hxxps://c8646cfef541ce7a451ebd88b9074efb[.]r2[.]cloudflarestorage[.]com/filerift/2bb2ddcd-a3df-47f3-803a-e68f3737eebd---Madium[.]zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=43cf367050590a138cc183e7557ba614%2F20260701%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260701T190828Z&X-Amz-Expires=6000&X-Amz-Signature=74c75be737beeb88d964390b69e8a39e7b59a840c5790ae3e9efe436b09b05cf&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Madium[.]zip%22&x-amz-checksum-mode=ENABLED&x-id=GetObject

Analysis

user interaction
yes
max time kernel
6s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://c8646cfef541ce7a451ebd88b9074efb.r2.cloudflarestorage.com/filerift/2bb2ddcd-a3df-47f3-803a-e68f3737eebd---Madium.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=43cf367050590a138cc183e7557ba614%2F20260701%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260701T190828Z&X-Amz-Expires=6000&X-Amz-Signature=74c75be737beeb88d964390b69e8a39e7b59a840c5790ae3e9efe436b09b05cf&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Madium.zip%22&x-amz-checksum-mode=ENABLED&x-id=GetObject
Sample260701-xtv3esey21

Score

6^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
14	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4364	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4560	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 4744	5380	chrome.exe	88
PID 5380 wrote to memory of 4364	5380	chrome.exe	90
PID 5380 wrote to memory of 4188	5380	chrome.exe	89
PID 5380 wrote to memory of 4188	5380	chrome.exe	89
PID 5380 wrote to memory of 4716	5380	chrome.exe	91
PID 5380 wrote to memory of 4716	5380	chrome.exe	91
PID 5380 wrote to memory of 2376	5380	chrome.exe	93
PID 5380 wrote to memory of 2376	5380	chrome.exe	93
PID 5380 wrote to memory of 1196	5380	chrome.exe	94
PID 5380 wrote to memory of 1196	5380	chrome.exe	94
PID 5380 wrote to memory of 3980	5380	chrome.exe	95
PID 5380 wrote to memory of 1728	5380	chrome.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://c8646cfef541ce7a451ebd88b9074efb.r2.cloudflarestorage.com/filerift/2bb2ddcd-a3df-47f3-803a-e68f3737eebd---Madium.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=43cf367050590a138cc183e7557ba614%2F20260701%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260701T190828Z&X-Amz-Expires=6000&X-Amz-Signature=74c75be737beeb88d964390b69e8a39e7b59a840c5790ae3e9efe436b09b05cf&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Madium.zip%22&x-amz-checksum-mode=ENABLED&x-id=GetObject
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffac6c4c728,0x7ffac6c4c734,0x7ffac6c4c740
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,6147971845058803989,14339159717829709874,262144 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,3244230589842545141,7600169781182869758,524288 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,1706429973024875759,10173217737036096601,524288 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:13
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,9445132132447758164,10939046359045256612,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4299619378388411690,13914756155295765321,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,6643251641666462503,1464304658492971399,524288 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,5476750367186033588,12110989419108003702,524288 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5744,i,10787443736141720179,5369993131289651094,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5916,i,1380182026899527568,10068774610798725834,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5744,i,1568421138725818647,3247295725690149369,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6052,i,5332688939304932192,4196509345343197519,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6732,i,1339906287986549375,9369888295732696366,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6880,i,14907762281890403443,18278551734519385398,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=7044,i,6346877354418961534,9881384510483351112,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=7172,i,144072265192765280,14910603564747125649,2097152 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6968,i,13960760041290195031,17396348926950619414,524288 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6916,i,11367873158009441208,5208240183388865912,524288 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,4644319433104798994,3395851833947771904,524288 --field-trial-handle=1944,i,4926585937080735082,713281570446530437,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:4292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4612

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1276
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:1380
- - C:\Users\Admin\Downloads\Madium\Madium-Installer.exe
    "C:\Users\Admin\Downloads\Madium\Madium-Installer.exe"
    3⤵
    PID:2788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /F /IM Madium.exe /IM Loader.exe >nul 2>&1
      4⤵
      PID:5804
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Madium.exe /IM Loader.exe
        5⤵
        Kills process with taskkill
        
        PID:4560

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1884

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 02b5f6e68e1b90264d78060edfc75096917e45c691b06c9c7fe3c6c7389041b2
MD5 469bae3f90a4da2c814daaaf85236661
SHA1 14b933a4337531b20316f42be8be0ae5bcff6b78
SHA512 26dbdaeb9a34a9deb0f4bffb9f8aa01632570aac85a9257ec21ac3c5f86591316d831abc00a1a44aba85ac7850fac1c3cb6986494350390bc60184502064df51
SSDEEP 192:/3Rw8BDI4v7zlvAPRp2y9XHsb+WNnNbPvbdeG3VyIsnAUge:/3Rw86kl6XJxwBPrRe
TLSH
T12932B66EA914653B5CCBC229FE757B57DBF6102131D42E80EAFC9A2C12D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e7f764db55ffe1754f492a4f288b1be4216b41d061dc3296d726fabf378edd5d
MD5 22430c0f78f7263bcc6c1de3500b2bbe
SHA1 192a10a360bfc1ebe63c5b2dc14cae6fff322288
SHA512 d8cff1e9512a959268522068fe534c499bc372006a76821cc65f1ebbd62591dab716064aaeef06d32e8edb7ae64c94a11ae9a4240ad92ddb4d8235c658f049d6
SSDEEP 192:/3R18BDI4v7zlvAPRp2y9XHsb+WNnNbPvIde93VyIsnAUgE:/3R186kl6XJxwBPrRE
TLSH
T19232B66EA914653B5CCBD269FE757B63DBF6102131D42E80EAFC9A2C12D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 5b1076f123f034dbad12fd70fcac4dd13385313bb4ac68852cfa16680d92f202
MD5 ffd880c4ced2ec7f511dec142dbbacda
SHA1 ec6e980c118695ccbcfcf55037f229e31a3fe5ee
SHA512 ae6b90a306c3c068462e7ea215706ae911167ade130e9cc618c74328784fc94d74e477b75f48d24b0ecc0a881ad4c9883449f0d18ff5295f8743b8272362a073
SSDEEP 192:ewL4K6th7KxkXqK4I40pUZNCgVLHrKHfFKslEAZP5XzKD/+5+ErUkKN9+hfmH637:RLjGh7KxkXqKf/pUZNCgVLH2HfgslV5J
TLSH
T16C32D71BA48D9A7F4FD8D41CCC526F8BADF5029672680D2496FB9D0803A57CE114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9fce4d1de78708137691daaf1ddc889144cba5902fc4fb422475eecbc7acf501
MD5 9689064465e31acebb6833588578a3da
SHA1 4f693689339cd5ac82fca7bf51e8667cb6b39f29
SHA512 0c35d562d5a75321a7bb626b808bfa44da4cde627e73a230c853a9e266d32fc94e9a27c63b32722365c30aa81c419270a418727a922b8e67045d1a8600e3e347
SSDEEP 96:FC68d+laPzyON3b/fVvExrSl8h4otop5uFDcB6hdGyvvwcCtPL1I054v5iygPMSi:FCPmaPzyONr1vmiU28wSwJcime2wPMSi
TLSH
T166C1F972A46CEC336AF7D895B1073E978EB4216B9651AF68DAEC1F0C02EB1DC1347412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2f6a4e2d9cd8b5e811e89ec83f9f44a27d8db700cceb4d8f1486422963765824
MD5 5884926b6617a66d645b7738f5c3e8f2
SHA1 ac9ef83d3d04aebaf88007be5ea14ed077fa2957
SHA512 41d14d7651d7a261208a80cd1c79cc2db4462d5f78dbe5caa070da0f09cc983da305d0afc6d9c1963388e2408193bb2e0f7fe38c0ba37bb819c2518fed6a4948
SSDEEP 96:FbJ68d+laPzyON3b/fVvExrSl8h4otop5uFDcB6hdGyvvwcCtPL1I054v5iygPMf:FtPmaPzyONr1vmiU28wSwJcime2wPMSi
TLSH
T195C10971A46CEC336AF6E895B1033E978EB4216B9651AF68DAEC1F0C02EB1DC1347412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 51d0840bca164a6b5eb929ba1ff5c47d094724a942514303ea6d9d7e4e43f6ce
MD5 7c94862815ed8720b1ae3f3fdb1087f1
SHA1 ff0d4a47345201197aed3ca3acc8a5406f191009
SHA512 0abcf0923f0b43d26cc9c9db6a558376d3be2a37fbef9b3d240f763107ec8b36f1cbbdfe1da56d4510ab0a6002d1e7f595eaf51c72ef7bcc681c6264edcfe897
SSDEEP 96:VC68d+laPzyON3b/fVvMxRRDotok5uODcB6VddGyvvwjNSwb7v4a:VCPmaPzyONr1vmDUDtwQdwJjNSwbf
TLSH
T143A12872A028DC3359B6D485B1072F438FB4616BA621AF98D9EC2F0C52F71EC0342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XRZ1TMA9\microsoftwindows.client[1].xml
Size 1KB
SHA256 4f7c01363112fd12f2796e1ab09f5a34b2fbfad00bb852d3d787b791fc453b64
MD5 a5decac82c19ae2fa28c75b6dacd37ef
SHA1 d16f82bb23012bed76fdaddf11a3b708847fb38b
SHA512 653d5a134703168c55f281e91e98e1b1b04d4aa4c153f112a8f9e33c822e1ddf760465039f1c27a875ddcde21f46a0873b83bbd7f88a5642ea9eea5842a49916
TLSH
T13331C42C9AF34F2E2C0DB43AE6C42388678F931BA5E933EC1CAC7EC46748905511B465
MD5 SHA1 SHA512 TLSH

Submit Download

Madium.exe

Path C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe
Size 292KB
SHA256 eddd8ae56b0d99a54e42e6513c2407feb9a04862b1bb4e653d95202b0d428cb9
MD5 aed4208c09192b11575928b6589c7d89
SHA1 d804e20ad189fc84ab723c6d02fe73098370ea98
SHA512 bfdce8db16d094fc563c3ab7182909d721512cebf3c7cc4b4d463417b6e9a0e0b48fce08e52f98f41ecf34f978c5c847acce9675de98caaae68ce8b13b51b63c
SSDEEP 6144:Lz91xGhfpZwz/JZI7xqdn5pjUsvVm7MVqWX8ijE9WbdaeJ5PTQYbeHxHA7op9hr6:X91xGhfpZwz/JZI7xqdn5pjUsvVm7MVP
TLSH
T143544A71A178A23E012F368AF270D314D7A7A31BD79856F5B93ED2B857C3C84EA53058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2788-391-0x00007FFAD27D0000-0x00007FFAD27D2000-memory.dmp

Download

memory/2788-392-0x00007FF70BF80000-0x00007FF70D4B6000-memory.dmp

Download

memory/3324-382-0x0000027400440000-0x0000027400623000-memory.dmp

Download

memory/3324-207-0x0000027401EE0000-0x0000027401F00000-memory.dmp

Download

memory/3324-208-0x00000274140E0000-0x00000274141E0000-memory.dmp

Download

memory/3324-241-0x0000027414500000-0x0000027414520000-memory.dmp

Download

memory/3324-216-0x0000027404040000-0x0000027404060000-memory.dmp

Download

memory/3324-549-0x0000027416D70000-0x0000027416E70000-memory.dmp

Download

memory/3324-195-0x00000274001E0000-0x00000274002E0000-memory.dmp

Download