1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26

Analysis

user interaction
yes
max time kernel
47s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260702-dthybabv3y
SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
MD5 eb557c8a6c10e7d92e2955fea2ac788b
SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
TLSH
T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Madium-Bootstrapper.exe

Executes dropped EXE 2 IoCs

pid	Process
2764	Madium.exe
1204	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274359048390065"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies system certificate store 2 TTPs 10 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe
2764	Madium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3796	msedgewebview2.exe
3644	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	Madium.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3796	1280	Madium-Bootstrapper.exe	86
PID 3796 wrote to memory of 3828	3796	msedgewebview2.exe	87
PID 3796 wrote to memory of 1496	3796	msedgewebview2.exe	89
PID 3796 wrote to memory of 1496	3796	msedgewebview2.exe	89
PID 3796 wrote to memory of 1496	3796	msedgewebview2.exe	89
PID 3796 wrote to memory of 4372	3796	msedgewebview2.exe	90
PID 3796 wrote to memory of 932	3796	msedgewebview2.exe	91
PID 3796 wrote to memory of 932	3796	msedgewebview2.exe	91
PID 3796 wrote to memory of 1504	3796	msedgewebview2.exe	92
PID 3796 wrote to memory of 1504	3796	msedgewebview2.exe	92
PID 3796 wrote to memory of 1504	3796	msedgewebview2.exe	92
PID 1280 wrote to memory of 2764	1280	Madium-Bootstrapper.exe	97
PID 2764 wrote to memory of 3644	2764	Madium.exe	101
PID 3644 wrote to memory of 4832	3644	msedgewebview2.exe	102
PID 3644 wrote to memory of 4460	3644	msedgewebview2.exe	104
PID 3644 wrote to memory of 4460	3644	msedgewebview2.exe	104
PID 3644 wrote to memory of 4460	3644	msedgewebview2.exe	104
PID 3644 wrote to memory of 2660	3644	msedgewebview2.exe	105
PID 3644 wrote to memory of 3572	3644	msedgewebview2.exe	106
PID 3644 wrote to memory of 3572	3644	msedgewebview2.exe	106
PID 3644 wrote to memory of 2188	3644	msedgewebview2.exe	107
PID 3644 wrote to memory of 2188	3644	msedgewebview2.exe	107
PID 3644 wrote to memory of 2188	3644	msedgewebview2.exe	107
PID 2764 wrote to memory of 1204	2764	Madium.exe	109

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1280.4936.379312497656744083
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x13c,0x16c,0x7ffd733cb078,0x7ffd733cb084,0x7ffd733cb090
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,8302952270664069696,9995719843919786763,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2056,i,8302952270664069696,9995719843919786763,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2388,i,8302952270664069696,9995719843919786763,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:8
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,8302952270664069696,9995719843919786763,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1504
- C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
  "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2764.4600.7655205897757791216
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x190,0x7ffd733cb078,0x7ffd733cb084,0x7ffd733cb090
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1800,i,14457075081009386201,1122227858487468617,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2080,i,14457075081009386201,1122227858487468617,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2336,i,14457075081009386201,1122227858487468617,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3508,i,14457075081009386201,1122227858487468617,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:2188
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
Size 12.1MB
SHA256 22ab8fc7741b02dc860e8b60bfe7636df3fc093134a563952e6332522ee96c13
MD5 285d39bfe1ef5d225c0660ccbdd5b1ca
SHA1 c2ab18ea9e7f4d75bff9de6ac952c0df7edc974b
SHA512 8ec38c52e778ae4f96ae7f29c6ea7c2bb2978157cf50feed8ef29dca5c71afe9485c930ed160cc92918b63f70dab44318e5fd861ca93eff072e39ca4e61e564c
SSDEEP 196608:lzJrOkaKfwtY1Irn+D7BgDTEmPAwatIj0DK/kLw2:3ba8wtY1I7+HBgD1I6E6kL
TLSH
T114D6BF07F24481F8C4AEC278C36B9532EA72F889452472AF57E45B112F2BF606F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 566B
SHA256 3d74df71a27d274da9e5a74ad10cd50099087cd1306431aa68c2a46b8f5b9e62
MD5 0bfd97673b1ab3962a7c5668fd850d91
SHA1 f68f6e1e786fde1b565e21270b399f07982e37a3
SHA512 2199d5e0026db220afb388c0721f23dd968d46900168cfd1e864ba7a91b9bfee5edd5eee525d1004da4ffdde92526c64978c1786ae283644a3ddd2a8985be7a0
TLSH
T181F08B7E9C021376AE92E64688C4324385346116FB7181ACC3F5582C82F716D2867C93
MD5 SHA1 SHA512 TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 1KB
SHA256 b1eb397856dfcd45ce0972af9f2175d1ed25d0c5be42768a87addfaed8464585
MD5 83fc8bb757f50732569af012608a1425
SHA1 acca4375dbca024b2060b25c1a7a364c549c0274
SHA512 361b458685e88fda5a013a86e1e450ea23549e74b38224eca213ab27c6bdaf366d0899767c184adf91b72bbca37d2c3ec505f77a46f4e3ee3a1df74e1f01d078
TLSH
T165118C7F9C021376AD92E64698D472138578A117FB7181ACC7F59C3C82E716D1C6BCA3
MD5 SHA1 SHA512 TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 1KB
SHA256 9a0c9bfbec7235ea0817f9ab748a9d9998a8f6cdf0f73116b27ba91077222692
MD5 dc10efc5206c9af9df74ba44dd288916
SHA1 d2a14f989ffc23ce65edfd73e1b7e34720cd9b74
SHA512 f986543d4b07149415e3a22e0ac5a059ac09806e39e7656bc1b5062e008a48db404f4e6ecd3159b21f9672e5ebe4218c68107c863727cf522e781c6fc0d2bae6
TLSH
T1EF31897FAC021379AD96E64698C47257C5386117FB61816CC3F65C3C81E712A1C6BCA3
MD5 SHA1 SHA512 TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 2KB
SHA256 d8df6ac0c266cd4db0f9ceef86f9764455a14512ecc6977d398b5d27f81a5434
MD5 8fc45686d9f789f55b2d393ac7788405
SHA1 34ff7e7f28967231a667f294c3fa33c6ec9aac9d
SHA512 18da287b900263ab60f1e5e4fc5d00dd1e025fa8629e9e12c82034aafb0ed0a5d30602c272a9450f44a1c00d72d7330a94f4b25cf09b36d33cae0da7a9369f71
TLSH
T11041DB3FAC021735EE56EA4698C5726395386116FB2181ACC6F65C3C81F726E0C6BC93
MD5 SHA1 SHA512 TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
MD5 6d946a685bf8aaadcfa863364abb3fbc
SHA1 75c5e878634d581ad8b2a341249f9aa550f80bf5
SHA512 59e165eb60008fa5d19d3882a7bad4e01e4d62a8154e639be31cf1e21dadf9c28e63e2a1899a26dbd48074cc6bcaf80108f47288015ad4500aedc7ff0781ec4b
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 39B
SHA256 1d7d4e09ef38b5ee654d44295fe4a38173381dc595a4543f565685d757e3e634
MD5 1db4a98e52be5450f7ee1de11316547f
SHA1 1b1305fc04bc19e7093b13f1e29eccb93259c629
SHA512 1e1518f79d2776cc7ea40fcf37dcaab7061c8019b0e3c9a06d6fc8941ff0c380cbbf879ca75762a3aa1e9b81b8ec2b647bced51bf7f761769a8c1d97dcef3326
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 cef88d0bd38288c97f86a5235aff7497714fb1b48e31de35e84d58dea5eac43c
MD5 95cb793063cb17e3ddbbcad9f9190d0c
SHA1 cc9ccb6da8f89f3ae06292224e21b8532129c5ee
SHA512 e0bdc4bae597cca4eb41e8ae335bfe9e8e7ada73789d82855b0ca7f8305ac756babd6bc0f13410299585da5ca803e2fe2993e211b12edb7a30979c1d7406c9bc
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 7c6552729881310751b8081e5b1eed41704070f949ed09114fd50c3a104df1f0
MD5 3ee773cf234dc95e2326810c803b297b
SHA1 6982e0fad3b2f4fba812474873d7670bbfd853f1
SHA512 2d957996e7c092d7223addafcaefb19c42d8afc3e5a5221760fb44f2b73d5cb2b40425888e3bb5960cf750e174e9e3a66fe12f78e5ea0162eef4fe0659fa9095
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 36B
SHA256 dd8a4802d926cc5cb036b8c52c6f580ab515f0fe21a11cdf59374433c4e08081
MD5 126459641609806250231f9b02730f87
SHA1 dd8309d5eb3a0479302c6af289bc644c5f2fa48c
SHA512 00ea30a87dda3069a67acc70451a7c07ac1f844889f7d07d4b3b98635376b1fa663627d77b0ad13d00b3cef4645795501939b4c41ed14a1a4a1b7ce7b4ef54d2
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 36B
SHA256 c8d89df060705d2971c39f7338698d24d0e0ecb3f7537e9f541cb66fb2fbea20
MD5 455753c61598ccfc62eadc858d70793b
SHA1 569cd3d6f1ccd4c491df9bb5d0e242f2c4d86ac6
SHA512 e9f3e0e9d4fe1dbc3025420cb71e056c4566dea7f21f34e93d96c468c074460b8536e1475b0c5cc42496eb392f49c0aef7ac52ca21b975be74d00c267b128906
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f65b4a0eb5d462a9d8098d4fb7fbbbb2010c8e1607595b6c8f56d1d1fa81d774
MD5 3fb5a142103f3bce9d913474cf979232
SHA1 6fc280220655f6f72d6d3db348f491a90552e6e0
SHA512 40d475943c91644708b82184a69fb1aa4276d26ac8742fb9f2be076026716ecc64a982582555d1bf9d7870fc24835a072fa7d2c68d37cd78a96a4f358ce32937
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b94fcb6837f3493c1f7560ddfe51e682533d4a4e6e2393d1dd3cf16993f4328e
MD5 4865c062a888b132d6c59437c915646e
SHA1 9af824a1b5f9c7136b7b11e175c5a431642a0839
SHA512 d77ce9c695140fa5115515ae14e85b300af51f8a1dbec5f7c7f12fecf4589e087b6d8ac5d9edcca7317c6427cb6f80bf50a0165b4171ebbe259bbb544758757f
TLSH
T171D0243373010174D13033330043FD4C0541C10F40454141753DCD5D1F040740F03441
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 03e2a7813ac3996161999170df1149589092a938f4349fc4e3fd451336f1ebd0
MD5 6f3fa1c6d16883483e6a1e29749b4b81
SHA1 bf84f20d19e35c8e878050f6ea6bbf11a32cf9ca
SHA512 b9de6effe3b17092ed1e3b2ba0209a7d13d8c0a3c56b44ba456b019255bd0f3869c20df903486868abc89115b1dd906e635ed40988b93922c479337295384755
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 6343e55c99fd06850438a7b1da7bfa341c5ce509fa8628d8972115f94f4c5cea
MD5 72e743c58ede47849179ee34ef7d0008
SHA1 9efa733a1aec792ebc3b297f1249b3295df4e00c
SHA512 006712f0b2dec6ec6f46a70782ee4d3808e936a15eaf15625c087d05d2976a85eeb77eb910ccb1c4b01cf2340be0649ce69e3edb08c9b75862ef31579ddac985
TLSH
T104D012B1572B39F0D336407010E803CE3534CBB12653BD91C1A32079A2647A28F39019
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 b56f9c809aa979244454cff7cd118d3e30e02f0b57c1af6ebd68d6ed727bab44
MD5 35fd713c3d06b17349510624679136f4
SHA1 06e6a29fc0e47a1b1d68033b6cf2c7b599f3e382
SHA512 f1394f8b577c7474c28dd43850e45cdbabcf94ed9a07d54e978d64dcc601744db1fe45b0a12a3df5d052163b36dfd96f18386c4622e50aff812c6046427c0982
TLSH
T15E718573A9A4B9374DE6EA41B8862B0BBB615136D6913F99D9EC0F0C01DB3D82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 16KB
SHA256 23d524341718aaa2508e6f94a2dc20afc32a96adc05cb0f8c99d28d21e19f60b
MD5 10dfa9cb811625a6902d6b626c376c38
SHA1 0c91625596ea468e825581d8961a9537e0a6b108
SHA512 7f832b02c4484279d0ea33e273e41bfcbefb6067916588acf1b50545d709357e93c3cf8409e2a7f38d01434437fa1613713f78df32d888951de6a218b9119d40
SSDEEP 384:zCsrv+89zHqlDNP9oid6NbhcBISCavwyINd:xrv+4UNbdwbKvwyINd
TLSH
T166729D33A468A6334DF29945B48A6E0B7F7851A695921AE4D9EC0F4D42CF0C92317D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 1KB
SHA256 c026e7b0885ecef657c4680084e3bde50b78967573572fa5b933039c65bf78aa
MD5 043429e937133a52a0fe94ce7d110dfb
SHA1 82998dd9abbfe31a139fdec6b4f761c44c345176
SHA512 58848c8421717e4b90dc95da822e418417ccf351f63830777d03187794d8e35d818bb8660e19c463e4b3657f2d58176fff8aef99dd817d6a44a188e00a57c94a
TLSH
T1EA3112B3E4D47F325DA5A6537142AB5FAF215069D2114E4865ED4F0802DB29C6279C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 d98d06e2a43daf1dbdc059d392e224cc938eac73e2c06276296095aeb4f98fe1
MD5 39aff6eba66830d287c915618b6768ee
SHA1 eaba7de4ad88228af94d682aa9947f3940346685
SHA512 e6723d3e62b3b6221a22f9e361590a82b8ab37ed203d6226058f8dc4166b812969eb61049803aef4e5a49aa14edd8c6544221475e281f60b57512ceacb96706d
TLSH
T1FD51B473B854BE334DE69651B9462F1BEF329060DA622F9496EC0F0C01DB29C2356C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe585a6f.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe585a6f.TMP
Size 1KB
SHA256 bbeecb8d152b82346835a5e395af59fef399538b28b8ff6c5e6f2c6d77003444
MD5 552ff20cc8b69341fd94b59dd3944d23
SHA1 effa836bf11eaffa7df0488c4f79e50bbaeb5f22
SHA512 f552e023e81819b3521c61fc61d460bcb5139430d5f1f4cf7615ec1b3faa4579e2bcaebec878784c96eb18132ea7c4d490899099bd3159ec04c6b153a7f192de
TLSH
T1C72132B3D4D47E326DA59653B142AB4F6F609179D2214F4DA1EC0F0802DB6DC627AC33
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 00f8c9647bec75eac96e7110b8ceb987a6b01832c8d6a593b7c64bd62d9f2be9
MD5 776f3a1b82de828a823a0d9f0e3e4b77
SHA1 78619307fe03d2a6a2c5b9c16e2f0e7955f46b6a
SHA512 6b0b23dfc98ce731a5d52e2d60f2de3dc1f65660f9c97bff9373c4d882cb1c294e56f12144fc3ef27e57ea7bdb8430f0f5ed4dada38a3363f3bd71233910a800
TLSH
T1E8412658A6E91148B3B72F4A9BF2A8AE087EB9372F06D45D00110E4F0622E01CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8b9efc94309fa19dcbc1abd87d3a7ab2f32543d36d7a8add45999e6e5e501cb7
MD5 ca12d606335d13e9792b727fe051ee2c
SHA1 9c2a1ce5a373e2278517fdca151928faf5acb6ba
SHA512 84bc243f4bda3ba16fe01617ab46ec4941e31ce58e4baa1b8dc9de4efb51246203c715dccae9e221ad1fe19294777241a7ada5895683777100d1377cd05c381c
TLSH
T193D0125232128534C01430B3145261081600C50F41494000742AC61D1A6C0980A06843
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3f1738b8fe55bb66e1d3b92752cd554d3bb7b69be9a6a7b3bf893865d0b64447
MD5 eb2de287cb8124440a167f6582824e90
SHA1 f8d8bb8691d2c841568db60c4bb45170bd7255de
SHA512 1f515419a7eb3ba7e59882db1fcb49d07c0ece0c8a9e0fd3931d5bdfd7b7ef90560c49bf7c7b9438c1391c616de827aa4c51373b563def27c031cabf73af0231
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 d1bea401e42ad794461629e7318f205aabbaa2b0b6cc16cdaf4d105adb8444f0
MD5 7d53d15640fb488445ec93653f9702f9
SHA1 0f85fb58def1ec060e3c51d3d39b9ec279532bab
SHA512 611438f54f70405d56c8001e7caa3b64380dfa23f6edf8397b130138189152c1a5c96cd51db303aca359555d37067a59f18bda3c2d666c5ad20cac140fcf6594
SSDEEP 3:LstlNllkll/lbd+/:LsX3lEtc/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 0eccabfb25d462c71a00e8296ff73e6264946040d5700308529b6a6359ffd78c
MD5 275c4d883db0039132e8d34fbdb0bd09
SHA1 78e7f16ed5985e6c3a1c16e1ced39ab77acd09e5
SHA512 265d400c6d93eb45c222d00eb04f7c925d53d7db6e21c5371b0513e165e1f908fa58efac9b3fe43084b5a27562c9a648879a80fdb45e36a94e6324a9783b045f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9934957dcc460038b3e6e995a9e0d5c6f445d8db3f86244207a3b1b69ba857d8
MD5 6d0a8fdaadebf77df58bf3aba198fd4c
SHA1 67df88390d01f97104524413c082136d497c4aa8
SHA512 7024fdfa0e0d888e8f03de30956251efecc0fed95805f8ce6a7845fd6123cb3bd8cbce5b464412fd84cf203bac46b73ff8d75e280feafe11b1efc1220520a6c4
SSDEEP 3:LstlNllkll/lhRu:LsX3lEtO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 f8211855568b69bceb403e2296cf90b8ce516cc3b42ed0549b67e59a4c751924
MD5 b21c676400be22a9e6adfd2273302d81
SHA1 f6719faf4aed6132be97f0441db7d7374521f096
SHA512 61c3d4992a33608c74a727b73134c6bbd8b2c041ba8405a9323669372425111e609e61af2ff12d1b57cdd4012f363af6c13e04d167474b236bb0dec7e2b56e8a
SSDEEP 3:LstlNllkll/lzu:LsX3lEtzu
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Local State
Size 1KB
SHA256 c83a7b49f738e11c16f2295b96c45e911b693b44056ad2b7b9c207e04d5d5260
MD5 edbaf56f83ffe4d26f60a7b3508643fa
SHA1 d01365cb3030b0e5a1a4840d4217ef37a1cac9fd
SHA512 e78ee2b548bb5cd78b91116b471a142431e481964bb7a20963bd6f60125e41e5b25a98119e12e00090ef9e2a4f312b6072a2980e7da6a894b35825a55e60dac2
TLSH
T1693182B3E4C43F3229A6E68272472F4F2E301069C2555F4492ED8B0C13E72CCA62AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Local State
Size 2KB
SHA256 522b2c9e20f0779cf1c698bf8fabb92d9cd527cf6c3526c9c8719e7a39d1b246
MD5 fef3a1f04d653798c8c840d6722c8100
SHA1 0965b184f40f6d8b4d2b6226481d4057590db08a
SHA512 2a973a6fd9311792bcbfb38873ea5998176542d989a6db7337feffb663e14542d3dd0f25cc618780da43a977400462a6997dc9bce236df76741f554d91ec4e76
TLSH
T112519773E884BE7749E7DA54794A3F1BAA355061DA522F5099DC4B0C02DB59C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Local State
Size 3KB
SHA256 ad16dd3741da48aa68552be8961fed74910f25082cbc69e303c055fa423dbc06
MD5 cfd9786582b2fa553847be6cc51f3fac
SHA1 5466d0230d2c41c7c8df65199c7d4c3b05a30b6e
SHA512 77cfb50e4ae0ae592815ddd3b427cdf051e704fcf133a72b35f9567725857ef252dcbd2f2f294e0476db5e145a0a70f85650036690384778a1161414a9ae9294
TLSH
T133719633A8A4A9370EF7D941B9862F0BB6A51126D5D53F94D9EC0F0C02DB2DC2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Local State
Size 4KB
SHA256 9a7e3cced525ceb0d0e276800d48b1f62ccfb4eb57f1213732be9d781abbfd52
MD5 6d6e80d6d6c52c700af2bc3cd49c3ad8
SHA1 fe7aaa1e7eaae6918fc0ac202de466b5ffcd6f46
SHA512 78219ade1bc8f89d634b0a6f2926458ec4aff56389b5bf1caecb41c7e58be3903e6ccf496a001f65e960866fe0d0f4a746eac5838f12be11d3d65366f41eea80
SSDEEP 96:zuA1F3NkCE/fHLAehTW0W58Frh/cInURoDotoTLQpDLXKB10jTv6vHSZhZW0TYhe:zJF3NbqLAe0KooDU4quejg6hf
TLSH
T12891B73298A4AA374DF7EA45B9863F0BB6655066D6953F99D9EC0F0C02DB2DC1302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583bbc.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BAD30B69-F575-4855-8E77-251B6DD6A596}\wv2\EBWebView\Local State~RFe583bbc.TMP
Size 1KB
SHA256 87fb43257e5e2fe0201c12a256ed2ead8b9bb213a32c06bc54c997c23828e1ad
MD5 10f56bb731ef3b6927633a2a9bebf431
SHA1 12762dab76b6fc521a59537ffc9dfa910efc3b01
SHA512 f8db18a8b03105b159440e61fec9e5d6c33f1f87c256304e1d721f6f8103e2914c948b004cac474e09d4a1543e71ca4b2730ff257aaac914ed064b1015d4fd4b
TLSH
T1BF2132B3C4C87F722A969995B2466F8F2D601075C2546F0891DD470C13AB5DCA626C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/932-51-0x00007FFD8F570000-0x00007FFD8F571000-memory.dmp

Download

memory/932-52-0x00007FFD8F580000-0x00007FFD8F581000-memory.dmp

Download

memory/1496-29-0x00007FFD8EC80000-0x00007FFD8EC81000-memory.dmp

Download

memory/1496-474-0x000001D1DA580000-0x000001D1DA721000-memory.dmp

Download

memory/1504-133-0x00007FFD8EC80000-0x00007FFD8EC81000-memory.dmp

Download

memory/4460-609-0x000002D948B80000-0x000002D948D21000-memory.dmp

Download