61ad8875a65280d8a0f35d50e35aad2f07a3c3cc853923f5e3889fa3baceeb2e

Analysis

user interaction
yes
max time kernel
93s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RadiantBetaTest.exe
Size 255.3MB
Sample260730-2fln2sycrf
SHA256 61ad8875a65280d8a0f35d50e35aad2f07a3c3cc853923f5e3889fa3baceeb2e
MD5 93169eec0390855c2ed56801a19083ae
SHA1 01ddbc023920c20f2e773b0b4c660adef0045635
SHA512 65102b960eed6417b05176a2548bea28132d0df05e811bea375759160b87fa9f885f267438a518edafe53c66d4e37cb758613b0141d861656659f68f9caf29da
SSDEEP 6291456:tfv0rGnC73exzNJjZsYiDTzMk4ilw/8bn:tfv06NxzHjhk4V/O
TLSH
T1BDD833EF718F743EE038237139B66222B57A4D623511CCB2B6F49D8C97104E45E6DB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1960	RadiantBetaTest.tmp
1008	Radiant.exe
2912	Radiant.exe
3440	Radiant.exe
5388	Radiant.exe
4028	Radiant.exe

Loads dropped DLL 10 IoCs

pid	Process
1008	Radiant.exe
2912	Radiant.exe
3440	Radiant.exe
5388	Radiant.exe
2912	Radiant.exe
2912	Radiant.exe
2912	Radiant.exe
2912	Radiant.exe
2912	Radiant.exe
4028	Radiant.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
30	raw.githubusercontent.com
34	raw.githubusercontent.com
69	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 16 IoCs

discovery

Process Discovery

T1057

pid	Process
3796	tasklist.exe
5992	tasklist.exe
2848	tasklist.exe
2612	tasklist.exe
5688	tasklist.exe
972	tasklist.exe
2864	tasklist.exe
5756	tasklist.exe
1208	tasklist.exe
3792	tasklist.exe
1672	tasklist.exe
2084	tasklist.exe
4056	tasklist.exe
5188	tasklist.exe
6020	tasklist.exe
2620	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RadiantBetaTest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RadiantBetaTest.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3176-0-0x0000000000AB0000-0x0000000000B92000-memory.dmp	innosetup
behavioral2/memory/3176-15-0x0000000000AB0000-0x0000000000B92000-memory.dmp	innosetup
behavioral2/memory/3176-177-0x0000000000AB0000-0x0000000000B92000-memory.dmp	innosetup

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Radiant	Radiant.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Radiant\URL Protocol	Radiant.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Radiant\ = "URL:Radiant"	Radiant.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Radiant\shell\open\command	Radiant.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Radiant\shell	Radiant.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Radiant\shell\open	Radiant.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Radiant\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Radiant\\Radiant.exe\" \"%1\""	Radiant.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	RadiantBetaTest.tmp
1960	RadiantBetaTest.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeDebugPrivilege	3792	tasklist.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeDebugPrivilege	3796	tasklist.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeDebugPrivilege	5688	tasklist.exe
Token: SeDebugPrivilege	972	tasklist.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe
Token: SeShutdownPrivilege	1008	Radiant.exe
Token: SeCreatePagefilePrivilege	1008	Radiant.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	RadiantBetaTest.tmp

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1960	3176	RadiantBetaTest.exe	89
PID 1960 wrote to memory of 1008	1960	RadiantBetaTest.tmp	91
PID 1008 wrote to memory of 3872	1008	Radiant.exe	92
PID 3872 wrote to memory of 2400	3872	csc.exe	94
PID 1008 wrote to memory of 2912	1008	Radiant.exe	95
PID 1008 wrote to memory of 2912	1008	Radiant.exe	95
PID 1008 wrote to memory of 3440	1008	Radiant.exe	96
PID 1008 wrote to memory of 5388	1008	Radiant.exe	97
PID 1008 wrote to memory of 5388	1008	Radiant.exe	97
PID 1008 wrote to memory of 5388	1008	Radiant.exe	97
PID 1008 wrote to memory of 4028	1008	Radiant.exe	98
PID 1008 wrote to memory of 4028	1008	Radiant.exe	98
PID 1008 wrote to memory of 3792	1008	Radiant.exe	99
PID 1008 wrote to memory of 3796	1008	Radiant.exe	102
PID 1008 wrote to memory of 2612	1008	Radiant.exe	104
PID 1008 wrote to memory of 5688	1008	Radiant.exe	106
PID 1008 wrote to memory of 972	1008	Radiant.exe	108
PID 1008 wrote to memory of 2084	1008	Radiant.exe	110
PID 1008 wrote to memory of 4056	1008	Radiant.exe	112
PID 1008 wrote to memory of 5992	1008	Radiant.exe	114
PID 1008 wrote to memory of 2864	1008	Radiant.exe	116
PID 1008 wrote to memory of 5188	1008	Radiant.exe	118
PID 1008 wrote to memory of 1672	1008	Radiant.exe	120
PID 1008 wrote to memory of 6020	1008	Radiant.exe	122
PID 1008 wrote to memory of 5756	1008	Radiant.exe	124
PID 1008 wrote to memory of 2620	1008	Radiant.exe	126
PID 1008 wrote to memory of 1208	1008	Radiant.exe	128
PID 1008 wrote to memory of 2848	1008	Radiant.exe	130

C:\Users\Admin\AppData\Local\Temp\RadiantBetaTest.exe
"C:\Users\Admin\AppData\Local\Temp\RadiantBetaTest.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\is-6RNCAGQSAT.tmp\RadiantBetaTest.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6RNCAGQSAT.tmp\RadiantBetaTest.tmp" /SL5="$B004A,265113988,865280,C:\Users\Admin\AppData\Local\Temp\RadiantBetaTest.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Users\Admin\AppData\Local\Radiant\Radiant.exe
    "C:\Users\Admin\AppData\Local\Radiant\Radiant.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /optimize+ /platform:x64 /out:C:\Users\Admin\AppData\Local\Genesis\guard.exe C:\Users\Admin\AppData\Local\Genesis\guard.cs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3872
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8831.tmp" "c:\Users\Admin\AppData\Local\Genesis\CSC5DA939986B884B049E4E9CBB6B32AB66.TMP"
        5⤵
        
        PID:2400
  - - C:\Users\Admin\AppData\Local\Radiant\Radiant.exe
      "C:\Users\Admin\AppData\Local\Radiant\Radiant.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Radiant" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1632 --field-trial-handle=1668,i,9038908688045862864,11174137444562281953,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2912
  - - C:\Users\Admin\AppData\Local\Radiant\Radiant.exe
      "C:\Users\Admin\AppData\Local\Radiant\Radiant.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Radiant" --mojo-platform-channel-handle=2036 --field-trial-handle=1668,i,9038908688045862864,11174137444562281953,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3440
  - - C:\Users\Admin\AppData\Local\Radiant\Radiant.exe
      "C:\Users\Admin\AppData\Local\Radiant\Radiant.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Radiant" --app-user-model-id=com.Radiant.launcher --app-path="C:\Users\Admin\AppData\Local\Radiant\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2748 --field-trial-handle=1668,i,9038908688045862864,11174137444562281953,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5388
  - - C:\Users\Admin\AppData\Local\Radiant\Radiant.exe
      "C:\Users\Admin\AppData\Local\Radiant\Radiant.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Radiant" --mojo-platform-channel-handle=3084 --field-trial-handle=1668,i,9038908688045862864,11174137444562281953,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4028
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3792
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3796
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2612
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5688
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:972
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2084
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:4056
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:5992
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:2864
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:5188
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:1672
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:6020
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:5756
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:2620
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:1208
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq Radiant.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guard.exe

Path C:\Users\Admin\AppData\Local\Genesis\guard.exe
Size 4KB
SHA256 d02985437d841f23ce725e9799a4ebec5bb099b143b4af789b0f32a98e038e73
MD5 e58e3efe913ec6a570137b19707d8ca0
SHA1 4dd49cb322508d7613c2148056d1004683cfac5a
SHA512 b1568d9d6ce3db4299e5ed687105407c7fe31051409324cf30475ce4011e5305cb24155c8f25da8c47d1f39dbb2f6f194da9735ec3182640410996a27ebdc43d
SSDEEP 48:6Iye4m9Ox9qcc19wONdQAXFJ7eiiVA4IVVNUhU01x3sm+XOGOulyTXqXSfbNtm:P4UP15Uow4j07J+vkTJzNt
TLSH
T1DB91B843A3D88766E0EA433469B303113BB5FB914A7A975F2CC8416F7F6774049536B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Radiant\D3DCompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Radiant\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
TLSH
T142F3E1D7B7B4EE3DCA5752B7626600B1ECB7452807A1434B178BD8763A72348D8C8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Radiant\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
TLSH
T1F024E1CB67B8DD3CC96706B3622601F1FCB6113856B6525B03DBEC357A9668988CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Radiant\ffmpeg.dll
Size 2.7MB
SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
MD5 fa145097e0274da929aacd68c31338ab
SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
TLSH
T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Radiant\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
TLSH
T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Radiant\libegl.dll
Size 467KB
SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
MD5 5db499ae909083620e47eeea1623b2af
SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
TLSH
T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Radiant\libglesv2.dll
Size 7.4MB
SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
MD5 57c23aa2c39f11528e56a48ea1824036
SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
TLSH
T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Radiant\locales\en-US.pak
Size 428KB
SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
MD5 809b600d2ee9e32b0b9b586a74683e39
SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
TLSH
T110944C1FF7442229069312627F09A6A2FF36D06DA35112563CBD812C33B6B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Radiant\resources.pak
Size 5.1MB
SHA256 1d241f5d4403a6e802e898c61e4753f8508ae4dda8fcb7750558ec1ecade52c6
MD5 0e69910860463d5045ec257234bd8dd4
SHA1 33c923c33129d1dccf0bb2dcbe8af983a7000444
SHA512 f6bb7c7b51bb202877739801498522095637caf8a03e2e1f2c6319fede3d3ca656f552061e171ec5e35e176c267fe278c326805d760add1371590bed58e12375
SSDEEP 98304:Ct1j25juJgWPVcz+cd31rJ7JBXbwHgf3IvVrwrWBpcdmTHWCF3UlfPcauPFcHNp:Ctp8CJPdB831FJ5wHwOVkrWBQmTHWo0l
TLSH
T1EE363320F6385C36D0F0A2BE816812738B39D8139665781DB1DF932C5F7CA5E85B47AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Radiant\v8_context_snapshot.bin
Size 627KB
SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
MD5 1e4da0bc6404552f9a80ccde89fdef2b
SHA1 838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA512 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417
SSDEEP 6144:LlAKlrnVVc/eK7cPg9oCWCNM+MFjfjfGJCWXecRvUsoA4EytPcAzCYY:LZ0t7cP+Yz7Vcrz
TLSH
T176D48FA3B345CF67C1642DB0BACAD656B5B43449BF4A062B7368A3BE37396311F14072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Radiant\vk_swiftshader.dll
Size 5.0MB
SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
MD5 583b1d71cd7b847ba02d734c508cd92f
SHA1 d63966aeafa951d51967620c606e9b97399699c4
SHA512 cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
SSDEEP 49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7
TLSH
T10E363813B2858199F05DD5794B5BA632F632F8801B72B6DF52A00F192E37FE06B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Radiant\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Radiant\vulkan-1.dll
Size 925KB
SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
MD5 47af18d68dc7cf271f0a92707f783f64
SHA1 64594e92a1cd7042cf6367b1843abed210db3d78
SHA512 2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
SSDEEP 24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo
TLSH
T171156D139A94456AD476D034C8C28607CAB178921726B9CF03685B087F6FFF4777EB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES8831.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8831.tmp
Size 1KB
SHA256 cf5f892b965840981da0db2528fd0782a8c8082724029a95af7d3a10b6eba9e0
MD5 a97b0472f5fbdc3593af2e25417216fe
SHA1 4c73142c7dab937f9095e00b88c5df20b07d3087
SHA512 bed661e9c01c71a289b3060d66c7fef903b9c79006e6326b597f27f95625df9fb6eddeb7a13d7971bbaf0d9c903dbe478136762e39223e348563deff77f1b6c3
TLSH
T18A413141C3D88B1FF172433129F79319A7B8BE969EAA475DB184122E1F12744CEC35B1
MD5 SHA1 SHA512 TLSH

Submit Download

RadiantBetaTest.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6RNCAGQSAT.tmp\RadiantBetaTest.tmp
Size 4.2MB
SHA256 a15bc0a130aeccb3323d80b4550ce03df15c76c227f9b96bac8b27453ca39da2
MD5 c376b5e0fb54ccd56a90cf839cab459b
SHA1 3979293d8fb833ff9f8cf99a6d9e6af92a3e1b09
SHA512 62224e9d07e41e2f2578aed2dfc8a46bcda9a9b2c38a02ac466252ddda581b1dce4e84b025543a630624d9027efdbd9aa5faae21d1ed8bd4d9e45ab2d011056b
SSDEEP 98304:Q9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JU333Bm:nItJj90Z6RgKwq
TLSH
T187168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Radiant\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Radiant\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Radiant\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Radiant\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC5DA939986B884B049E4E9CBB6B32AB66.TMP

Path \??\c:\Users\Admin\AppData\Local\Genesis\CSC5DA939986B884B049E4E9CBB6B32AB66.TMP
Size 1KB
SHA256 df686d5b53c93f4d7c6590c8c29878a00f9094112435373333d0a9bec78c547a
MD5 da26b83de55e094545063cfc62872289
SHA1 5f09a24bf412f47eaf3b0f1ebc6afde073c79a17
SHA512 3b3e93c49e4bc5dfc53f2610b5974bf77b646625e226c646d5766d3ba82dd60d6603f16f0cbef2644376493c57443fb5000c050816170a59af31dd4dbf3e668a
TLSH
T1E221AB81A3E8821EF2B3477069F2C36292A8BE568D7A43EC3488175F1F256018583AF1
MD5 SHA1 SHA512 TLSH

Submit Download

guard.cs

Path \??\c:\Users\Admin\AppData\Local\Genesis\guard.cs
Size 2KB
SHA256 9641dc3141ae1af25cb28ec7c333f4775deefdbe991e1b5f9d89b5deaa801a2d
MD5 be30cba09693424c06f18c6a3fcccca1
SHA1 d3e18bf95272a599436c9a2368135bf5ee682f0a
SHA512 ef02baffdb141f13892d9ed6819f31474a095b642114542869d6c362941107dd155987c3168566e190646eeab1f0bbc9869269348bb3eefa5be8a1067a4c1734
TLSH
T102514F5469AE15A159F7203A2F4B0407BA97C167037ECD20FDFDC326CF0A4268AF8669
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1960-16-0x0000000000B90000-0x0000000000FCD000-memory.dmp

Download

memory/1960-159-0x0000000000B90000-0x0000000000FCD000-memory.dmp

Download

memory/1960-17-0x0000000001B70000-0x0000000001B71000-memory.dmp

Download

memory/1960-176-0x0000000000B90000-0x0000000000FCD000-memory.dmp

Download

memory/1960-6-0x0000000001B70000-0x0000000001B71000-memory.dmp

Download

memory/3176-15-0x0000000000AB0000-0x0000000000B92000-memory.dmp

Download

memory/3176-177-0x0000000000AB0000-0x0000000000B92000-memory.dmp

Download

memory/3176-0-0x0000000000AB0000-0x0000000000B92000-memory.dmp

Download

memory/3872-188-0x00000147A64F0000-0x00000147A6E94000-memory.dmp

Download

memory/4028-293-0x00007FFA98D00000-0x00007FFA98D01000-memory.dmp

Download

memory/5388-243-0x00007FFA98900000-0x00007FFA98901000-memory.dmp

Download

memory/5388-244-0x00007FFA98B10000-0x00007FFA98B11000-memory.dmp

Download