1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/07/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260705-svjcssds3y
SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
MD5 eb557c8a6c10e7d92e2955fea2ac788b
SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
TLSH
T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5960	msedgewebview2.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 5960	5936	Madium-Bootstrapper.exe	85
PID 5960 wrote to memory of 3044	5960	msedgewebview2.exe	86
PID 5960 wrote to memory of 3624	5960	msedgewebview2.exe	87
PID 5960 wrote to memory of 3624	5960	msedgewebview2.exe	87
PID 5960 wrote to memory of 3624	5960	msedgewebview2.exe	87
PID 5960 wrote to memory of 1756	5960	msedgewebview2.exe	88
PID 5960 wrote to memory of 1424	5960	msedgewebview2.exe	89
PID 5960 wrote to memory of 1424	5960	msedgewebview2.exe	89
PID 5960 wrote to memory of 5932	5960	msedgewebview2.exe	91
PID 5960 wrote to memory of 5932	5960	msedgewebview2.exe	91
PID 5960 wrote to memory of 5932	5960	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5936.1632.13237740029538577711
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb7080b078,0x7ffb7080b084,0x7ffb7080b090
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1804,i,696770936800890131,17391564048963393897,262144 --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1884,i,696770936800890131,17391564048963393897,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2240,i,696770936800890131,17391564048963393897,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3560,i,696770936800890131,17391564048963393897,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:5932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e78b26f250fb565b4955e8afb36991d8ae1cc9518790aa664f7d597fd3d98ad3
MD5 4b23c19ceaebb248aa86968a2cd36789
SHA1 0f9965f0806f668b3d6a7d29d61d55a674f20667
SHA512 d61c099c641643f17fbf7765b0ca9cadd82940517ea3701a988b263b11b77857a09879d8af52d9f3d52bccbc86bc0f8ca68b6b7e3a1ecca5d1e076bacf641403
TLSH
T134D012227303837AC01030731046A60C1846C10B4005410098BC895E3E184D40906441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f86c7139205f5ac881448b5601b48a334c4341649f36b1af83a47649715b445e
MD5 873c6b2dcb45bd29aca542b35819b5c8
SHA1 ba261363db24bb4a81d7c7f40849b96893dacc81
SHA512 81ae3c3ab8172e6bae3e1373386eb7b4c3b7b3e5693ccbddb0794b5a982f10453d587fc2f584e639f1ec2fb2a5362bc3e43fc10a1b71d8db28abb474e410a4fa
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 dda5de4872c84a9bdcefeaa014a9cb631c2973625f312d4e9a890f8b9d93ddbb
MD5 f1e9ff9866b2058c4b3dfd1fe79bfb88
SHA1 a0580978ba436b11dc31f76455f81c0a1e01b08f
SHA512 ee12ae3618e9b046a411191b26f514b3151c5d8a7a51922dcd26a66c39afeb9aebc13c9c8a7e9e81bd8e642898f6bb39375b023b78ef485260ba70902fbf3839
SSDEEP 3:LstlNllkll/lFtl:LsX3lEtF
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 50e515b7eb28d6e2e293ee1d7ce805d9628c077563eab6704de627af6295a4ae
MD5 00b160e5073a4b2730dd00374c1bdd5f
SHA1 6e6e0b4eecf493c1b37aeea4fb834c7ddf27dfd1
SHA512 84a862c4c90466c95bcc95dc4e4f14940fa70302d94ec7e0154067ee3802c3145c01a28d86e8ac13308777a6e74671df277ff5d2e687ed89dad196ec6f52f5bd
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 b70a405d07c714ace69c95b99d54436ccdd44f199abfe1c0a470eeb7a4ff5684
MD5 f351f4fea842a5ac5ceed79fd503ea2b
SHA1 c04598b8f2b95675697031103fd8944ecbab6b9d
SHA512 4c17c08259a7a9bf9ac73fcd5a2334976bd89705606cd7b48bdbab39ac2915c38ff1481f9a3aee6db416864aaae895c5b8ca57d4aa225a61f4b300cd76027d2f
SSDEEP 3:LstlNllkll/l1pl/:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Extension Rules\LOG
Size 373B
SHA256 910d20927f7d0e07f7fa0d5357d2f1039a95ff80c3cc988cdf72b8db3b0ea1fb
MD5 c561b651538308492a8fe3be39dbee12
SHA1 2a4a8611df61b09e518d09a728547e75a6a7fc56
SHA512 a9df4cf9f9858e0a111ccf0fc0cb5299d2bd7c9406cf7d0b231b05cfca232b7d9879cbb916371885a5e0c62521cea8e0cda96f8008b261a1c46047a66eb4148b
TLSH
T111E068026A8B865616C8BDF2E7B8934CCB40282CE7987B144F28DCE4680794DAFD1B47
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 377B
SHA256 f81dbef31d29d1039ca66cb085692e2888835f4bc9d1b61eb1b6d50ded134a76
MD5 47fd208310419b79b82e9ca0babb43aa
SHA1 fad696503b3b73fce246f0a67dc803457b713330
SHA512 3c9941d36046d9318345e5930db828b41a55d9af795fd92a5d12aaf9492a340179740fa6f0c48fb1d0a4af7415d69dcaf9a7f3d5226b6e0407a1b378b8a0e14b
TLSH
T118E02B045D9B966615887DE356B9A34CCB903414E798BB144F24DCE4580B90C9ED1B46
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Extension State\LOG
Size 373B
SHA256 3e01361c3124c17cf4368ff049b667e154f0a192c65845f874cac0b5ff7befe8
MD5 d2726a2909ec7e9bae269e7796f3cbe6
SHA1 2e42367bace4614b49815db737233e828a8762fd
SHA512 a060d53b439e93f31f9742ceed39bdeabb0625914e9d98cda23568f1893aeb9bc359e373e817abaaf9e83291c865f28ae25b8bbcb6560983882213adab116f16
TLSH
T151E068105A8B86565AC8BDF397BD934CCF803428F7986B144F28E8E4580B94D9FD1B47
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 313e72ee6956a46165394f33ec28e6ab6fbd284b181068e54d4250b78a8a2dca
MD5 a6fbc981c91cf2dcb4f6b42e1a9604f9
SHA1 fa572b7b3bd279d0d4448e4f0781da5216c90ef2
SHA512 1c6ad2d5f95d5279888790c77415842475e81d88c2216f5f077364ca4e28754ce28c7a4c9bedb6cd55e4888f8882e2349dbaed12b442baf5fe08e99493287915
SSDEEP 3:LstlNllkll/lrRa/:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\History
Size 184KB
SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
MD5 c77e3d0b59e286bc3b50eff7cb8f464c
SHA1 b260bf6f86fb9aff5b2396bfb49dea658a6f05e5
SHA512 e9d95b19019dda281d5cdc16315ae5368b3bab7786955354de93dabe5885c958c556a09e4b57a707244e0052cbabb00029619deba1810677bf9ea06e7287e8fb
SSDEEP 96:xhBttejzH+bF+UIYysX0fxQp97fEHt/DfLjLqL/hbgI4VgNr2jWRk/E0:xhBqH+bF+UI3iWGVfWN3qL/8VgZQW3
TLSH
T1AA04EC1E5F743612CDBD513668E745B3597CF03F8B636AC62CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Local Storage\leveldb\LOG
Size 383B
SHA256 c2a0c8957416a13d27a82004c337f20794fd26c94530d1e4b59e18b117d32fb4
MD5 e94f903acda11209da86b3f643af779d
SHA1 c526c0165529a39e10b9ee3bd5635fcc1fa0ce83
SHA512 a93363ae64c1f3beb3e3c4d86f1261648272343a458f6793cf6119a881377761dec5af989db9e6c678f4141afb978da7c7d83210a0743c86c1c1a0e6274fc98b
TLSH
T1EDE0AB915A4B825A178C68AA6238F34CCB202429EB986F488F20B8D0EC0740C9FC1787
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Login Data
Size 42KB
SHA256 a5c1d3aad1ea6dfa8484d39b4b6239529889661a0a4d9643175df4d5915c7afa
MD5 cf0d378139d518ac262a5cb0979f238d
SHA1 94a24d2046879c9b26347909eb02cae09d40fabf
SHA512 d856b2d705188592828b2f277967f269ed46e5154d9e20b955b0e131d8de964b400672d167043be454104429be2bb5f285a3c084cd578aff2ffeb5363099bb4f
SSDEEP 96:ALlpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:ALlrAG7Iw9ftFqidn
TLSH
T17613350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB144259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Local State
Size 1KB
SHA256 7dc58a845540eef137fe108c44e2af7518c8c467bc5bbe0fbbe5665a63fbff4f
MD5 14303baf1e449fab4cdcdbf1918f9819
SHA1 cceca3bbc8dab886eb2e0971532632b7d76d0403
SHA512 e8f1af5a8880d8c17039070da69b39273ba8846ab9d06fff720ede799a8639d6c528680cf9d76a1ca39c99cbf3fa30ec4ea4e027f418aa077fb7ed14b5ba484b
TLSH
T1103142B3A8942F36A881D28A71463EAB6D21106AD1500E88B6DD0B1C03E72DDE53AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Local State
Size 2KB
SHA256 8591aacfdd45f442862afbfb082e4ba36de97640ecfff1ac06f16c867b0c7153
MD5 831a8c439c0e16106600b3197b46ab3c
SHA1 6e0ad9dbfcd478fdbd7735d154d943c66bb2f6b8
SHA512 97fc1dc408b656be7fa77fa21b118a4e8f6385a5aa1e30f8ea9896e3a88b223bd31f9295a3551100ae7ab92f35db5690dbd181422f851c8d51833cd8f961b771
TLSH
T1555194737C18AB3789D2C688798A3F27AA365165D6912F85E9DC0B1C02DB69C2316C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Local State
Size 3KB
SHA256 ec086ce5261f634007ec6fda8ea825c8e8113504f61b782eb86b4d6cc9fda85a
MD5 c6785ce2a1c275ceaf4a2544b4eb1b80
SHA1 d6d8621e3fefb7541251f7dae4987dc64b36bb89
SHA512 09d0100b70fef876327c12b42838827550eb9be2006efbf4712cdc38d62208c1519054dbe6cf9a0ac9b0fc5c584dbfb947ee516788277e8c624fecb7251baff7
TLSH
T1267195726D68AA378DE2DA49B8863F1BB6655127E5903FD9D9EC0F0C02DB3D81352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Local State
Size 4KB
SHA256 3f57d81fc136f8ea374ca82be4e1c14907bb308c076756ff981fb5ba636cd642
MD5 f166d21cc4a0e3a52c19c168bcbc1c2b
SHA1 f9dfc118be0999b0a71ff84e82a4d53f5bae806a
SHA512 6dcc43e1c8b7d99fc7662e05f57df4c2be02dbdee7d1465c079387f8493770230167438cad2a3ec4d86e985a50fdb6a2122bcd911b2b43f8bb9677ccbe7fdafb
SSDEEP 96:zu3LF3NkCEcDfyG19at058Frh/cInURoDotoTDRsDzB7Da6bPZUOZWTGlca:z+F3NbOGOooDU496t7DiOeY
TLSH
T18791C5226874AA378DE3D649B8863F17B6655023D1942FD9D9EC0F0C02DB3DD1352C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589ecb.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B1E9CE67-41FD-4606-B4D9-5A8CFFAAC41C}\wv2\EBWebView\Local State~RFe589ecb.TMP
Size 1KB
SHA256 3d6b78b4a03eadc11e3858cc34d81cd9ee22dbef28adea421f259bd9d17e2ab1
MD5 c46739274d00b9b84ab5f24296a4ca3c
SHA1 fedacf8d61c475e7ab1f0f92a4eaf047edbae7e6
SHA512 1ca8e8e4f77802678d8064b25a967c3df9cf92e9f71e49d9f852b4cdc6f653782f470f1f90a07b660690e7a93d8cd9954b3093480dfb0f41598ec92fa8ace825
TLSH
T1CC2140B3D8986B36A981819AB1427E9B2D60516AD2500F4CE2CC062C03E76ECD67BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1424-97-0x00007FFB8B5B0000-0x00007FFB8B5B1000-memory.dmp

Download

memory/1424-98-0x00007FFB8D200000-0x00007FFB8D201000-memory.dmp

Download

memory/1424-350-0x000001EBADF80000-0x000001EBADFAF000-memory.dmp

Download

memory/3624-82-0x00007FFB8D120000-0x00007FFB8D121000-memory.dmp

Download

memory/3624-351-0x000001B2343A0000-0x000001B2343CB000-memory.dmp

Download

memory/5932-100-0x00007FFB8D120000-0x00007FFB8D121000-memory.dmp

Download

memory/5960-352-0x0000020000000000-0x0000020001000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads