3360	Ronix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
1424	msedgewebview2.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3160	msedge.exe
3360	Ronix.exe
3160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3424	4284	Ronix-Installer (2).exe	81
PID 3424 wrote to memory of 3160	3424	cmd.exe	82
PID 3160 wrote to memory of 1860	3160	msedge.exe	83
PID 3160 wrote to memory of 3872	3160	msedge.exe	84
PID 3160 wrote to memory of 5396	3160	msedge.exe	85
PID 3160 wrote to memory of 5396	3160	msedge.exe	85
PID 3160 wrote to memory of 5396	3160	msedge.exe	85
PID 3160 wrote to memory of 5956	3160	msedge.exe	86
PID 3160 wrote to memory of 5956	3160	msedge.exe	86
PID 3160 wrote to memory of 2484	3160	msedge.exe	88
PID 3160 wrote to memory of 2484	3160	msedge.exe	88
PID 3160 wrote to memory of 2484	3160	msedge.exe	88
PID 3160 wrote to memory of 5280	3160	msedge.exe	89
PID 3160 wrote to memory of 5280	3160	msedge.exe	89
PID 3160 wrote to memory of 5280	3160	msedge.exe	89
PID 4284 wrote to memory of 3360	4284	Ronix-Installer (2).exe	91
PID 3360 wrote to memory of 1424	3360	Ronix.exe	92
PID 3160 wrote to memory of 3148	3160	msedge.exe	93
PID 3160 wrote to memory of 3148	3160	msedge.exe	93
PID 3160 wrote to memory of 3148	3160	msedge.exe	93
PID 1424 wrote to memory of 3900	1424	msedgewebview2.exe	94
PID 1424 wrote to memory of 6036	1424	msedgewebview2.exe	95
PID 1424 wrote to memory of 6036	1424	msedgewebview2.exe	95
PID 1424 wrote to memory of 6036	1424	msedgewebview2.exe	95
PID 1424 wrote to memory of 2208	1424	msedgewebview2.exe	96
PID 1424 wrote to memory of 912	1424	msedgewebview2.exe	97
PID 1424 wrote to memory of 912	1424	msedgewebview2.exe	97
PID 1424 wrote to memory of 4396	1424	msedgewebview2.exe	98
PID 1424 wrote to memory of 4396	1424	msedgewebview2.exe	98
PID 1424 wrote to memory of 4396	1424	msedgewebview2.exe	98
PID 3160 wrote to memory of 5256	3160	msedge.exe	99
PID 3160 wrote to memory of 2384	3160	msedge.exe	100
PID 3160 wrote to memory of 2384	3160	msedge.exe	100
PID 3360 wrote to memory of 5068	3360	Ronix.exe	101
PID 3160 wrote to memory of 4936	3160	msedge.exe	103
PID 3160 wrote to memory of 3564	3160	msedge.exe	104
PID 3160 wrote to memory of 4936	3160	msedge.exe	103
PID 3160 wrote to memory of 3564	3160	msedge.exe	104
PID 3160 wrote to memory of 1160	3160	msedge.exe	106
PID 3160 wrote to memory of 2224	3160	msedge.exe	107
PID 2224 wrote to memory of 6124	2224	msedge.exe	108
PID 3160 wrote to memory of 1020	3160	msedge.exe	111
PID 3160 wrote to memory of 2668	3160	msedge.exe	112
PID 3160 wrote to memory of 4360	3160	msedge.exe	113
PID 3160 wrote to memory of 3940	3160	msedge.exe	114
PID 3160 wrote to memory of 3940	3160	msedge.exe	114
PID 3160 wrote to memory of 2560	3160	msedge.exe	115
PID 3160 wrote to memory of 2560	3160	msedge.exe	115
PID 3160 wrote to memory of 3924	3160	msedge.exe	116
PID 3160 wrote to memory of 3924	3160	msedge.exe	116
PID 3160 wrote to memory of 5340	3160	msedge.exe	119
PID 3160 wrote to memory of 5340	3160	msedge.exe	119
PID 1424 wrote to memory of 1676	1424	msedgewebview2.exe	120
PID 1424 wrote to memory of 1676	1424	msedgewebview2.exe	120
PID 3160 wrote to memory of 5064	3160	msedge.exe	121
PID 3160 wrote to memory of 5064	3160	msedge.exe	121
PID 1424 wrote to memory of 1244	1424	msedgewebview2.exe	122
PID 1424 wrote to memory of 1244	1424	msedgewebview2.exe	122
PID 3160 wrote to memory of 4748	3160	msedge.exe	123
PID 3160 wrote to memory of 4748	3160	msedge.exe	123
PID 1424 wrote to memory of 2612	1424	msedgewebview2.exe	124
PID 1424 wrote to memory of 2612	1424	msedgewebview2.exe	124
PID 3160 wrote to memory of 1436	3160	msedge.exe	125
PID 1424 wrote to memory of 800	1424	msedgewebview2.exe	126

C:\Users\Admin\AppData\Local\Temp\Ronix-Installer (2).exe
"C:\Users\Admin\AppData\Local\Temp\Ronix-Installer (2).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start "" "https://discord.gg/ronixstudios"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ronixstudios
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fffeabfc188,0x7fffeabfc194,0x7fffeabfc1a0
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,4064028222269876159,2649044252074532761,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
      4⤵
      System Time Discovery
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15108832645741174026,3144388375569523423,262144 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,13648670598490321872,13548839344699935920,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,14950973370275014399,15947419223483525219,2097152 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,162837758055194441,5882916329337820998,2097152 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,14250324926291800633,6301020831568946603,2097152 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,16653272845638221044,16762301217044887649,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      Modifies registry class
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,12728394287542387664,5442664666137118713,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:12
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,13231247002994167877,7472644229567669697,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,1083047163317673995,17318772049132797831,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4183333189167716706,7587021675231117305,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4183333189167716706,7587021675231117305,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,9599563410983480893,15490250252938343285,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,13231726742883516640,12938091340857329109,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,236170377205690894,14016360796175614112,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,4739581514637399647,1842888543613218437,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,441972989297020248,2561309266301371348,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,13165446191605692639,6302897779574104288,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,9413374186743841278,4228847395072972233,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15735103942140822346,940542622490591986,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,2125601050929181987,8982291524939796377,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,10831456606157496728,9399024261252145926,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,9589975645532946937,7780041981520431654,262144 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:10
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,15292327682565565791,13349071925298008519,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,15382856802476945725,9155333773050403414,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,7648311947052927233,8174297651818216160,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,2450771728646028796,9722329738107771949,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,127309675162296575,8262259920061443895,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,8992500574359560354,13369803832145574036,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
      4⤵
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6420,i,8102440477142132285,7192607155903369428,2097152 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,2404270224029998083,11283080145986411511,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,10007417621122872958,18138021712947863785,524288 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6204,i,3924453255262006867,2438001882833014254,2097152 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6312,i,5125455174003132051,9701403234013130727,2097152 --field-trial-handle=2000,i,13861493573729058528,565083256912256230,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:3216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fffeabfc188,0x7fffeabfc194,0x7fffeabfc1a0
        5⤵
        
        PID:2428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,3271749427509275020,12855707528352384957,262144 --field-trial-handle=2236,i,14820691434083722397,17438816165729930047,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
        5⤵
        
        PID:732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,12969190117729642787,2164035997648853139,524288 --field-trial-handle=2236,i,14820691434083722397,17438816165729930047,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,1510431627893261491,5624904825641103906,524288 --field-trial-handle=2236,i,14820691434083722397,17438816165729930047,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
        5⤵
        
        PID:4072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,1864010181348664839,3439669040602210288,524288 --field-trial-handle=2236,i,14820691434083722397,17438816165729930047,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
        5⤵
        
        PID:4612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,1864010181348664839,3439669040602210288,524288 --field-trial-handle=2236,i,14820691434083722397,17438816165729930047,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
        5⤵
        
        PID:4040
- C:\Users\Admin\AppData\Local\Temp\Ronix.exe
  "C:\Users\Admin\AppData\Local\Temp\Ronix.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3360.2148.15128836403943163136
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7fffc708b078,0x7fffc708b084,0x7fffc708b090
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1652,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:2
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1960,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2140,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3524,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4428,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4568,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3768,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4664,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:10
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=776,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4588,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4620,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4616,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView" --webview-exe-name=Ronix.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4584,i,18065400092892971564,8538874859623546169,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
      4⤵
      PID:1588
- - C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
    "C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe" lsp
    3⤵
    - Executes dropped EXE
    PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 052d068556442d6dea8027b3ea9b47cbc780dff0564ddbb1ced08f56a40a0997
MD5 34d0dc7e7b2fa41a04072d49fac21c96
SHA1 a7995a76b896945df070a3a9690eb6d786b10618
SHA512 12201cd368c293b2ffe1d8eac67c0ddab3c033a9b459916114d76d544c0fd85614686a3a177447eb910a0ae36f9ac30c24aed3f464494e33728d23a963d718f6
TLSH
T178D0236476397CD3C238357691A08703B25555732657D1416140C40C9D7DCC3EBD59D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6fe750f187e5ba2a8eacb273b0140d9b6039e9da765636f910f1d6297f2153b5
MD5 e42ef5f8491168e73c2f436db811b365
SHA1 631fab608256f4a6c1d16f90e50947665f36ce04
SHA512 a3df0bd2c84f6cbfa528552213bce857c5adb31ec0eee7a9d02bba7985b8270a835d62cb4a3630d4ed98395b0bf39568bc526a4788363cb1c4f0e51cf3794c74
TLSH
T165D0237477393C43C71739317190C70373D257616916E4515050C00C5D798D2DBCD0C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

833ee6a3-daad-4379-8f13-082f503c59b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\833ee6a3-daad-4379-8f13-082f503c59b4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b83a8a56d95cf78e78800fdaae4aadd4c289ef567ee5c21bd2e776264d91bae8
MD5 82761500b767cc40c45fc43ca5b0ea23
SHA1 5b852ca46ab38f1ddd340841fe75aa16c648e502
SHA512 40eaa6051c725d63e6b9cd23c4698bdffffd803645167a5f7cb43afe8f92b24bbc093a5ce4827cd27ff0ae6d8c36402bacdebafb481221edafa9151a20705a03
TLSH
T1DFE07DA915CEC39E935676CB4168570C92C1374BE7C8AF4E1744CD983003880E3F65BB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 aa4403c4c449772be1271d7a77d122e595a27b95cbc9e963766d6df8451039f0
MD5 60d7773273c215366b4177ebc89964ff
SHA1 c28f88e420f71aacf1b8b634d9a8a3ff1460f32d
SHA512 2f26b0dae8e5303a60389e96d7a7cab45b3bd2ee8895a3f4f528feb130ee3fd696f001d3f1583a5a040fa5271de8f1173b3228e7483279b3eb4b7aa95affda0d
TLSH
T1CCE0209518C9C32DD54077C78394634CC2C3374BD6C4EF456F888CD970015C0A796574
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1a63f7bd1295d970e60b129b116f216efc772db33e608bf641b7bcb9c971867c
MD5 65d8380124248d71cc0baa49d2fc2107
SHA1 cd53f96805cf0ae821e8f9e8f7dcc4429f9e0766
SHA512 4d76605ed6cb13647e17413cb6bda58d4cebce72a7a214b1ef8d1d51669cfa977754018ead3e193def87fa08092881f70afb54ed49347e37b8f218259bbcbf3c
TLSH
T18EE023AAC821DC2714FD4B19A0554645E65013576740845F3B3D860C4FF072A018541C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 503c0c0bc4b918dfc12aa7a5eac4d38c50cced134d0bb0a4b43e18e7bec7bf6d
MD5 ae3b434843edb468509822427b91aaf8
SHA1 099a942d0cab6f7bdd3afe72b22619d87ceec3bb
SHA512 08c390f1fd6b5a6c3feb9a0236829f00b99d11ae486a348c9d8a39c2936e7cf24655125740c84c49b7301d768b0bd2971f93cb7b70385d4f06ccee9b445424db
SSDEEP 192:w6UpOMoi8Mwm+rZ9uBF8EV1oeWJ0VE5yj+cxgIDayGWt4VQK2kUo0gS0AFHIc1rK:f41cJ0VEdblRBCgcBIK1u
TLSH
T18432664B476860C3EB3C0CB160E9FA2739F1C49C84531E963CE4A9B9588EF86D77E610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 73e86897fd032ddee4b1308cf4575ba8393bc2cb8e9d3b562d6da497bc4cacc4
MD5 ccd8541d1186cfa01f7d9134261ac174
SHA1 e57db45d759364b349ac2e07f8b80e3cf6bbeb65
SHA512 edf0566942f054498738e4393b85cffe0eeca2fe321a888f1bcc857ecb77b10c4d6f940e0add575c76eccd869e98692960329eef81c6b433e5537cec99d1098e
SSDEEP 192:iQAr4yj70i85iH4g0grFEVcoru9lIH9EF7NeWGvIJIdITdXUfnmeVm0zgYHOOz3O:XMmWlJgITdXj27O
TLSH
T10FF1398B036834D3D73C08B171DA363732F198AC84A31E1A79E1B9754885F9ADB3E615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58cafc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cafc.TMP
Size 3KB
SHA256 15b827d843dafd3dd823e05e3e0dd42b4b9678dab4b150583610d095062d9838
MD5 dbec30060a6246a955b689d91544dc5b
SHA1 d03ff1d22db2161edd58314975f9a01f0847aa9f
SHA512 55666b2549e4d7401c703f4695717e4fafb689ff8053a647ac96b792f2bdc55cb3c57ea51d1f33706bfc8d1bc28824d6961e0a2999586d79401cbdc6da59b2a5
TLSH
T1AD61D40106727863E32C1CF2B2EE322372B280E859570E6901F474BAD188793DF3D728
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 60638c64a2409dbcfa5bd03e8c25774d951f5074e057ff5e0a599b067419f67e
MD5 aac035f1983848532f3436c3efcd3eed
SHA1 4f8df0f77a3250f1d1e8e1e474c0bb1d9cb44266
SHA512 c5c9ee15194447fea228744dd5fecf35e1c328a90fe7240d4602e097526ffdccb4a7bc02547909621cb315435aca6e8b0f4d1f493a55a38f86cbe979b86a42e7
SSDEEP 192:D1Q6NHFZIuaij6VD1rr/AmTNGj4475w2McatctHWEvCx:D1Q6NHFZIuaiGVD1rr/AmTNGE475w2MV
TLSH
T1EFD1ACF7C3E5862DD91192F4AA186E1BCE1C0855436C3D5AC9E4AF4BA3F2471E181B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 61ab2495e2b6d4a872a5cb2566f50c113f2ce6fd258204f1f33cf31995e1d48b
MD5 c67939d6ac0dc755afc36b7a1be90d33
SHA1 45901ce5824853a5c442c12f99810251db35cdad
SHA512 f6bcb2dadf195f3c86ea1c25715dca77b9b62833162de41300d93f2429e6a46b1de41659c30aafdbcbb9551fd4985e4b05996b896a239c378b45f56d1888e226
TLSH
T15871ACF387E8862DD91152F4AA187E1FCE2D0954432C3D6EC8E4AE5B93E2571F181A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7ea4dc9da1ee500eac11df7bc5e6d2f2f7e2a2f5982d0980ddedbec24a9c533e
MD5 924b11c575b2f8b193b0ec30d4d25bff
SHA1 f3e2de36054a18b1db8fba410993503c70c470b6
SHA512 8ed748f3d96bf6d474b2c77d4f5025d6ea10d2985e966eb4c5f9a9b27a521609d1d3ffa5e98af16b8b3a509b35cce1e78724c2545eb7ba9a918623ee92318614
TLSH
T10C61AFF383E4862DD91156F4AA147E1BCE2D0954432C3D6AC8E4AF1B93E3571F181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c0378666542ca67dbebf9c14c74ae29de5b1d9f331ed4315fba8278b067a4fa9
MD5 1181accb0e051b4dc5f837116f0b2a6b
SHA1 85c66feb3b6cb670dfea7456727fdaf5c1918168
SHA512 fdc4f1bc025c474119354d13d9c93cf93c55575c28260068facf363c3566109e511a64eb76f1ffe4ae234562de60f542001884b8a289863bca4b676f54d4bf20
TLSH
T1D331BEA38B7EF427502D58BF0E49BC092DBAF53541A154F5CBAA837CB0515FB0B16427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 32KB
SHA256 88cda3b39ddc364eadc3291b8fbdbf5335720aa41f55745fb5d902db1f748edf
MD5 90f6838efee8ee982511f9c934633531
SHA1 75b36be61636ccb4816ca33bcc72b0ce973e3f30
SHA512 951ebbf27af278bf9d907f18cae2c75c10df691d62fb1ea3c4b8769a35368c18679b545671fce09f14eaccafa423ad34a57132758f941758cbefc31698baff84
SSDEEP 384:sxZ5n1mqt0/fOs+366s8qMpRiYnazAW8pZS15posJWeT+k0Ly8r4Mq/bZV/5lHxF:sx1pt0/fw34Mnc7WeT+k0Hq/bD5h
TLSH
T1B2E20A05A924C87B9FC39D18B43D7E739AAC50525285CEDA56ECCE0C00AE5FD6B0783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 63f25d02b9313a72c834e6b1e7c3138a3802e32b94d4614b70c9d8c2e9aff6d9
MD5 deacd1de6fe4a158c348c0f7b479391c
SHA1 f01159a74dd6e9141484b101c3e0ecad9f7ff309
SHA512 4a6a67c7af249dc89d8a374e1622feb4aef354473d4f3151f6eccfe2111773647c252cc1364d5d833e80b8d4624a903617864fc5b1126e459bf9208cf4f99e88
SSDEEP 192:sxZARpyMqZjK1Ml8UQpc0/fOs+zE0CXUyynDezodpx6q/W6+WNz2U/Y0dObEqmFF:sxZAmq+0/fOs+40Ly8FIq/bZ/5UHcMK
TLSH
T14B72F916AA345D778CDBD219F6457F93D3F9112292904E44AAFC8F0C04E6AED221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 93030d28efc0795d02fb96597c7a9e4fbf79ce912161aef95d274f0358b6fefa
MD5 4f89013b16c2670116c1e0144bdc9953
SHA1 a505adb36bbdb058309c3e70cf3a7c8442ea2f4a
SHA512 7a58e7bb501d06a4adae1e695240af677eea570ba7f0f77076e56399900205148c580d1c3d162e755e8496e835e6ad2f5818d5ee796b87379c2aa17e71e25377
SSDEEP 192:sxZARpyMqZjK1Ml8Mc0/fOs+DxE0CXUyynDezodpx6q/W6+WNz2U/Y0dzbEsmFI4:sxZAm00/fOs+D60Ly8FIq/bZ/5BVcd7
TLSH
T13772E816AA345D778CDBD209F6457B93D3F9152292904E44AAFC8F0C04E6AED221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 36KB
SHA256 7ba54ad3c07a1d1de0594e5cc1c52bbd0c45f328a48ed16d84c7e7c6a68ae40a
MD5 a1707f5dfe872ac4edfb5461c7c69370
SHA1 ee005351c96fb15a5d5384441cacea5a3a707ac4
SHA512 49457b849aa8237aab2c89b01589681474aa04727ef1241b1fdd26af7970110c5cf8aeeee753376b2084b8458fd0f277092c2b04a73e5a0f86c6484886290c75
SSDEEP 768:sxypLm10/f7Y534Mnc7WeT+k0kq/bk5we:jpLm1UY5oMmWd3k5we
TLSH
T1FEF209069524C87B9FC39D18B83D7E739AAC50525685CED95AECCE0C00AE1FD6B0787B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4f72e5f9837015a5fc8717763536b08b6221e43f23440c7b72bf43fd51fa0c7b
MD5 f885fc3371e6bab300dc3ff58ef6e53f
SHA1 f7b38ac4eb68f67fce65cf42a7171bf6b9aeba71
SHA512 d79c22629ccb25da8906771d28bece8ffb6edc133631b1275c1b783b707ec64f731483c0c1f9baeae03413540ca2d75c141f510fc7a412e925842069b6724698
SSDEEP 192:sxZURpyMqZjK1Ml8Mc0/fOs8UDxE0CXUyynDozodpx6q/W6+WNz2U/Y0doWmFIgv:sxZUm00/fOs8UD60Ly8bIq/bZ/5Xcj7
TLSH
T1B662E816AA3859778CDBD219FA457F53D3F9156292904E44AAFCCF0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 8c86681ea318ba7f8309bdb929e89eb8522b2965d5ea49a9d14e6445381d54b9
MD5 e70cfd65e2f19ced1e4bc0b21570efb7
SHA1 bf60de8ae51f4cc9bb9040b2f26390655e3c94ae
SHA512 4beebebff2ff58883dcc4f70e804b0837ae5706d1d8712b726b1f60a022fca56f42aefe6af97fda1f320f868540141f0cd90225241629d76a343b0dc145cf52f
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQg78F1+UoAYDCx9Tuqh0VfUC9xbog/OV363pQLlH:ciWKy8Eq2ADEn5dWRm5rQg7u1jaK63pI
TLSH
T11A030B3B680CCB7E4F805E9CED266F9A6EE8018B6698895447FA480C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 0a5dbf9c9ed9eb4dabb0ee4441387b7468fd9de739c02cbf934743d94d3b8d3f
MD5 2d1f927019f26fc2f7a3195a8b79bede
SHA1 77de0bcba64b864e9bc77a2dbbc358e84a4c6285
SHA512 2cdb230e1fd5fc6ce57c0dc7890439e9a4a0af6b78abd4fe9bc2f0e6ed761322598399a8370f0a57a7283ada130e09c1380046bffc31d1950915f27af00d7a52
SSDEEP 768:ciWKy8Eq2VF7pLuL7ydWRm5rQg78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3h3pQLln:ciWKy8Eq2VTE7ydWRm5rQg7u1jaKh3pY
TLSH
T182030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 83da5d23f00628f7c1656512bd3fa9e857f0752cb199c04304c196dfd5fa59ab
MD5 9c6f39bed2c86d93b5ca440cefcc487a
SHA1 64807f0ca94526a6ec4f72f6ecbd17fb07dbe34d
SHA512 912fcbe1e1ccc24f923b2d99900a0382e8f8a9af9ff02bb985da7aec2dd85dcd5035455f3f24d0de3c5cdac3a324da2dee7d8d3192595edc5195c9accc45fe85
TLSH
T1CD51B80F4E826A9BC87C11BA25FB19D13B396CDE59484F0720FC9975ACCB2382D4A754
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 5ad63ddb7c040d3c7020e5821e665a6dfd025c3b31c926a8bade3cb5f922ddec
MD5 a8cc57d0de94e64cc96a76c12246dae5
SHA1 63e50a82690c3104b5921988882ef77fdb7a7d83
SHA512 e2a9e604c75446ef9dd0c72fc9f0f7f2f5787cfb889c10830b80cda59decd40ce873c7dd68e23adbd51c858fa3510fa2f4e9217190fc41fe76c5c169865dd292
TLSH
T1FF51A34E0F428E6AE8A802BA15F34490333488CE4A249A1368FC53366D5736E1A4F6E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce007.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index~RFe5ce007.TMP
Size 2KB
SHA256 f2d7b61ddc402fbbb05c1862694103f6686378693a4a6509d21fd81eab70a4c1
MD5 fa1828464c4343329466d06377eae4eb
SHA1 bdc43e37fbd9d08d8096777a18dd36d101c5b499
SHA512 abe3ab6623e13db9b7968a1a6d3168c8b30877aa3136ea7dd7afeb12aab9c7c6085ec0bc449775e58c9531b0cb9f0c4b0fac10de967ef90d7e417236e752d9e9
TLSH
T1D751849E5D824639E8D8417709E3A8B437391900C619BF5374FC9632AC9379E3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 23a3fbfd6c441c0abcd52943fd3d61fcb913a24caa517622f45068bad058991f
MD5 8d4100b02a1dc0876035a53d7b59c2cc
SHA1 069b4f63d6e355aed76c81297e5ae1a2deabb661
SHA512 f9b183660ec697adb519a115b12384a4271d6519162ee3547ec2a93b6351d3ae982d77c58d2e0aa514eeb3c7c1db31f8dedc566edadfb194a24d1358e7f11138
TLSH
T1F4A0021013941017C81251B1199213521303CF101600970744A14099CE535D04E6600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 5baf47727230ada0b73c3bad61389b555cc8e919951148036bcfaafbcc1849aa
MD5 1a9287b0369728ef5ad8b04ff306a337
SHA1 0ba52344f9c75a64030cddf68a675907fc3f9918
SHA512 89bf686d5bf8945c8195f27139577d9c6a7e6ad9fb17c4527bcdb6c9f504dfc41d1383368f490f621b69e2d8fadb6d4228188c87c4d71672b80287f04c814d7f
TLSH
T15EA0025003A02004C55396F33766524153C059245162221DC1A322CCC894581854161C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d779375d-0bf9-4283-b741-b66292b97c9f\index-dir\the-real-index
Size 72B
SHA256 8936618fce9e7a7032ec78f26500aeb24493a817a6975cfdc63c531db30ac71d
MD5 cf46996372b1724e683a7ff181e2d1a5
SHA1 f93973d807880ffdb77944cd89bc753b9f340857
SHA512 64edfb276be28fb8e2ec856ce84592756cc8ace9fa57e1288b2ed6a406d84a5a7fc7626da8f1737262644a419044468f5fe0f59acaeb5fc4b6e488890d493d0a
TLSH
T187A0022512405242DC0067F0D01782E277D2C92C45444B0A53D6B86CCC54695C945044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d3674.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d779375d-0bf9-4283-b741-b66292b97c9f\index-dir\the-real-index~RFe5d3674.TMP
Size 48B
SHA256 507ab98fc1698df43dd5133722a75e6490b208b7b697046449c9a742705ba57d
MD5 e9b5e2ad01954ba20969a3f8d927a66f
SHA1 467223f1d29fdb54b04bde4a0b70c094734e42f5
SHA512 667f9771bf1830c8465a0f46b9446caf3605cad5a97b22ee5262ed331bf89284b39977aacc446297c869bb5d378ef5fc04c6263e7361b85e13732a3077a53a34
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\index-dir\the-real-index
Size 72B
SHA256 6ca73487fcdd474bb2172c86a368b3c147b4a4fc51c9f4a7fda5bafcc1db4f12
MD5 e06650d4ee2063ccb442306c6dea6f78
SHA1 1eb558d9976c6708f37bc551b3f9d6ff88688e06
SHA512 1c83d6c2e78d3c3d6fd9e313415f25464c779324d019fa93373c77ecbd60739e10e064df65a153fc3b57d427779d3ef83c4ab6031076b36c1205b4a997d9817c
TLSH
T179A0026801782040D555E9B45312625833845E19D043430ED0D046D688D15B9A941E95
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 326079582748890c4f31cb6e184674a88bb35fc92a686efdc24c6c3cf14452f8
MD5 a184108106d39e6d8a36373a1ccb9bae
SHA1 38ac2e91c241ad2df1120d93f1d51f1d04924672
SHA512 bb693f7bf15c1acd0d9307bfb451cc9d6ac48e5ed4d9811014b819a1ba3c8e828a04c217f2359142dbd9f192aadd33125828cc77a58a8e52408a1a62b84a24fb
TLSH
T1B3F02E773EF71854B86F93D6547250A44010BC99E455AD4E142A75E6A07135E140DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 ff8648396d0346081bbfb3b56aaf11999bbfbff8c9610a799797339562c2b131
MD5 23cb0c359228f7fe701af2246f6068b6
SHA1 a041152d4b1d7297d7c7b6a0eddf9eac18bda45f
SHA512 873b7deac66d880501f096a3ac4b630441a535014129f0a1fe55ece4cc444c195991f50ff22d3a006992c9af76504fbc15fd90bc0bc560e3414fe96c81cdeb3a
TLSH
T132F05CF73EF72858F86FD3EA64B250A40010B898E4A5FD4E542AB2E7A1B135E141DC72
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\2c7b6e98-d234-4a27-b37d-f05fb3d87af6\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 b494f5353519d37465c8b396f01df082ed01858817e36b7292a8674143f55c8f
MD5 65999fd61bcd0c8c2fbdf3ecd8e000fb
SHA1 b6dafc2dc746a42e233b65c9dbb30033939531f0
SHA512 1483b337dfa04983ed04e793e17836b59be6a2bbe5a8e7c6a5eeffbdd32643b1cb67308c74fb03cb902ba230c4d323711f50806c05f9a72c6054e75211344687
TLSH
T14AD02357E1554651E7EB468277B355DD472E7C853884D0CC9903B82E58747C39321F62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 7a1665f7af5806a1bb42572f819ab5572fab3c27685bf5e7abd110bba0d50248
MD5 650b5886853192a1d10ee494b319502f
SHA1 5f6bfd8774363c62776dda8500eb7f7014f6096d
SHA512 8161004111bc65270d0a5825af48be47c375a1f7386419c607f5f08044afbe7995ea7ace23cb95f9df2d0f83e261f2e5e8e74a67f0d80e7b81b522fb46aa1241
TLSH
T192D02357F1988751E6EF8B8137A355AD471E7C853898D0CC6902892E8C547D35311F62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe584c56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe584c56.TMP
Size 138B
SHA256 7f0ed960f78c41d3f8a2036c867f21d7cd72622e1c22a6c5c54759d6a9ea9a39
MD5 c89f091b1684cbb2ee4f2f2a9e002d18
SHA1 7c5c694b4bc6dee194afff12415aad481cd85e9f
SHA512 3c7885a48c0f15bb7ccf7f6dfd2db8b1b158fd565301d19b243999acd20716d375fa98f5b84d12b6da737da336b240615a470471d83cf21a414810d8a544cd74
TLSH
T1FFC02BF7A1480300C75902414373548C470D2CCC3D81D44C711374592430E132101EE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 af4b32a2a6e3a322ff74a9a23887ea13a1d26b4c057cb49ef8686f4c26f773a2
MD5 370d58b7f111cbdac7ab4796293a98c4
SHA1 fc34fc4ef71c1f6eb870b917d5face84e049bf0a
SHA512 da84b0fbd560220cee6803fccaa1b1e29c097515b7c2c3c51fb221bae10559d198b870d2daa2170bf141873fe940062b3eff5e507958c072de198a43b519698a
TLSH
T195A002F2C9658482C00146B4B57B465453D19CBC8638232541FC00548D6F0814992504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d3664.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d3664.TMP
Size 72B
SHA256 09ff5d0055e5712b3e52fb11cd532abec86d8937ef4357cc255e448402095bb9
MD5 602d6288bb7aa3e6818aa934186bc32e
SHA1 3a8642bc6070dad06c5425d0edd41d47dfd27690
SHA512 42f3d77daa1e8806fc35a4f46cbb12449e1d41dad3f78c87207713bf717b2752a22ccf0a2fc58f43951e086a827bbcf825fbda743fd010b7091314104d5077ea
TLSH
T159A00223925A2549C80045B21447377113918B690604168248A0D0E8FDD24D059BA119
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 f11247d33d83669a7c71f0d157ba5cec9b8ce275ae8160c5ccf1712684b535d0
MD5 db0d27ad43267514334b6cff45e9fe6e
SHA1 6585eaa4d862b33318ed57d50d6563ca4651707c
SHA512 b9d15bdacf1dd7bd5fd35e0a1e6a0d57a2da6ed17a06f7ac88ec95f8b8e61b5d371f1ee3246b9d2753a2d065c3c9d1fc67227b41db494051ffa9588169a1e46a
TLSH
T13BE026F455CEC639934872C74374A70CC2F1BA4B93C9FFC257885884F601510B3BA990
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 4083a2167abdb120045ac1432d80bd62cc729ca1bfaadc61732d918a3efd98f5
MD5 fd0a05a1e05d3f237629e4b43875b814
SHA1 54ec959d4f1d2f48e26ccfbb1a0d64e5a719a69e
SHA512 cb61b4f0abef60684a274df1f2b73cbf4aa19b944944ffd28388ebf1d5e690b8daa692272e6cccd8311650892018a4b19cb610d6de48e32ed60b596d597d40f9
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Ofd3x:AFBHhTofhno2mBeaOfd3x
TLSH
T1FBC28D57717B12023C3E291CA6A19B770E8272A33558A57F7BB800B64E67E215DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet_donation_driver.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\wallet_donation_driver.js
Size 1KB
SHA256 39a63d56be4f1ca950310f385e8a42f7bc2dcc0e49fefff306176182bfa4f0e5
MD5 03abcce3f9828372d9876aa2e6fcdbb0
SHA1 cf5834e1af5f7143e62a29ae0f7ede79178b3574
SHA512 ef9b7decb4cfee3961006ea5c77299a48fe6a667475772f2a78e93bd4f691dc4700f8008138c574898fdcd8d717d84b8b201527ddb5a61346e05d362aeb15701
TLSH
T1ED217BFDF3806F9C1692021A35BAF5B625200C74B2823DE462D408D16F26D0779773BB
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9aa53790c59033e582ad8089a26df68d4e73c4d3d317f57b3942a97257227a18
MD5 a00bcd4af4b849fc137eaf81fb2ae394
SHA1 034fcdf3f18d62f637771f5a8e49c3f1a7ac29a9
SHA512 17bab1499c5a799546246d9a76f7921347fc263eb34d30b033f2e057d02968d7949ce50efec9b2257ecbc7c9794a47bfd90848d75edd4e73cdf5a30e92994a98
SSDEEP 384:nxiFKtNn/s3n9SO38NLx8TUNTUlIRXITBpi62jkpft+oUytO65ym5FNfXAOObjIQ:YFKj+9p3QxwgZ6vOox065ZXA29M/
TLSH
T160F2A2F298D78A76D8AE4B9BA37D2D1699FCC16375884984F7C45E0CCC861BFC306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e75b5b1b22925372491ffbb6c3e6b06a2b2889a4626ad205ae8d8737718a33a9
MD5 f260b38fc629c7b4b587e59f9cc3e406
SHA1 d48a05bb5337d91d51b35db7ea5e468c31d8ad45
SHA512 be068af1f5d5ab575215ca835e8e3b45e0ec7132663f1d894efdf26b3b3c138926948e1c147b2898eb204fe20844cd4028a872973776bdcad4ab19b1a40297ed
SSDEEP 768:YFyj+9bQxwgp6vOox065ZXNSneStVFf48grcE29M/:E9bQ/65aeSfFgTrcE2+/
TLSH
T174136FF194D78DB6D49D8BCB536DAD01A9B8C173B1584988B7E46D2CEC8B4BFC302821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 454137381212200e131588ed734df67df0a0ab1ba0ccf7fcb830d77cfe23f416
MD5 6f44774f1188e72eaa7f2218f972bd01
SHA1 3409350228e0acd1934c15e0ee86dbe762fb888e
SHA512 f0332271a0429b9e2061fe4fbf4acac33aa2e53e5fb55d5ac0a4dd0a4844b67e669539ff9f4105ada8738c154e8b6e4fe11faaf5335a6498b0ce96c846db4548
SSDEEP 384:nxiF8tNn/s3n9SO38Ni8TUNTUlIRXLye4xjGfbwoUytO65ym5FNfsAOObjI9G6wr:YF8j+9p39wgglox065ZsA29M/
TLSH
T167D23936EC54CEB7ECE74FD9B74A3A56EEE001A386885AC8DAD95E0C00C719D4707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7bba3a150f133824a0e1deacb82244bd0c1489d108bea83e2666bbf79175897e
MD5 57636251abfb0b7976e235b543700369
SHA1 158536325272d234932acb4bfab10e722229d856
SHA512 f1ab7cb36b73fa0faed2c09ae96ea41d6bfbc299d13604160710acaa15dac586e279128edab011f874fdc0b52b597ee5d01711475aea4a43ec5b3f40718a716b
SSDEEP 384:n5siF9CcmyWCs38Ng8TUNTUlIxBydvSobajGfbwoUytO65ym5suhkP+lFYS/jfHA:dFccps3HwgHqiox065quhkoFYS/k
TLSH
T16EB25B36EC58CEB7ECEA5F99E74E7A02EEE01163859899D4CAD91E1C00CB1DD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ee920ba40fd4ea693af271d5141db9d5976a06499b60cd969a6b2176c4e2d434
MD5 d43dfee4f0362dd51ee069f41ddb64a7
SHA1 02164b4f7a9d9a02b1d921650b4c4ac848b0866f
SHA512 87891c97838fa463f9c4f53cb8d0931b6c659b8d97587949542051faf76397b99fbd2cc31c13a5a01720b1f1276951969aecb822cc506c8dc54ef6c8bfc8bacb
SSDEEP 384:n5ziFmCcmyWCN38Ni8TUNTUlIR9ye4xjGfbwoUytO65ym5FNfEABo+3Hy/7IgZ:MFlcpN39wgGlox065ZEABVW
TLSH
T179B22932EC94CEB7ECE75F99E74E7A02DEE0116385989AD8DAD95E0C00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 62e8b4a6b44f1c2f11f77463eeb9eaa63a3437c2c48fbec890ee58ad8164bf11
MD5 44508b2badce5560378e3f2ff2c4b67e
SHA1 ca94f213396f804325875e64c1dfdbd43dbe7a02
SHA512 ea458e886c704fce5029af387244559f56742b4b7633d75d67844da80942ff9350a7d37741758a016e25cdb29c9d72664f8edc09a2cfbcf2dcb53333ab71934f
SSDEEP 384:n5ziF8tNn/s3n9SF38Ni8TUNTUlIRXLye4xjGfbwoUytO65ym5FNf/AOObjI9G6w:MF8j+9039wgglox065Z/A29M/
TLSH
T10FD24936EC54CEB7ECE74FD9B74A3A56EEE001A386885AC8DAD95E0C00C759D4707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 bd9f13f9273b9ab12108d8add67fb51cf66a8eb96151cd723b890c660ddbd517
MD5 f7ada5d7ce5cfe70766660d9b5d31da7
SHA1 c652b42d8153aaa735345b1267d0395a8095df76
SHA512 8528b24a561853f1b382fa1f278df6298be4efa40835d772be68238e9e3e39ddfe83e0667fcf225ff17cb80d511150e1640468e429bce1ffbebcd7098776ba1c
SSDEEP 768:YFyj+9bQxwgA6vOox065ZXNSneStVFf48grcE29M/:E9bQ065aeSfFgTrcE2+/
TLSH
T164136FF194D78DB6D49D8BCB536DAD01A9B8C173B1584988B7E46D2CEC8B4BFC302821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4ba3b8874dd2a3cf615e3f4006260fb50b4985ef1c9618ddd223b7d781f740d4
MD5 18e6a487b795655c5f1573a03bc9aa99
SHA1 9d9b0a6a55e897d882323a73c4b659197120396a
SHA512 cf09c55e717d8896c81921915217a396ecf68b031a8354d7cb26f3931bf6320b384cf881110ea536444e5d94fe89f09ca98b667d5482820e400f496782bfb54f
SSDEEP 384:n5WiF9CcmyWCs38Nu8TUNTUlIxBydSmyjGfbwoUytO65ym5FNfHAhkP+lFYS/jfg:TFccps3Nwg2aox065ZHAhkoFYS/k
TLSH
T1A9C23A36EC98CAB7ECE65F9AE74E7A46EEE00163859899D4CAD91E0C00C71DD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ae49cade70013ab5c3f0dff6d4e29dc84b2db7bbdd14ba7e2cc6dec339824590
MD5 db0c3d5e8930653d256e36314216151f
SHA1 d0be6274fb5760a45e5d160cda2d909696050994
SHA512 c8dca902f9b6ffa917f71984ce9c0ba5fdd28cb1fdf84684b893451923f1503bd44f8196c21d93e4366b475d5802c1413c3218b8409d330f8d783d47e7f5ad1e
SSDEEP 384:nJiF8tNn/s3n9SF38Ni8TUNTUlIRXLye4xjGfbwoUytO65ym5FNf/AOObjI9G6wr:gF8j+9039wgglox065Z/A29M/
TLSH
T1FAD24936EC55CEB7ECE74FD9B74A3A56EEE001A386885AC8DAD95E0C00C719D4707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\37\10.34.0.84\Ruleset Data
Size 3.5MB
SHA256 54bd9731392c3850fc347fcb09c4dd558c915e742dc491ae4173ba1f00abaa50
MD5 135db4e8520e0c6ad4abab7bba2c621c
SHA1 ac85f5b7858165aaa8cfbdde0919364ec14654c8
SHA512 2bcd8fe87a02350c49a18327b614294530721c9456487732108eb0f2c4842faf2b329f04983f36f46424febcd59c0e5e14d69a9f52e60a6dfd161926ec6b7ce7
SSDEEP 49152:aLNynd3uBgOEqeaZjRBwJHKKZ80LkF8AghdiJXRhPgjEdqmGe6BL69hCO4bmMNP9:mNIT+wuO60
TLSH
T1E706A352572D4B22F0D2C03A88F5CB357700F7E4A19592EDBAA8414F7D8E2712F5A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.11.1\typosquatting_list.pb
Size 713KB
SHA256 7c99eba9e3fae4c14308b5d58902e5edd6e11f864ded930c70e625756c916b37
MD5 d5d6de318daa53b466cbd23c49350d5a
SHA1 4cbf25e540962c61b87a9bb26382522e238d1a31
SHA512 9aa19bfc6101cbebc7346d609488b825937c334af3759c994a8f9883787960a360a75183891bf54ceb27421ac85e65c539b2892701e382e49f7e158d3fba65fe
SSDEEP 6144:yDBMg6Kh+9j66p13jbh3dJdTjOIsoAq3o2CZxSQk+PNLemXT1+A8hrI:UBMg6Kh+F66pvNCIBn3o5f9T1+A8hrI
TLSH
T13DF4C6B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5e903506aa66f96b2e500d36da815f5c0a4c62fd224b33a2915273b2c2504995
MD5 5b31c7604f5a380e615caa6f057a0ac8
SHA1 87d18c3556796dd081669b0f98499e8c9f0d826f
SHA512 86f489e03cb9bfafc89a00ce7f19b8fb7096a03839e438f2d2607661145a8238940332f9126c4811877a02683c88678680c3a00f6e8ea266526686ffa00cd8b4
TLSH
T1055130E19C3C16D1D5BE0E6FB49778FC85E89325F4A0343D6858EA981A7A71D708087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dcfda45cdd3726fa234968dfcfb1d4ae39a9c483417abb105d15d9020e068d89
MD5 d4f7f06736ad5bf3b886fb0edfb2c4c7
SHA1 b7022293b345dfdcfa09da7c24fcbaf32c6f8a64
SHA512 98425897ed258573d1e618d8dec12b21a73f233254a4d1bf898acee57b9677f58786659cd6ad1511b6105e92e3d291c0a077e00702f846b7e4baa1c403affa70
TLSH
T1134141E05C3816C1D4BE0E7F708B38FC84EC9729F89034396849EAD84A7961D658047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8ec19b3f5038b6152d1ab64f1b9bc670081ac41c01455fbabbe2a3d509387241
MD5 eb004392f7aeb7496167be24ddd2c8b3
SHA1 2ac656318d0a2a9c381fef35b2efcb75a1dc8cd4
SHA512 2ce858e3786d16db7b7c92f0b56cc62b3d2c0d79fa2b51aa5a985471012126da8307e3952779f9d28776104c09d0466dc2ff432517826e16c2711e961d0b90d4
TLSH
T1C64141E05C381AC1D4BD0E6FB48B38FCC1EC9725F4A0353D6849EA984A7961D708087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 80029ec7f6a8703b558803b4e37a408d8fb93d1beb53bf79d44d0aba29d31e69
MD5 5979d9630604bf3f9444545f48516fac
SHA1 db43201f96265300ea2456311db00bf20490bc1b
SHA512 7f40325f3cc2cff5451096a6ed92bc51defe9e3ad8c52a0e43c241b537d47975753ec4864fddc947cb0353e40b3616e3b899c9207a6d5528bf45bc970fc861ee
TLSH
T1DF4161E05C3C16D1D5BD0E6FB08B78FC85EC9729F490343D6818EA981A7A61D308087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6165972dbc9510d6df032b12947f3e0858af2fdc96cc02530c6c4e55b947530c
MD5 3046f70d608b359f3f19f32e38bacd13
SHA1 1f2c19c7a4f06fedec49db92c1de1a7d8dfd6cc4
SHA512 e3938c151ded637ea8845fe579de7f7a83dfbba42d7118eb4f6f9324ef46fb71f498485d114edcb6fdcf2eea5d4990d66a21ee039785904dae0506f1bd5b160c
TLSH
T147412EE15C3C16D1D5BD0E6EA09B78FC85E89725F49038396858EA981A3A71D308087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 43d07e22316f423ac1915f70ffb5498e8d449b234fe5caeb4f54ec9bd044495b
MD5 b50d92ab35cf9946e7fed9fea6cbf215
SHA1 f26240f99cf64a70a52f8049ece3885d906d81df
SHA512 cdbed0e9b07070c3dc52588af7c967b507333e36ac47e594e46575c30f8c24be28983270bf851f3d2ccc00e9010fb5e3b1850678fdc0abee375a637113c1199d
TLSH
T1E75140E18C3C16D1D4BD0E6FA09B78FC85E89325F8A034396858EA981E7971D708087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f1bce00b44c1e995735d9c8a7ef283bce115b02f81bd6204536170847d0a6b8c
MD5 e3095d6754f5104133a9ff85f513641e
SHA1 008b0020ceab1a4c713dd6d4d95db25d85ce338c
SHA512 639eadcae9e1eec05d088bb283a10ee29dab0c004f13297e766fd4525b0f7fcf6e66765ef28a93a0311c800cf69c7437de5ff0bba7b009cc9453bf02cdde3218
TLSH
T196413FE05C381AC2D1BD0E6FB48B38FC81EC9725F4A034796848EA980A7A25D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

533de17e-0367-4c57-8b4e-109d41274a73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\533de17e-0367-4c57-8b4e-109d41274a73.tmp
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix.exe

Path C:\Users\Admin\AppData\Local\Temp\Ronix.exe
Size 15.5MB
SHA256 d2e1afef6561c5806b1d6438a886df3102449a8708cd2f7ea9a8ec27a9065385
MD5 b1cf36c7076e3bb998b309a125fae177
SHA1 c84dfc8557f7eac1a1a2d2e441cebd1fa4233cd1
SHA512 bd416af112268642f3ad9c87b85f202d182cc8203848d6d91f75edcf7492cad311d5bcb671e329eafe9b4089f624365ae7a09114b2440658a53376d20ab7b6be
SSDEEP 98304:nOsiN3uJmrP+tudDWREOgW+fiuWwEZAWTZ1rc/BEtzJyKzrn4U71HOCW17aW6YrP:OTuJm/DWRE+Jd1MKgU7sP1CCP
TLSH
T1F0F6F7247A5B996CD05BC474834B8A634A7530CB0B39B9BF448496382F6EBF46F3835D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fa84968-318f-4a5e-b003-e75a9be8a104.tmp

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\9fa84968-318f-4a5e-b003-e75a9be8a104.tmp
Size 1KB
SHA256 aba93a1e6427153f5a1cadb7ce317f6368de74938e5d3c21ef16ddb4d6c1fb0e
MD5 6c1df9fe70cac1c530ab06bd7c09f9e7
SHA1 ee0a43198412df5bbd37da176866548c83fec85d
SHA512 5318840ede2b0821d3d9c7e976ecb5fd6e076d4a343a428e680cff1e139c76771b7ce422a07918e3b153704ea485d80d8bf26e677d5ff8d2e8d97f1017ebc9e3
TLSH
T156314073E4A06F725D93A685F14ABA9B6D604169C2914F08B3DD8B1803F249C937AE33
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4ea406911e38b984dc9ca8ebb6f4b14ed6f28ac75ad3da8d4d8558c989c565a8
MD5 684fb19fdcb568a5cfb5d01e9fbe1f8b
SHA1 41576d636d81ff42acfe74b3470fc87f2350ac86
SHA512 51d7eefc8ad832bd399de3b0630238bc43cd45f4c565afe8d8f4845e20af2aff8373576a991de575e525d773e3ce128b575dcb3d4583cc0f6fdc90ad1070c076
TLSH
T107D0125337410334C02022730003B6080800C50F81054041582DC56E1A444501D07481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2f5b6449012b0924a7011001474b6c97edcf7269eee4a51694ca4ee643d2227c
MD5 a46bbb7b47f0edc7147938986b8fde31
SHA1 f75a65a99c32bc9bfc460f35adfb011f1dfb65ae
SHA512 141103fb448656d8f4859d2fbc86f3676fe1b33335d1ab1e595a03d5bd51eae68a94758d06a1f390e867220d99d55b8270c4bdab51c5940ec74bad9d45b318e0
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 3df860f17364f539b27253a2cfd9cf501dbe3f94e4f9663447f975cca07de6e0
MD5 2a3d59e4b10b41651e569f24876e1879
SHA1 8e30ae7793c930f26d076d837143cbf1501aa468
SHA512 58b847275d4e18116dea70aee2e2458e8e96d2578cf64e9f847ef753fafc3aa1648809713d7acb02147588979e7f34e058dfd90bbb7c64bc662977310d9bd26c
TLSH
T1E9F0226017A048C2F37105F185E1381639F6599C07534EC3B6E40CBE9903F96D0BD720
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bac0.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58bac0.TMP
Size 48B
SHA256 67a49f141fa5fc523e60889b25476f63821174c1c514f55c04c47e4928963f5e
MD5 e7f967e723f04c8ee4306670223f504e
SHA1 bd921d228f1b8b6124a3ba38b2d27de1f1311ad8
SHA512 5b69c89655eb18646d33cf95352c9b97fbb94ac04851369f0dd82fdd01bb61c6ec0a4192d17b39d7fc8fdf1dc6b86fbb339918f14153335771880419f246c2ff
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 ab39fdfc67a61651982016018c3227399d9f099df9f73e73e6a927dd29853ed6
MD5 8707d6b83b542fe062cf755040cd2e06
SHA1 ee35d2a2ca614852541e044897ed7f8fbf509906
SHA512 860c5499dfd4f0216289a854098d9243633201444e6b7c89c91341bb0bd3af299c60119d8f254e5aa1a07638a38e8719878af031d4438749ff0824a567900e07
TLSH
T102217DA643F4C66D8A4066A027347C17CD3D002993286E37CEDBFBE667D20B2E12174B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 c9bfcb9c9b10e223516f2b31a154275148c4bfb4e7a584b57ae85e05102aadc8
MD5 52ecc331d742de54f08893ac3e36c9d1
SHA1 4cbbd1b66b0d7dec565f3af5a3c30faeff68d531
SHA512 ba6fc6a72d3fbb0d5d92e0c1643d03a51124a141556fdbb5754cad674bad806c54e05319af3f9f64b715c1bcb5176059730413604b264e79f47858a09ce34796
TLSH
T1D7319CA6C3E8C76D894166E427347C17CD2D052992283D2BCDDEFBDA67D20B1E21124F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe595fba.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Network\Network Persistent State~RFe595fba.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences
Size 7KB
SHA256 75c7569040e16f669d59554f5ca89a01d73ec85ffb041aab5a00d202331304a0
MD5 767c538402d91ce5a450ad0455f7f15a
SHA1 60db10a38b53852d0d63f2ecf7a7b2f202a38e2b
SHA512 5cb51712c9a8be993b0ca66fb3a5237aca3450f94d43deb60fdfbb4d58a181779aa01b4bc65bbe0d3f62ead3f9cc1fdea421fa6c8a3127a2505c9bfe67ca1060
SSDEEP 192:stO0RDRftZ8pa/U/S+WiTucCxgBr0eIKC:stLRDRAn/V1Cx0C
TLSH
T139E1B8035E289E7B9CC7E61DB935BB56E2FA102253D10E84EBFC871C04E66DD620791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences
Size 6KB
SHA256 48b6cc78480eb6af1cb3312b0674f952cbb5759ec24b7446f2b21ea917804dc7
MD5 0fae2fd3588598712c7c541ac6335311
SHA1 acac9f1db8e3a12f7fac07a626145ee6ab8b7679
SHA512 378e5cf1ce3c185334f17e8f3393e05843d8c99dd6466d70431178459ebc6eaf13ca0c10452c870167062605ce4873a7eabc38b13c5b81321cee5cc3ac325432
SSDEEP 192:stO0RDRfYZ8pa/U/S+WiTkLwxgBr0meMC:stLRDRPn/VkwxmC
TLSH
T156E1C8435E285E778CC7F619B939BB56E2FA102263D10E94EBFC871C04E66CC620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58e48f.TMP

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Preferences~RFe58e48f.TMP
Size 6KB
SHA256 1c7bcded51293a336502d2b19d4ea0ec92c784bf5c757421531c1c5fca41f1f8
MD5 9c83727aff88835e99da2a045481ea8f
SHA1 c562e2df8e3dca6853247e205726b318d6074458
SHA512 41e06d784e6fec600d67aaea62f750b0645d21d5d5856522c39cbfeb2d08ebcfddaec37e1b065eec7bdcaba367e92d1358cd24cc152c294ed2a2cd1688f0e811
SSDEEP 192:stO0RbRfYZ8pa/U/S+WiTkLwxgBr0OeM8:stLRbRPn/Vkwxe8
TLSH
T107D1B8435F286D7B4CC7E219B939BB56D2FA106163D50E94EBFC871C04E66CC620791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 18KB
SHA256 5f0f428531f6845b397872633f21372033dd5359f609f3201c7e3eece9605854
MD5 e5fa690d723659d2bc67aff63d0466aa
SHA1 41ce4cd038d1c7f634b4fed51444c3ffae0d8104
SHA512 12d4d687aede9d49eb703c57276b05cea092e01a62ba1ab40b1b1b4c6d6aa09020b73528644e77e58ab4d9571af7fddf84a7c7860501aa87306d239e5aa06eb8
SSDEEP 384:zTsrv+89zHqlDNP9oidoNgmHIyMBJh+vmELGwjAZkVNV:8rv+4UNbdUKJYuELGwjAuNV
TLSH
T1EF827C33E428DB33ACF39984B14A664BEBB4515296C50BD4D9C94F8D429B0DE270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 16KB
SHA256 764d7331f3ece75f63fcd929ab281c659da36fb5e9382ae325058f339f938c08
MD5 1363df016381734bb865796bb0b8dcd7
SHA1 83915f28a2949113b23504d168f187a641e3c078
SHA512 c4dba70d8d316158b07fc68688bd337368901fe66648c64b9eaa5d7107f2c7dcf20b5486ab29b85ceb57415a6af65cb6d0ef764871e431275f7f3e0baca19818
SSDEEP 384:z/srv+89zHqlDNP9oid6Nb3HJMBtwjAZkVNV:4rv+4UNbdyKtwjAuNV
TLSH
T18D728D33A5389B375DF3A544F44A6A0BBF74509692C10BA4EADD5F8E42DA0D82317E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 1KB
SHA256 eb2e3bb83da0f2255af77d4d32fd74d1195db56197b3fb1c284cccabf52669ea
MD5 a7cc0fa590401a4cb709ad645949dcc4
SHA1 98ad64d302b7a5a2fb3a31d0a0ad4ebdf0659a5c
SHA512 9162b52d12acf7a5699bb13465a539690cf3b4eefca61c76eef911f8de4fbb979608aca3d8274f12537285b3f43d396b98dab6c534946e2f3cb95f9f6b4b09d8
TLSH
T1EE214073C4946F725D835994F14ABB8F2D50416982904F08F2DD472807E789C837BD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 2KB
SHA256 1198e1d4c8376fe4039ab713f1a1a7491141282e62c5be624796a4fbb74cf992
MD5 64d453f5d9ebf682a33a783d5ebe57a2
SHA1 be4f44c7999c5fdcb5963e7c7180a60cdadc20fe
SHA512 7aaf42a562b997dd809b9f14dcea29108bbc226fd4d3c308c36d263a8280650ce3905020f417fffac87a994b2c32ba6f4b2915fb37f530f59222a85b2b5e33be
TLSH
T1E651B333B814AF374DE38A84F94E3B57A9714164C7A12F54A6DC0B1C02E759C2362C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 3KB
SHA256 f37d8e328adb38ca810c5e8c324379426dcf6c287db7ed398d8ff43a4b30b59c
MD5 b03ec4d82d034fca09ad5effcb206174
SHA1 abac3b2ef11aef1fe0e8ee34f38ba3de6cb61f5f
SHA512 4f1891e0a2c17733941f2c06e493b74c7722f05ec00b65141befc059512445cf3a43378d0b4bad42ec1b4f66f6390b05e7044e41ee646fdbda59a528228c293e
TLSH
T198719827A964DA274DF39944F8893B17B6A15126D6D53F58E6EC0F0C02E729C1352C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\Local State
Size 18KB
SHA256 12166d1a339d509059984aa1ce5fd1ac5ebe0643d76cf9cea7d872f9500dec13
MD5 a549bc7e05eaa0f64d976097d71196bc
SHA1 c7fda529fedec62aa88eba2a76a7b97ec19438c6
SHA512 3b11eac1977bf7941023941dfd24346252f8995789fc08f4eb1f3598a484f016e97a16a6ec0a65f23b641df19a3f00b4ba2bc5aa04c090419604fcbd141006be
SSDEEP 384:zIsrv+89zHqlDNP9oidk3Ngj8uyMBJh+vmELGmjAZkVNV:3rv+4UNbdkbKJYuELGmjAuNV
TLSH
T1A9828C33E428DB33ACF78985B14A7A4BEAB4514296C50BD4D9C94F8D429B0DE230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\com.nuageux.ronix\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Loader.exe
Size 223KB
SHA256 c10a44bcfbe74b002301d8d1db86a86514991ffdd653db18403b12c999995314
MD5 c20889e76b60471e064140799e84036a
SHA1 cecc0b65bcc0a985c627859ced705e3e359b8a9d
SHA512 9191bb59338d1abcaf72a6675965113570772d21205a9ecd72fd44497ae0748c83c033e51fe60c2927b0a68aba7311a62c131576b83d8081d4a6f9893804fff6
SSDEEP 3072:IY9zMO9UUu05Lph1QS+usYmaMjBwbO1GB9MdE9M9DF78FffdJeD:IY9wNH0531YYHMjAzM+9sM72
TLSH
T12F248D1A956108F8F7B399BCDA164E22CAB27C954FF4B65F5BB44AF24E135808F2D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix-Module.dll

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\Ronix-Module.dll
Size 8.5MB
SHA256 de7287a89bd6d1b10564c032c94c9df33bd884debdb753c04b7233012efb0835
MD5 bf117c333855c1af1a16f3b6d0c94ee7
SHA1 f8c1286f191a1e5a157d8b0eda2c0461d6bad6eb
SHA512 2a7697ec36d5f86fdc62735821e5924f3d02bfcc5fd5c2e809ff695d103aa07a8226cd9323279fe1bbb5471bd2c6f3a007e2937d7cf8f00c51191d1ee3c580d1
SSDEEP 98304:VcuLnZiPcnT2Oruc5ysp1bFcevGFwrhtygT:JbMPiT2Op5ysp1bDeWj
TLSH
T1B4969E76B6A401ACD87BC13CC6579A13E7B2B815133097CF16A4567A1FB3BE41A3E390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\lsp\lsp.exe
Size 10.9MB
SHA256 dd16dfc077156df6795a69a4bbb753a0201de9513e6614741d8f1976ca9e8b7a
MD5 16de28c93995a988aaab6eb1c409038e
SHA1 424666825b9a2970a0d7663fbe66f9e885e5215a
SHA512 2ad14445e7cf7df46251d2978757ad2c73a9b0fd143d7fcae8cf9d78af1702c7a991be69330535a8cc664baa85c59ae0b1fdb8bca8354e1fd8f5bbece25ac074
SSDEEP 98304:gJeV6UHLvpVTLS0wRlgF8MkaQW0Dlems/Dt3:gJKXfS0s6QW0xemot
TLSH
T161B67D37629C11D8E0BBD07D8B8B5D93E7B2340903719AEF05A046965E1BEF94F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Roaming\Ronix\Bin\version.txt
Size 5B
SHA256 7fbd210ebec11f65a97190ef900795c4b8da3805af3f5a1b8d1d272556b292ca
MD5 7d23ff901039aef6293954d33d23c066
SHA1 528cf42af97409ff91db4e7793a81bc5f447d215
SHA512 d3c38b72c045741693569bdf0ffad7c7f2135a98358bdc26a31ba654110d6347b32797b54e0fa41dc336c532fee9c843fa0ae7fc62162c3658d1ecf947cdffe2
MD5 SHA1 SHA512

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1024383701\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1024383701\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_172450733\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1829334155\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1912114056\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Filtering Rules-AA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Filtering Rules-AA
Size 2.3MB
SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
MD5 b91a6cf79bedefedcb5603d3477cc3ed
SHA1 b3512a426a6a613f8cdf7f9ae3a0d02b700d1843
SHA512 9d85945f7f963fd9277adc20a0af459e8bb5904ef7038584e510ebd041b3029bf24ecae2047b24ecfa853154beef7e2bc5bd34ff8d90aeda000fbcdde741341d
SSDEEP 12288:DUoPNPlfiCBGkqNEWymqMD2N3FRgVfFRg3oFRgHsFRg/sFRg7dFRgImFRgJ1FRgs:JNhiSGkqdT5+9
TLSH
T189B51BF69947509145B9631938ADB2C82B14A28147ECCBF2EBB4C4AA2791DC737C05FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-CA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Filtering Rules-CA
Size 11KB
SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
MD5 40b3ba01a09be340fdf879f97b31c867
SHA1 b6ac58d1653c1b76e0e9898b17cfea3e6b56de94
SHA512 97f82f162588a761a13a2efd38d2c9518954400c7898cdd12923ce26e90818d94310b4a9f2a2cb2f55f5101c9a2e177dc1b14de8c9486eafc910271e2991dea9
SSDEEP 96:MKSlCviF3P2DoTc+cTKSlCviF3P2Do3lTKSlCviF3P2DoT:MaviVucryaviVualTaviVuC
TLSH
T17C3275333E488D6792A4C1A0DC92752C9E3087D98C9CBEC31235B9776BD1E6A508B5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-DE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-DE
Size 305KB
SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
MD5 fa08e85d713ad46803e924d443e4bf7e
SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
TLSH
T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ES

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-ES
Size 137KB
SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
MD5 6e8f660d075254a08948dc3517304256
SHA1 bc8abaa82d6d555ee9482c568a1d661453fbc956
SHA512 cc3484fe628e4242eeec2ce969c51e817ec9ab3feecec8d8097f43a319c9dc226771eefe63316d8ec2ad895f23ed4603c4836faa49369db785580455ecf21f37
SSDEEP 3072:NiZ3EhHST197h/6Jl06bBeS1G56asSnGpFrUboki9a8jRU+Zw1:/RxbR1EnYpLv/Vy
TLSH
T166D30D55AADCA8B55A73102C64D9254C911772D082CECDE4FB6686CECAE05CF3BA03FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-FR

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-FR
Size 528KB
SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
MD5 6804859c589fa0ce46529c3a53b882d6
SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
TLSH
T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-IT

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-IT
Size 216KB
SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
MD5 268f6a3c0990d434175268cf09cfa6ad
SHA1 464e10c57c536e6bb55a326a48469246a9241505
SHA512 5154048a794227c45b950ec2d2ca378f9e7a9542b9fc79c1fef1f1615e97a263168927d883967b06f8b52227a47e3ac75ac7061b25400ebaa63e4536a368d50a
SSDEEP 6144:1quRAGty7QiWYIeezuu2CGiXTyRl+XPWRq14T/KfY:HRZtQl+XPWRS4T/5
TLSH
T16524E9176A54EDBE4E22156CA09F5E0C7225758182C7CED4F3D5C08DE5F827A2BA03EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-NL

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-NL
Size 79KB
SHA256 935465fc40adbb4ae89ba37542ed37609014666c67fdf5115927809d69144b41
MD5 65126d1e76de4f0872e6cfa96609beba
SHA1 95268d3b2134894040afd0530d062a3b836f63c7
SHA512 0c6dd17cf622ad1a1a4ddc43fdc6f36567a98309e145e16d95edf38e9b21905867b28865bee591b52eecaa371138ac436eee6d18ff8d78f4c8f7031ba4e7ad84
SSDEEP 1536:x3ACbKFpRTfKGy7Dpj+u9huKCe/MELfmoRyQpnokj:x3ACbYpxfKGy7Dpj++hu8/L7moRyQpnv
TLSH
T14A83D70AAD68F8754A331D2FA4990D1C9625B600C7CAFDC4E725908EC9F52DF2AD07ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-RU

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-RU
Size 1.2MB
SHA256 f8abf856660805e271d9d2033accf4f8cc43b19b7662fc2b96f56739229a90fe
MD5 e946014ae78f059f0698731a745a3f00
SHA1 afeb8dc2d86d2763b69f97717e454a7c6b8a267a
SHA512 3c699d3205c3a000c13d20411a0e958f2107f62d813591652cfc573f9a29647badfb1703e499a8896644f1485ecc19cdcaca0c6bd5ec1e5e328339c95784cfa3
SSDEEP 12288:4o9g8Q9u1Xku8Uc24wpDs2zGFtyKnVgLxB7rsvAyLuQCdj9/CwYJWj0Ek0ozM/vQ:4Oe9u1Xn1KFtyKnKq1CvH0Ra3Rnkd
TLSH
T1F44560137254F9F04F734E7E549A9C089275B1A083D7EDC5CA29C19C98F2A9FFA402B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ZH

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\Part-ZH
Size 686KB
SHA256 9645edd48b978354345b657bacb3f30be1f450300856a82ba4d5dbf1236c7c9e
MD5 3e8cbee42dcb97db0df88cb96643e3fc
SHA1 94cd9e2bc876e04bfd2f311cdc160b6ae1d3c9f3
SHA512 319c69fcba623a0fea9ba4e1dcfabe3e9bd47f31dce7146e317835331217730fb61d0449abe7e66b1bc6f06a50c12269f7f09dbb633c85b4fd8dcc7b21c95304
SSDEEP 12288:g3gaBN1zyZzxT04duSeYXzhW+svzgAfk+XTAdXUd84nT4x09/xSE8Y:CgaBN1zyZzxT0N9YVW+sv8Afk+XTAdXy
TLSH
T114E491132168FCF51EB21E7D284B6D48813A76A047E3ECC6D62BD54ED6F025F39A01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock_snippet.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2020531827\adblock_snippet.js
Size 2KB
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
TLSH
T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_271241193\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_474976646\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_623589999\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_111299856\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1260839942\manifest.json
Size 118B
SHA256 9884eab7370008ea0366a3516952304fe3dfc3e4af613a701b140070052ea2fb
MD5 c2eb53757016d742f60dae3f6dedd5dc
SHA1 59e8ee7a18522944c88977476e3b2b37d5eb8b81
SHA512 905ee402639d8ae8988817e1726c97e466676b6b007b8c045179999f034f39855403c97a530bdfe38318b5f1b1fd5fd525d940c04e546ef33a3d0d37fe69c81c
TLSH
T1ACB092B00C0AA03B26C19320ECA066C683F80218E8025B1A088036881F8817880362B6
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1338080668\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1807452505\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1996395089\edge_checkout_page_validator.js
Size 1009KB
SHA256 04047fbad72cb02b113ee3a1f1823227aac74e1615fc5fa359d11776c727259c
MD5 21147b0280aa959a020d50a7d5738f17
SHA1 2e57c2a0e0b2c1f1cc78acf1a8fbb833c01b984f
SHA512 92db10d864968ee94156df795552867723aeb7ef03341e00c7f8cf11542a8443f83e1eb2487631ed38b441d4af751c8f4b3f99319312e50d8501df74263c01a4
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErg/OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErg/OUfq
TLSH
T1B5252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1996395089\manifest.json
Size 146B
SHA256 c97cc8be28f97c110b37ace786188903f2f1c9d6736e5b0ebd875d900340f4a1
MD5 c8b91ccf65e0519cd165ad5171ae6169
SHA1 bff29cece85fe2c0e817a1de9746ab4ba86c5626
SHA512 01197a05068fd9a4f7fc08e09f3192d5418dde6b62b6e5ee5aecc2e19cb28b4734f8c7b5d7175f08f55ac2c6e8a501e7c2ffa1725b3960f7920632bc456dcc4f
TLSH
T150C09B73C931AC71157507D449F59745EF74974BF511B0563731018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_400744077\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_407531790\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_407531790\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

main.lua

Path \??\c:\Users\Admin\AppData\Roaming\Ronix\scripts\main.lua
Size 25B
SHA256 761d0ba13957885dc4f35ecd2f6fe9ec62138c586766f4f8a5c03706efbff2ab
MD5 01999e84d8107b5efc0d1b93d566ab46
SHA1 19dd9037aae46c141e02d5eee0b656b3411779a8
SHA512 0df3f23b2d14989e034d50ea19aff0369c21c76e061cc65969e9f051892b31e7578ff9adbc37a97dbc1c84088f44bcd47bfea3d8e0d2aeecc3f639514c072a32
MD5 SHA1 SHA512

Submit Download

memory/800-1768-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1766-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1758-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1759-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1757-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1769-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1763-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1765-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1767-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/800-1764-0x0000024621C50000-0x0000024621C51000-memory.dmp

Download

memory/1160-1039-0x000002E9A7EF0000-0x000002E9A8EF0000-memory.dmp

Download

memory/4284-23-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-6-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-73-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-7-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-9-0x00007FF6F2BFC000-0x00007FF6F2BFD000-memory.dmp

Download

memory/4284-5-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-8-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-61-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-3-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-4-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-2-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-1-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4284-0-0x00007FF6F26B0000-0x00007FF6F3529000-memory.dmp

Download

memory/4396-258-0x00007FFFF8D90000-0x00007FFFF8D91000-memory.dmp

Download

memory/6036-164-0x00007FFFF8D90000-0x00007FFFF8D91000-memory.dmp

Download