salatstealer | ecc2c9caf0c81bc8fbfab9473d2b1402b11e7cd43db499344b7674296874738e

General

Target
2026-08-08_8f78ec2a88492c170e2d676fa8845807_coinminer_cryptbot_dosia_elex_glassworm_icedid_luca-stea.exe
Size 21.0MB
Sample260808-v6e6maar31
SHA256 ecc2c9caf0c81bc8fbfab9473d2b1402b11e7cd43db499344b7674296874738e
MD5 8f78ec2a88492c170e2d676fa8845807
SHA1 0a67ea389be325ed43908609f21fd43be4b7d950
SHA512 ddfcb7133afb56eb4cdf4f66fa6ae678119560b5b70ef213e7828845ba7acb47f37d80710a45c0f17053432e7228af7c353b49ad156f1acc4f9e9741e6a69e3d
SSDEEP 393216:9WI8c3pUfk/2GO71gMuZPquR5OyC++hFqWhkvYVXikzB6H4E/lrSh:9W7Ec2ZvORDFqvQS0sH5+
TLSH
T12227F007EC6515E9C0ADD6318A639262BB717C895B3123C72B90F6252F77BD0BEB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000432-47.dat	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000432-47.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000432-47.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000432-47.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 8 IoCs

pid	Process
6100	PerfNET.exe
256	Ronix-Installer.exe
4416	PerfNET.exe
4356	Ronix-Installer.exe
6116	PerfNET.exe
5112	Ronix-Installer.exe
3508	PerfNET.exe
5172	Ronix-Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8f78ec2a88492c170e2d676fa8845807_coinminer_cryptbot_dosia_elex_glassworm_icedid_luca-stea.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 6100	3580	2026-08-08_8f78ec2a88492c170e2d676fa8845807_coinminer_cryptbot_dosia_elex_glassworm_icedid_luca-stea.exe	90
PID 3580 wrote to memory of 256	3580	2026-08-08_8f78ec2a88492c170e2d676fa8845807_coinminer_cryptbot_dosia_elex_glassworm_icedid_luca-stea.exe	92
PID 256 wrote to memory of 4416	256	Ronix-Installer.exe	93
PID 256 wrote to memory of 4356	256	Ronix-Installer.exe	94
PID 4356 wrote to memory of 6116	4356	Ronix-Installer.exe	96
PID 4356 wrote to memory of 5112	4356	Ronix-Installer.exe	97
PID 5112 wrote to memory of 3508	5112	Ronix-Installer.exe	99
PID 5112 wrote to memory of 5172	5112	Ronix-Installer.exe	101
PID 5172 wrote to memory of 4488	5172	Ronix-Installer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8f78ec2a88492c170e2d676fa8845807_coinminer_cryptbot_dosia_elex_glassworm_icedid_luca-stea.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8f78ec2a88492c170e2d676fa8845807_coinminer_cryptbot_dosia_elex_glassworm_icedid_luca-stea.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
  "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
  2⤵
  - Executes dropped EXE
  PID:6100
- - C:\Users\Admin\AppData\Roaming\SearchClear\agent_nhtSDdEP.exe
    C:\Users\Admin\AppData\Roaming\SearchClear\agent_nhtSDdEP.exe
    3⤵
    PID:5952
- C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
    "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
    3⤵
    - Executes dropped EXE
    PID:4416
  - - C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_bxTRWrHh.exe
      C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_bxTRWrHh.exe
      4⤵
      PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
      "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
      4⤵
      Executes dropped EXE
      PID:6116
    - - C:\Users\Admin\AppData\Roaming\PushBlock\agent_XNrLBelK.exe
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_XNrLBelK.exe
        5⤵
        
        PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        5⤵
        Executes dropped EXE
        
        PID:3508
      - C:\Users\Admin\AppData\Roaming\SearchClear\agent_eUCMxxmm.exe
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_eUCMxxmm.exe
        6⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        6⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_xgSkytSs.exe
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_xgSkytSs.exe
        7⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        6⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_gYknPAyg.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_gYknPAyg.exe
        8⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_PgHAewJd.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_PgHAewJd.exe
        9⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        8⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        9⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_dpdqEeiG.exe
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_dpdqEeiG.exe
        10⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        9⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        10⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_zmDhVNay.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_zmDhVNay.exe
        11⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        10⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        11⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_wqMbPQyw.exe
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_wqMbPQyw.exe
        12⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        11⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        12⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_GLRRhVWG.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_GLRRhVWG.exe
        13⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        12⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        13⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_PwNUSDWl.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_PwNUSDWl.exe
        14⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        13⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        14⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_WMlsdvNi.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_WMlsdvNi.exe
        15⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        14⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        15⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Roaming\ConvertToCopy\agent_qhftVRaj.exe
        
        C:\Users\Admin\AppData\Roaming\ConvertToCopy\agent_qhftVRaj.exe
        16⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        15⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        16⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_pbNugwXa.exe
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_pbNugwXa.exe
        17⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        16⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        17⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_qNwVBiDT.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_qNwVBiDT.exe
        18⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        17⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        18⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_slXHGZNd.exe
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_slXHGZNd.exe
        19⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        18⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        19⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Roaming\ShowRevoke\agent_uDYwQbJP.exe
        
        C:\Users\Admin\AppData\Roaming\ShowRevoke\agent_uDYwQbJP.exe
        20⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        19⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        20⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_rfRkBwBj.exe
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_rfRkBwBj.exe
        21⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        20⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        21⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_TmVATHMq.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_TmVATHMq.exe
        22⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        21⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        22⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_ZdIlfSTC.exe
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_ZdIlfSTC.exe
        23⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        22⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        23⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_HQHGkgpT.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_HQHGkgpT.exe
        24⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        23⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        24⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_FFAQKunr.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_FFAQKunr.exe
        25⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        24⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        25⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Roaming\ConvertToCopy\agent_AlkAAPTM.exe
        
        C:\Users\Admin\AppData\Roaming\ConvertToCopy\agent_AlkAAPTM.exe
        26⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        25⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        26⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_dBQPpvML.exe
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_dBQPpvML.exe
        27⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        26⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        27⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_TeEdpeEP.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_TeEdpeEP.exe
        28⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        27⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        28⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_YhDddoVV.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_YhDddoVV.exe
        29⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        28⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        29⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_tEnTHfoa.exe
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_tEnTHfoa.exe
        30⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        29⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        30⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_ihqgbKep.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_ihqgbKep.exe
        31⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        30⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        31⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_mNScxkPQ.exe
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_mNScxkPQ.exe
        32⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        31⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        32⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_NHZuaaJs.exe
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_NHZuaaJs.exe
        33⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        32⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        33⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_ZfvTRoue.exe
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_ZfvTRoue.exe
        34⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        33⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        34⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_dTncSLxu.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_dTncSLxu.exe
        35⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        34⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        35⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_QQWqmVJD.exe
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_QQWqmVJD.exe
        36⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        35⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        36⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_azzzQNuU.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_azzzQNuU.exe
        37⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        36⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        37⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_gvctSReL.exe
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_gvctSReL.exe
        38⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        37⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        38⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_CqSzKEqE.exe
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_CqSzKEqE.exe
        39⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        38⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        39⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_bZnZmGfQ.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_bZnZmGfQ.exe
        40⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        39⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        40⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_tDREOLTJ.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_tDREOLTJ.exe
        41⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        40⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        41⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_FQoeUhSX.exe
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_FQoeUhSX.exe
        42⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        41⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        42⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_HHxftBSX.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_HHxftBSX.exe
        43⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        42⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        43⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_uCgMUqzP.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_uCgMUqzP.exe
        44⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        43⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        44⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_hGaBmDfH.exe
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_hGaBmDfH.exe
        45⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        44⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        45⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_okXYIMls.exe
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_okXYIMls.exe
        46⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        45⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        46⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_OFAFQLCI.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_OFAFQLCI.exe
        47⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        46⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        47⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_mfxyQWHm.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_mfxyQWHm.exe
        48⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        47⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        48⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_bCxhNwyb.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_bCxhNwyb.exe
        49⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        48⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        49⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_dLlroOII.exe
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_dLlroOII.exe
        50⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        49⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        50⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_kYBrLHJx.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_kYBrLHJx.exe
        51⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        50⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        51⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_WWJPvsWO.exe
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_WWJPvsWO.exe
        52⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        51⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        52⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_XxdPrMJB.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_XxdPrMJB.exe
        53⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        52⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        53⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_WlJfPfvf.exe
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_WlJfPfvf.exe
        54⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        53⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        54⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_GjQdUQtZ.exe
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_GjQdUQtZ.exe
        55⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        54⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        55⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_YowmjKKo.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_YowmjKKo.exe
        56⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        55⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        56⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_ZCogeMxq.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_ZCogeMxq.exe
        57⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        56⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        57⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_fevqRFPR.exe
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_fevqRFPR.exe
        58⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        57⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        58⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_fLkdNQXz.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_fLkdNQXz.exe
        59⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        58⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        59⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_KRMakJxU.exe
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_KRMakJxU.exe
        60⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        59⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        60⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_vgHHfhoP.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_vgHHfhoP.exe
        61⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        60⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        61⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_XysGGCTC.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_XysGGCTC.exe
        62⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        61⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        62⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_XHHxGFfx.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_XHHxGFfx.exe
        63⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        62⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        63⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_UYxWaSsf.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_UYxWaSsf.exe
        64⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        63⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        64⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_epEdbOAo.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_epEdbOAo.exe
        65⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        64⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        65⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_pdErWFeh.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_pdErWFeh.exe
        66⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        65⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        66⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_qubjxJXU.exe
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_qubjxJXU.exe
        67⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        66⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        67⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_GsJvGsKD.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_GsJvGsKD.exe
        68⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        67⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        68⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_YzwBUdmK.exe
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_YzwBUdmK.exe
        69⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        68⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        69⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_aCcljcoi.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_aCcljcoi.exe
        70⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        69⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        70⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_fsHxBymB.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_fsHxBymB.exe
        71⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        70⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        71⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_xQIHHeYV.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_xQIHHeYV.exe
        72⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        71⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        72⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_LeIMjHLN.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_LeIMjHLN.exe
        73⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        72⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        73⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_llcelToj.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_llcelToj.exe
        74⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        73⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        74⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_cXrFquJv.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_cXrFquJv.exe
        75⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        74⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        75⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_SWwmDisb.exe
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_SWwmDisb.exe
        76⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        75⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        76⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_YotdRXZR.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_YotdRXZR.exe
        77⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        76⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        77⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_xrKaZazg.exe
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_xrKaZazg.exe
        78⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        77⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        78⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_tyZjAEiR.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_tyZjAEiR.exe
        79⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        78⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        79⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_gqbCFYEW.exe
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_gqbCFYEW.exe
        80⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        79⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        80⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_oPXzsjBV.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_oPXzsjBV.exe
        81⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        80⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        81⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_WmGAfqUi.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_WmGAfqUi.exe
        82⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        81⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        82⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_ClNeAZnF.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_ClNeAZnF.exe
        83⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        82⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        83⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_IaMhEtgx.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_IaMhEtgx.exe
        84⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        83⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        84⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_PDdIrEXK.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_PDdIrEXK.exe
        85⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        84⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        85⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_JLCFzzsg.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_JLCFzzsg.exe
        86⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        85⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        86⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_uonrDVlk.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_uonrDVlk.exe
        87⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        86⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        87⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        87⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        88⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_TilHBOcD.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_TilHBOcD.exe
        89⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        88⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        89⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_fxCKjsrN.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_fxCKjsrN.exe
        90⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        89⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        90⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_dxiJAcsj.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_dxiJAcsj.exe
        91⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        90⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        91⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_MwlhZPOR.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_MwlhZPOR.exe
        92⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        91⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        92⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_sxNRFlnY.exe
        
        C:\Users\Admin\AppData\Roaming\PushBlock\agent_sxNRFlnY.exe
        93⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        92⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        93⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_ezLVYYdK.exe
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_ezLVYYdK.exe
        94⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        93⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        94⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_cMLtQDyE.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_cMLtQDyE.exe
        95⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        94⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        95⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_skvyERKQ.exe
        
        C:\Users\Admin\AppData\Roaming\PublishMeasure\agent_skvyERKQ.exe
        96⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        95⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        96⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_laVoyuZM.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_laVoyuZM.exe
        97⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        96⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        97⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_PjJDGoHw.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_PjJDGoHw.exe
        98⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        97⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        98⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_Cahephff.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_Cahephff.exe
        99⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        98⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        99⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_ihVGWFeH.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_ihVGWFeH.exe
        100⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        99⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        100⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_gzkObtrA.exe
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_gzkObtrA.exe
        101⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        100⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        101⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_tnWAPugu.exe
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_tnWAPugu.exe
        102⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        101⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        102⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_kYDpySBL.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_kYDpySBL.exe
        103⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        102⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        103⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Roaming\ShowRevoke\agent_hhaZOehO.exe
        
        C:\Users\Admin\AppData\Roaming\ShowRevoke\agent_hhaZOehO.exe
        104⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        103⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        104⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_piQGKReP.exe
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_piQGKReP.exe
        105⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        104⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        105⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_IbDuSUwT.exe
        
        C:\Users\Admin\AppData\Roaming\Adobe\agent_IbDuSUwT.exe
        106⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        105⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        106⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_PFXQimjD.exe
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_PFXQimjD.exe
        107⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        106⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        107⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_hRNQjABn.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_hRNQjABn.exe
        108⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        107⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        108⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_JhWcRdxo.exe
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_JhWcRdxo.exe
        109⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        108⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        109⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_DknepbIx.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_DknepbIx.exe
        110⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        109⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        110⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_sQfUMsEP.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_sQfUMsEP.exe
        111⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        110⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        111⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_jWrZqgSL.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_jWrZqgSL.exe
        112⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        111⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        112⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_XbShPEno.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\agent_XbShPEno.exe
        113⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        112⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        113⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_WcdsnyRC.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\agent_WcdsnyRC.exe
        114⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        113⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        114⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_GzuWgFml.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_GzuWgFml.exe
        115⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        114⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        115⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_IPrqKxIk.exe
        
        C:\Users\Admin\AppData\Roaming\WatchRestart\agent_IPrqKxIk.exe
        116⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        115⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        116⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_WCOXhdxi.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_WCOXhdxi.exe
        117⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        116⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        117⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_tSRmTTjO.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_tSRmTTjO.exe
        118⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        117⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        118⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_CHaFwqGs.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_CHaFwqGs.exe
        119⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        118⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        119⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_TFuILVMd.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_TFuILVMd.exe
        120⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        119⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        120⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_IekpLmfD.exe
        
        C:\Users\Admin\AppData\Roaming\UninstallTest\agent_IekpLmfD.exe
        121⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        120⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        121⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_XjoCKYdX.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_XjoCKYdX.exe
        122⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        121⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        122⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_DdidUHMF.exe
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_DdidUHMF.exe
        123⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        122⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        123⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_DreafcCk.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_DreafcCk.exe
        124⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        123⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        124⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_xAufxaUI.exe
        
        C:\Users\Admin\AppData\Roaming\EditLimit\agent_xAufxaUI.exe
        125⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        124⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        125⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_NxGTQpYt.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_NxGTQpYt.exe
        126⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        125⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        126⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_ijhTxwzX.exe
        
        C:\Users\Admin\AppData\Roaming\Mozilla\agent_ijhTxwzX.exe
        127⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        126⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        127⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_lrLKRFzg.exe
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_lrLKRFzg.exe
        128⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        127⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        128⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_EeHSvOAq.exe
        
        C:\Users\Admin\AppData\Roaming\CompressCompare\agent_EeHSvOAq.exe
        129⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        128⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        129⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_QaLdyqpn.exe
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_QaLdyqpn.exe
        130⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        129⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        130⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_buMgnANi.exe
        
        C:\Users\Admin\AppData\Roaming\ShowExpand\agent_buMgnANi.exe
        131⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        130⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        131⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_ggeldTsD.exe
        
        C:\Users\Admin\AppData\Roaming\SearchClear\agent_ggeldTsD.exe
        132⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        131⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        132⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_WpWJysDO.exe
        
        C:\Users\Admin\AppData\Roaming\RequestSearch\agent_WpWJysDO.exe
        133⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        132⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        133⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_tTbtqpHV.exe
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_tTbtqpHV.exe
        134⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        133⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        134⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_AeYFOWDa.exe
        
        C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_AeYFOWDa.exe
        135⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        134⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        135⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_nQlifmEQ.exe
        
        C:\Users\Admin\AppData\Roaming\SetMount\agent_nQlifmEQ.exe
        136⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        135⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        136⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_BFJSzJca.exe
        
        C:\Users\Admin\AppData\Roaming\TraceResume\agent_BFJSzJca.exe
        137⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        136⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        137⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_SCtdvSvM.exe
        
        C:\Users\Admin\AppData\Roaming\OpenSync\agent_SCtdvSvM.exe
        138⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        137⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        138⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        138⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        139⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        139⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        140⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        140⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        141⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        141⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        142⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        142⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        143⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        143⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        144⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        144⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        145⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        145⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        146⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        146⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        147⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        147⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        148⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        148⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        149⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        149⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        150⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        150⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        151⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        151⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        152⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        152⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        153⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        153⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        154⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        154⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        155⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        155⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        156⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        156⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
        157⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe"
        157⤵
        
        PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PerfNET.exe

Path C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
Size 11.3MB
SHA256 589e1b75b5aba819520166038a03423115461c7e0aa51326ef0adfc1d5c3bdf2
MD5 2c72c26a45bb7c534c5d0bb5a09ef99e
SHA1 4b17bac773296b4629fc9a22710a83102d71a75a
SHA512 379d69b40e09c696c2178b281d782ec940a76004c80672fe0886fe0da2a9e0c26c09019d2f5cd59d66cd6b57f0f6873d8eeb30d8c37cf1dc39cdf7121c4937b4
SSDEEP 196608:aDiQN98cZ1PoEKQiQ4fiKNE6kOa2GO71wXT:aWI8c3pUfk/2GO71gT
TLSH
T159C6BE03EC6515E9C0ADD6318A639262BB717C895B3123D72B90F6252F77BD0BEB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix-Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Ronix-Installer.exe
Size 9.7MB
SHA256 fa0f10a12a11f0fdf33d6d29a86e0f108425e33a759cb1c436e11a7542041ca7
MD5 6e68608e4a86e31602d15019a5b9dcf5
SHA1 de4ce365c9c4899a44a843427533083316a977db
SHA512 685937e31b08e5d8488fe40b3e79d0602834f6dd7b209e597f2af9281af788cf79a4e42d1191f4bf729c007cdcd18b6da0e267004aa7f6236c9499bead1f1322
SSDEEP 196608:4ZYZNhquRmKMpy2+m++hnnW+qWyH2N6vjEDpXni30z5P/6HxO2WQ5tlrSQ:4uZPquR5OyC++hFqWhkvYVXikzB6H4Ed
TLSH
T1C3A6335AE77445F9E176D1BCCAA70612E77634090361E3CF0366AAA62F136E0DE3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_bxTRWrHh.exe

Path C:\Users\Admin\AppData\Roaming\ResetRevoke\agent_bxTRWrHh.exe
Size 12.0MB
SHA256 7ec14ff08b3a2394c2de8a1c269a40831ba6d4991032be04e1e87ce74eb90287
MD5 fdb01496a26b1b9a2d33c146839cde6d
SHA1 6ad768f7495de69a8a95f2c0848b8aa9a0454993
SHA512 a3624998c48cf11fac89e5ce8d6c85fef294d3be2db30a843080f06e47510580ed97a4689e76e210ffebaddd3f88d06b6b6b2c9c12b652ae02177347a5e7a838
SSDEEP 49152:wE6KiXwhZMKX41WQw9JxdNPCpYs2tFVDbwrLyfGvUdP7XVOYHahsnipR6mSMFZOo:YKUwNQw7/RCH25si5uiMCh4CrEvO/
TLSH
T130C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3580-17-0x0000000000400000-0x0000000001910000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads