hxxps://drive[.]google[.]com/file/d/1SjR7lUFjpnXJkD2vJ-e3BtMyQtHG5xJy/view

Resubmissions

03/04/2025, 15:08

250403-sh6mkayscy 7

03/04/2025, 15:03

250403-sffncsx1hw 6

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
03/04/2025, 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1SjR7lUFjpnXJkD2vJ-e3BtMyQtHG5xJy/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133881662732015342"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 56003100000000006d5abc88100057696e646f777300400009000400efbec5522d60835a99782e000000a6050000000001000000000000000000000000000000048f7200570069006e0064006f0077007300000016000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5a00310000000000835a8f78100053797374656d33320000420009000400efbec5522d60835a8f782e0000008f36000000000100000000000000000000000000000054d21301530079007300740065006d0033003200000018000000	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	NOTEPAD.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Radium.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Radium.zip:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5792	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5792	NOTEPAD.EXE
5456	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe
Token: SeShutdownPrivilege	6052	chrome.exe
Token: SeCreatePagefilePrivilege	6052	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe
1244	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe
6052	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5792	NOTEPAD.EXE
5792	NOTEPAD.EXE
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe
5456	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 2832	6052	chrome.exe	79
PID 6052 wrote to memory of 2832	6052	chrome.exe	79
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1496	6052	chrome.exe	81
PID 6052 wrote to memory of 1496	6052	chrome.exe	81
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 1672	6052	chrome.exe	80
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82
PID 6052 wrote to memory of 2696	6052	chrome.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1SjR7lUFjpnXJkD2vJ-e3BtMyQtHG5xJy/view
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4086dcf8,0x7ffd4086dd04,0x7ffd4086dd10
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1996,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2340,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4300,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4656,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5264,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5728,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5924,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5876,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6104,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4296,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4396,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5480,i,17054080579941398503,3671044487143048522,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5964 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4928

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Radium.zip\msg.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5456
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Temp1_Radium.zip\config.json"
  2⤵
  PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Temp1_Radium.zip\config.json
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:1244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {280ba11a-6b87-4b9f-b8e0-72b702e58edd} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {0fa58766-3c72-44c0-bb07-ecd3a45b3eed} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27323 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {9ee69960-f496-4b81-be68-4b084ae657c4} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27323 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 3896 -initialChannelId {bc8c2e7a-7656-4366-b5a6-542d26270a0a} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 34822 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {856dec38-6ca9-47a0-90e9-91bff95e07e5} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4776 -prefsLen 35010 -prefMapHandle 4768 -prefMapSize 270279 -ipcHandle 5036 -initialChannelId {0c7f6c7c-63e7-46fb-846c-a302e967bb6b} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1684 -prefsLen 32952 -prefMapHandle 3208 -prefMapSize 270279 -jsInitHandle 3212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2708 -initialChannelId {51efa4a0-8395-487a-a203-415638fe16f9} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {3604d406-b7bc-49bf-8c4b-4c1c3bc999de} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {68e046f9-7266-410c-bdbe-bb405f2f93e5} -parentPid 1244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
e5df7bfaeee29337abcd4a7fcd81073c

SHA1
fd70b1f83e7d6e12f532b3a837a94778892b539d

SHA256
32f89686eafe7ba6d41578fb3a43814c38b96b12b5fd5e431cf213f04ca45861

SHA512
41e039e709c644f2078b3a85c378980e179cbb13f64f3c2d8d69ea18d13ce7960451598a0869a7f5970b89d31425d4fb9b4153e61509633924dc8a4c88bb4490

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
4ccab83886aa7e46c301986610ecc4f9

SHA1
8f091015dd620c33f9dc0680c80c576d3408f770

SHA256
9d299840e101e9b938d6389864110457330172a600563d0cde6a8247bf399e59

SHA512
22e0a0a8aac066170ca13fd19c6ebd685989824d95d5311e82bfb853fb40512da0f55e3b51add71180e8ae918d55abce7a559c675e8121211931c32e4c65911d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
29a15c57dad8e476668d32ce776a20a5

SHA1
49180cb2e116149f35357f003fa259ccdf6642b7

SHA256
e25b7163ed96ce8f5e8efba3f2a7f8f5faa93768d2f6b8c579e9e70166bc8f1d

SHA512
955e8fecb71acb763dfe880e397c0329bbcddbd94d8573ff0bf6168c4afc5d6256b91cb997a0dfde4af97b5ed81f76cfc9cfb6dac01107f7c6682d205cd7a16b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
38befe0b01d6baa21fceda67fa882716

SHA1
280143d17a3667807f63069900fde3e3ff03c535

SHA256
c38585b1124003dc89759b9a65bb8612a7b2418d633663316c9763bb0edb1a68

SHA512
c73da5abad7d76412d987dc8b77b3f0f1e35c85953b43a69d1e097f7e4956b15450824e6daca4efce78146e02feddbd3e1bbbc1cb9bc6cce4ec154b09777ca51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
60cf69de02656eadcf6382b1be898a47

SHA1
c6925cd6be8825134eda74e2cdac59457d9573da

SHA256
5e9f8124fd61790db0b430a905cdacd38fc6df966c23ab54e42b1fe92a3f04b8

SHA512
3c61ab7df36f54dbf19026ea1830f5945aa95ec2e8783667ba37a26f0527adc92d30d9e7eb66a9948f7a1df0889391adca6a623a7715fd0cb2eb5da8228341c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7a7f765aeea38aa5044c2e8344554500

SHA1
2c81656d4d8f677e6dd1ee53462ed56e72f2ffa4

SHA256
2bec9d52254ff1732f8d2f32962a66b9696ab072ffe5a05d1d1c528c27b72a6a

SHA512
efe92a0e2698919957aeedce9fcf48d3df91eacc8e6942fc7dcd77c860a5db0d2c6d875d11be1b5f3119a79a3bc5b3c97a7db63cae5e0622f5cc459fec31eacc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
8c767153270134ff67f3dd4ec752018c

SHA1
42410c9826c5ff96cfdc8163096d903d687da0d2

SHA256
25dcc03ab8d06e9b12461e9227bb92a15634b66ebe6760d3a322ef492a4cc7bf

SHA512
df952af3cb1514315dec428fe4aae1d8de2d7e2a53a1fa250ae47c5af5f3c1af177ad0a2f34d9eeeb40b073157860d2055b79823a1cb399f51b415b92a7c9739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
36447db7f8086abbb79f2c8c20fb8427

SHA1
2708f04a984fe81e5585a311e83888cab02b0c15

SHA256
b696f50d48bf8219c7bbd0238b52f4548407ed16c7e0b6c7e14623535145a80b

SHA512
d041bb4b5f11c42d46b5d2624318b11fc8ac360af32dd3fba3db3e88c17f8cfac3afe2847034a6687cb434ff4d6ba82c560b9f882ec376dbc5d68af13d286bc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ca55.TMP

Filesize
48B

MD5
ae6fe4711a7645386c3cd670c557409c

SHA1
9c972b08a013c0454f8ac2983166bb5646919f2c

SHA256
3048a144a90a58b02d65b70318a024b8f5839863f019189f4935afe07a1ba0e7

SHA512
370f3505a2cbb9427ac23755520462a6c5c5dbfca2735e54bffa73fd0bbb4603131c8b4011773f3c0e3082c7aa88f286957a85fb44bbc1164ae39fbc51753a18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
d6f3a19f2ed9c63549c03a11bab9ddf8

SHA1
e211c3483bb052d10438efbcdbf47300725725aa

SHA256
ac16e90ffd58c0d20f91c54dab2b545692ce7393303e98ada384c34c580b1dce

SHA512
7a93b3758f8fd4de6756ca6ea84b6cf56c6e9a94080ff6b2d6dd32b6e42212bcd3375cac7caaf5a953432bcf0effa43458ff6d03f540e8ef489dd462b596e84e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
b321e720c0b8cc534ec1328e56cdf914

SHA1
00076ef16ac99a9a2970541eec5bd327aa71b185

SHA256
95993ad81bc77ffd2c831b6b2bde52335ec8cff5f5ed5ebb985a7137e7d71c57

SHA512
e4b9a62f2d0f0fed39369ee6bec127cee66ba15edd3cf5a57bd3ea2e5c46e92320e1542e87566945ee0b42d6402c6e7bddeb0664dc00f8cbf23ebcca4a8ddfac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
3a6fccc37bdcc94c90fcd8131e6b7dbb

SHA1
b2255a61070dc514f47821ff490dabadb9256e63

SHA256
cc0371abb4c9509ac2d37a4f1c52b58f71b911381654772e6f8179a8e3a1414b

SHA512
05c9c8c5b3ea5a0b632be4b05fc63d619d32a028998e30f6b454d21f2e2cd38fc57c4757fcfe145d2130655b2ddbea79e2715655d2c1f66534bb647cfbedee57

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6xthhun8.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
f08407b651ae937eec5a85202ab21908

SHA1
5ea48a4e70de3d9bef4b8243411415b7c1bf4032

SHA256
5233e8dcde053fa10c0d59aedb720b1137396bc919d0038b73db6bb758d207b7

SHA512
ac7cc32147b2a04609757141bcf9ce8da49bdf3610e4c57966b720886c5d36bdc68587fc8652648df93b8b9e0d30ba892f2bf78ccd0bdd4bc961c50788d7a536

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
6d6ed03e2ce2df86d1340d4d71e66053

SHA1
34837dde17fa10bf344e59d9992099aef91321f9

SHA256
e84bbd9c8d0d129cf19b2b66d17aaf8beed5c4ea833cc7d76dd832ec3107a59e

SHA512
9ce7730937457030254ca959f8a14defa35160cc9a6f523bc86b133fdc1b58995d55d67c170b9d44acea63300204e1db63f8a8d1b2ffa22cc05d37d7bea3f6ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
4ca51e3c6843adae65a7e09a62e456a3

SHA1
e8a87aab161bbcecc52fb0f449cf93d7fb3e95d4

SHA256
3224f014e44a70496f74ffc2bb910abc25a890ff004973441390fe3933252380

SHA512
d87db28f29efb4e72708ed4698864a4a178937d719d96ed996ff626969d47a26017fd79e925100cb1a7bfef80ad421535a301b1ee4f276a024c3f0625c9bbdab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
778599b2aa1c4984fe95b8345d0889ac

SHA1
8cba6c841b8e5f0ee792227f62d27a914cdfe6c2

SHA256
659edecc2bad40f88200f70a48c95c8aed1e1545c12c378f817587a7a89ffc3d

SHA512
abf71f961a8a93182fdab7a32a601471e2c1e6c5e41f5aa6594885b68d79d35f6410229b18826141f0ba98f46b3a77ba6cafdecb1fffd01802cd6740bbab9f74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\pending_pings\1ad6b49b-605d-4f94-a71f-c0f52e62b266

Filesize
235B

MD5
47f0ccb4a55c20dcc28a55c0fb7b87d0

SHA1
a45fc722a122dd50803c20d6f15f378d152dcb13

SHA256
ae59cd303bc3e26501c4f1d69ac3eb5b4b30e9e35150ea343464595c74f44fd6

SHA512
a35b66a549c419cc275983aab336b63a5a34d020b9a20402332edff2cfe0044ad0b93c867808b685580df4e387af9428d9ef0cd5e2f65ad31217be0ceae12ed4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\pending_pings\2db6cf52-c200-48bd-bfc0-eaf93f287085

Filesize
2KB

MD5
f5612ebd506ed05f5493d896e9dba447

SHA1
cea013fddc7851cf5dae65b0214631c09d2870ef

SHA256
16a91ee4c02df7b2e8e439337218e63a909ff67a2f79e5db8497d2280c43f61b

SHA512
6692617596daa2d7350749ae00a3171d06c1f314492f907fc89a09180f169e81bde5886ff3177adc81de0a1d8b151991a2de452f47e191cfad9bd3192f6ea37f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\pending_pings\6ace2081-94e1-457a-a2c1-e3f2ef83042d

Filesize
883B

MD5
3088d40bc795eeb907b728d278b1056e

SHA1
f93f84983bbdb3fd372967d8d63f54d2d9f588fe

SHA256
e05bc929abf60e5d7b868ccb3036f0170285bdce0408e099847b66bf5a7fd9d6

SHA512
5520fac136140a0d0c6a05de6d0e906c6216609fb65f8dce1ca7bf155d6f8cbcf563762404ffb0041934a52dfa12e40a4a70e9e35d55c3c23804ba9f1ebff744

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\pending_pings\864edea9-f8eb-47ce-bbd6-dc150ba577d7

Filesize
235B

MD5
2f2a20cd17ed1232dbb2ff4c53912193

SHA1
b9f7b8c19e491462afdbf661ddfa2e6b79363405

SHA256
300561f04e0c9a5dab3e5c47e61a297ce843fa7d8595a4244362135a7a18addd

SHA512
b5917a7b6b508717119276374be3769ad55568f70707a3f3ecdfe1f03b4745b7dfdd121a09905a200d135336ecff4c46254a7b93800f5f9a53fe699472c437d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\pending_pings\a40f0d0b-23bb-4d9c-801f-2fea3b88e967

Filesize
16KB

MD5
6a2dbb30c8163956ad665bd7dce176f3

SHA1
884d100f328db74e54209f31596ac1df8da5cdfe

SHA256
50bd93a7c25c427c9d93faec4fc24e998f200bf3ed3c3332936f1662c563de44

SHA512
077bdb13324e9e07efe308aad2ecc5b127c1a12af994172f1a83c0c841167a68699dd7380a0f694f7eb5e8a87822af42fb21dfa622dbdf77b1dfe022e450272e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\datareporting\glean\pending_pings\da3e630c-b101-4199-9ef3-8eff3872997d

Filesize
886B

MD5
c8c7fd754b14124c3688df4fef739c87

SHA1
71fbb9f4794cd126b482ba3d2bad2e9cc16f19af

SHA256
70b0a0cf6f392891d2ecb715baf27c4608c18d421cc9c5ac323731a4c9ec97bd

SHA512
b5651fdb91a1cd1da7dd0460d54264bc6d8ef9058734ef0376e59f5ac8f451f0a26d5f144602c288c5a34f2f6d29286ed8b3d5a76d8d7fa3a46d7715dd8c26ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\prefs.js

Filesize
6KB

MD5
1b15adfbf8aa1b5a76425cb5f7810a67

SHA1
c958abe7f4c6454d8cc69aeb41b15338d5dabd22

SHA256
edfb5b692754f6ac96dcf372af0c2f1e91d1bc2b7df2d7a9eda06570ebab71c5

SHA512
1025e18f184972a5903724f82a16e1c641250587ecb63af5dadbbfc611be871d699b67a42c4dfbe826c9e23a4b0d1fd54e51f451bd94811591d620537b77c404

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6xthhun8.default-release\prefs.js

Filesize
6KB

MD5
ec1972a63b628605969c814454c0645d

SHA1
a31de63e81f4ad4e601fd9afb7c46e586418939e

SHA256
ef33a5ce756a061e4a89049b6662120203a712754c5a67ceb04da1bb2afc6511

SHA512
cf4e957fe97c80e9e35a11b711d25a3b904c4d9e8db123b99d889ad899b53ddd2f78d65e756534e75a491fcdfe3ff39c62c78059f6ea569e395aa090da2771f7

Download Submit
C:\Users\Admin\Downloads\Radium.zip

Filesize
27.0MB

MD5
3d86110c5f6df2e32de3624237b44cf4

SHA1
9c2b5ed6405eb0ecec8c03552ba7a8302a01c041

SHA256
04e36f6674b8c12a1ab4dc71db7c4ba276181df07af0ed41ba8dd0ac3d2b480d

SHA512
a787668f0945acbd673a4489893fff8c5755f1b682e6ceda028ae1ab4922538ab7b46d65507e25141f47eb11116d2e72653eaa940d6bc34565719e4ae59bf96d

Download Submit
C:\Users\Admin\Downloads\Radium.zip

Filesize
119B

MD5
3fe102efe24cfd2e88ae1cc37c3fc806

SHA1
0091d8321be4b8c18e2324898e5056ce9e799063

SHA256
fad751bf4ae428ccf6b34924f27e8336e7435841e007a22afa0bf708541c777f

SHA512
3abd429e7b38f8c815c68b9b20dae27e14c7c984614f095adb5b3c412d834b8c18047d09895f6248ea7bc6685b1c88ccbfc66a6919f6194e98cbe2f6e712e75f

Download Submit
C:\Users\Admin\Downloads\Radium.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\ed2f835a-3e87-4588-ab3d-3e754fa03dde.tmp

Filesize
15KB

MD5
ba71fe9af283c91decffa886b7e8ca47

SHA1
022265756f475466b57b4d21a2ed93ed93352548

SHA256
4c36bac4ebf6c4d5ccbafac86323e3a002444a253d9d347e62f033fe8f4ce362

SHA512
6c7d2b2b90dc43208b79902f5007318afef535911abcff71207f6d6a661b8c8b0c9dc8b0049496aa902c92ad933382f4c9402d8bc0dc418d2b55225ae5b1c5af

Download Submit