1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260709-e6mygadv4v
SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
MD5 eb557c8a6c10e7d92e2955fea2ac788b
SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
TLSH
T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4636	Madium.exe
416	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_300021336\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_300021336\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_300021336\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_300021336\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_300021336\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_300021336\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_143430741\ranked_dicts	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	Madium.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe
4636	Madium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5772	msedgewebview2.exe
4908	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4636	Madium.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 5772	3404	Madium-Bootstrapper.exe	88
PID 5772 wrote to memory of 2164	5772	msedgewebview2.exe	89
PID 5772 wrote to memory of 464	5772	msedgewebview2.exe	90
PID 5772 wrote to memory of 464	5772	msedgewebview2.exe	90
PID 5772 wrote to memory of 464	5772	msedgewebview2.exe	90
PID 5772 wrote to memory of 464	5772	msedgewebview2.exe	90
PID 5772 wrote to memory of 5084	5772	msedgewebview2.exe	91
PID 5772 wrote to memory of 2272	5772	msedgewebview2.exe	92
PID 5772 wrote to memory of 2272	5772	msedgewebview2.exe	92
PID 5772 wrote to memory of 2272	5772	msedgewebview2.exe	92
PID 5772 wrote to memory of 2376	5772	msedgewebview2.exe	94
PID 5772 wrote to memory of 2376	5772	msedgewebview2.exe	94
PID 5772 wrote to memory of 2376	5772	msedgewebview2.exe	94
PID 5772 wrote to memory of 2376	5772	msedgewebview2.exe	94
PID 5772 wrote to memory of 2376	5772	msedgewebview2.exe	94
PID 3404 wrote to memory of 4636	3404	Madium-Bootstrapper.exe	95
PID 4636 wrote to memory of 4908	4636	Madium.exe	97
PID 4908 wrote to memory of 2660	4908	msedgewebview2.exe	98
PID 4908 wrote to memory of 2664	4908	msedgewebview2.exe	99
PID 4908 wrote to memory of 2664	4908	msedgewebview2.exe	99
PID 4908 wrote to memory of 2664	4908	msedgewebview2.exe	99
PID 4908 wrote to memory of 2664	4908	msedgewebview2.exe	99
PID 4908 wrote to memory of 5804	4908	msedgewebview2.exe	100
PID 4908 wrote to memory of 5504	4908	msedgewebview2.exe	101
PID 4908 wrote to memory of 5504	4908	msedgewebview2.exe	101
PID 4908 wrote to memory of 5504	4908	msedgewebview2.exe	101
PID 4908 wrote to memory of 6068	4908	msedgewebview2.exe	102
PID 4908 wrote to memory of 6068	4908	msedgewebview2.exe	102
PID 4908 wrote to memory of 6068	4908	msedgewebview2.exe	102
PID 4908 wrote to memory of 6068	4908	msedgewebview2.exe	102
PID 4908 wrote to memory of 6068	4908	msedgewebview2.exe	102
PID 4636 wrote to memory of 416	4636	Madium.exe	103
PID 4908 wrote to memory of 2908	4908	msedgewebview2.exe	108
PID 4908 wrote to memory of 2908	4908	msedgewebview2.exe	108
PID 4908 wrote to memory of 2908	4908	msedgewebview2.exe	108
PID 4908 wrote to memory of 2612	4908	msedgewebview2.exe	109
PID 4908 wrote to memory of 2612	4908	msedgewebview2.exe	109
PID 4908 wrote to memory of 2612	4908	msedgewebview2.exe	109
PID 4908 wrote to memory of 1148	4908	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3404.5532.9320526192294759377 /pfhostedapp:62f7262334d6fbd0a1a04212e2abe0c4f6103f8e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView /prefetch:4 /pfhostedapp:62f7262334d6fbd0a1a04212e2abe0c4f6103f8e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8e3665fd8,0x7ff8e3665fe4,0x7ff8e3665ff0
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1772,i,15942604677706203302,2902618078135735302,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:62f7262334d6fbd0a1a04212e2abe0c4f6103f8e
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2180 --field-trial-handle=1772,i,15942604677706203302,2902618078135735302,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:62f7262334d6fbd0a1a04212e2abe0c4f6103f8e
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1772,i,15942604677706203302,2902618078135735302,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:62f7262334d6fbd0a1a04212e2abe0c4f6103f8e
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3552 --field-trial-handle=1772,i,15942604677706203302,2902618078135735302,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:62f7262334d6fbd0a1a04212e2abe0c4f6103f8e /prefetch:1
    3⤵
    PID:2376
- C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
  "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4636.1700.12969835715892745488 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ff8e3665fd8,0x7ff8e3665fe4,0x7ff8e3665ff0
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,3195522079868135792,8470309497008614380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1804,i,3195522079868135792,8470309497008614380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=1804,i,3195522079868135792,8470309497008614380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=1804,i,3195522079868135792,8470309497008614380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1804,i,3195522079868135792,8470309497008614380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1960 --field-trial-handle=1804,i,3195522079868135792,8470309497008614380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4692 --field-trial-handle=1804,i,3195522079868135792,8470309497008614380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:1148
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
Size 13.6MB
SHA256 4f9daf33fa48205e687af95fba1eb84a1048ef1e07af031998ca5cac2e12e60f
MD5 7c5de79e0ffc2fc9b6c15b4e53b37437
SHA1 ecdf68f152f94eaf50318483340cebbcd4e638c5
SHA512 d7b5d53d77f9cb9b71bed255dea823d5479650129db439e7ec5d3d4ebe61b67c81855b321700229ee88daa38d4aa7ec8be0ec80ebd4b3d5745f09e2ccdfed962
SSDEEP 393216:MOhPpYIvRKErIslV0PTmIZ4nes4laBy+4qY8:z1pDloGF4848
TLSH
T1FAE6D007F24481F8C4AEC279C36B9532EA32B889452472AF57F45B112F2BF606F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
MD5 6d946a685bf8aaadcfa863364abb3fbc
SHA1 75c5e878634d581ad8b2a341249f9aa550f80bf5
SHA512 59e165eb60008fa5d19d3882a7bad4e01e4d62a8154e639be31cf1e21dadf9c28e63e2a1899a26dbd48074cc6bcaf80108f47288015ad4500aedc7ff0781ec4b
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 39B
SHA256 1d7d4e09ef38b5ee654d44295fe4a38173381dc595a4543f565685d757e3e634
MD5 1db4a98e52be5450f7ee1de11316547f
SHA1 1b1305fc04bc19e7093b13f1e29eccb93259c629
SHA512 1e1518f79d2776cc7ea40fcf37dcaab7061c8019b0e3c9a06d6fc8941ff0c380cbbf879ca75762a3aa1e9b81b8ec2b647bced51bf7f761769a8c1d97dcef3326
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 cef88d0bd38288c97f86a5235aff7497714fb1b48e31de35e84d58dea5eac43c
MD5 95cb793063cb17e3ddbbcad9f9190d0c
SHA1 cc9ccb6da8f89f3ae06292224e21b8532129c5ee
SHA512 e0bdc4bae597cca4eb41e8ae335bfe9e8e7ada73789d82855b0ca7f8305ac756babd6bc0f13410299585da5ca803e2fe2993e211b12edb7a30979c1d7406c9bc
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 7c6552729881310751b8081e5b1eed41704070f949ed09114fd50c3a104df1f0
MD5 3ee773cf234dc95e2326810c803b297b
SHA1 6982e0fad3b2f4fba812474873d7670bbfd853f1
SHA512 2d957996e7c092d7223addafcaefb19c42d8afc3e5a5221760fb44f2b73d5cb2b40425888e3bb5960cf750e174e9e3a66fe12f78e5ea0162eef4fe0659fa9095
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 36B
SHA256 432b1b0905da045cf89763944864a902757ad3a16fa38c49e2ce9eb97a29fd9c
MD5 005c26f3d60e7b6924f813eca528cf33
SHA1 012e9d2b4bc7cd9f1f71cbe88d51a6ecd17c15eb
SHA512 76e46f16df58aec4a1a410b6cd8662347b1a73fe05ee2831ec67016afffc58ad7a960660005aa3f0f5bf23302af468b9205f5759135985a6ad84ca27560a3330
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 d1c89106aeac4779658a5ca0b7240ab2b4c1219ff6eda1eac7b9c4a1b6a115a8
MD5 940ecc7e1b2b944bc8d7fc452d1ce0f3
SHA1 171e4ccf3a812d87cf5f361deb35a020b1a4c1e0
SHA512 216ae8904358a4e2367518f582e8d1f20adbd8ad9f94efadf80234fe1caf5ac79235f263606a0a6d846f9ab2e58ab272a5d93efabec108b41fd474db8b1b0704
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7a5114f246b7a834b900839d9954554cda31e46459541196582330981227107f
MD5 22c4e09464d616aff5b97678fb35f809
SHA1 602389cb012a106d88fdbf6201f9613591479fc1
SHA512 11b287a7b0ae21220c6ded5acf80f53996fa14151695eebac4c78da7cb64bc19f6365c9a42fd4ee74e9f7a314e30a1983b479ab8e66eea09330cefc239aa1885
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 05710446ede59d1eb03819cba9ee2332fa8dab2640c0c4d218be31f21f558911
MD5 e61078888cf51535105db58bb5e776dc
SHA1 06bd76cca9b0de4c6d113952a9aa7f336c1979b5
SHA512 9232e8c6f3e31e3c55627e61ac38eaea10fdf634fcdbf0a1d8af692dbe82d6504a5f86fe769010efe907b8a2c2b2ae44f2f7b8ccc06624efb0152923cd2220d4
TLSH
T131D0243333310134C0103C730033F50F0504C30FC0054105543CD51D1F0C0740D07451
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 cda84b948341f86e515cf9e1c84e1cd24d142b9ab846c24f36afc601cc2166b1
MD5 806d8c484bb3cadc9d626cdb81344871
SHA1 5ce1094f2872b13598dcd926abd38b8c941473f4
SHA512 03df9709ac42f773aafe86a80ef3b4d99526294d6739bda4d53d9730cec65fec782ce6c319c68570f6ae3caf9553504d56e4a34c23059b1fc220c22318063044
TLSH
T13ED0021227676CE4C74CD57123ED3550B1B2C88CCDA33D5654FDD0B5A8953145627F46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d7d8.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d7d8.TMP
Size 48B
SHA256 5703b8703b10406415526e532ae95df00adffe4450663cf9bfa5c37f8b6d43cc
MD5 9f1d153b0f6bc3d2dfe55232da9445ce
SHA1 5883a7defd810f2e7ea4017da0827fde92568c0d
SHA512 6005cdce78e79cf19e6e42448ba5536f92f23a45cc019f3d608205a58ce050ad03cee3c4b74e0449c869f4c754d35afc8077261081465e5c5b479462daa46f40
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 f3c7e1f95647c54c6be6f72346bbfd1d5c5f447123aaa04f00366ad52ca11789
MD5 00fce9c03fc8085604dd62d51f7062da
SHA1 3716c2e91782066ad73ba373e55746f17fa3031d
SHA512 012790cfeef8824092a6944cf92d3d2d5332b13f0782fe5556e21a1972b1e9a97e91c56e18b13ba84ea2dd7e35e88b00752cead86069445116dd557f146c410e
TLSH
T10421AFA287E4C66D8A1126E027347C17CD2E091992282D27CDDBFBD567E2471E22060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9a6c.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State~RFe5a9a6c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 e4c065cb13d6d96ac07cf24c21cb2fb3c7266b44b297805ed394ab6b9a4f04f9
MD5 246188dcb9f36c9dd94e0a2fd843d583
SHA1 3bc9743affeeba88933e03aa5a346bc6afffd243
SHA512 070058b4e0b4fab64549f48553226ade6dd753dd097f58b978efcffb1d3da902b61e554d87f6766eb7c4f594a76ba9f38ab348d8d2051f0c0de7801203f3c5a9
SSDEEP 96:stY/d10GUG9b9IkLjo5h16Z01s7/x+6MhmuecJKoMFNjeOK+gudRxb28XM1C7K:st8jgkon1sV+FdKo2j+QbG6K
TLSH
T177D1A8126E28697B8CC7E519BB297B53E2F5607265D12D48EBFC461C04DB6CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b366d370-2e25-4c46-ac99-ebe181799fbc.tmp

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\b366d370-2e25-4c46-ac99-ebe181799fbc.tmp
Size 6KB
SHA256 eb5b7b993049df2ec7f52c79c2da832db4dc50e07aa85b89ebfb8d3f6e7b3a3e
MD5 ae28ff743787d35bd28096818b3c389e
SHA1 611bb56c2d6e5902a033be65775f99a9deedef6d
SHA512 a98c05a91d45a673b234eb853f0cfdcc46f0dd219a68e4c1b4420209667a1be86231fe5afa6f52f8c607089a1543fd1505ba7289416689b5d32d268b5172b2ae
SSDEEP 96:stY/d10Gd9b9IkLjo5h16Z01s7/x+6MhmuecJpp1ejeOK+gudRd28XM1C7K:st8jmkon1sV+FdppQj+MG6K
TLSH
T1B9D195526E24697B4CC6E519BB29BB83E2F5607265D12E48EBFC871C05DA6CC2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 b557cff91664b1f56d2d87624ec5fec6a349562f9aefe10a8fee8fa37ca6df1a
MD5 164eaf19357e498d59c3689cd3ff27f6
SHA1 934607345b993d66b0b4db54f6bdfbe54bd3f492
SHA512 789418f94fdab6864798da47cbb1ff856401dd0c12236cfa3977097d44acec9519c51736f1f971465583f23353fc09ec8bbd62177c514184c441d25796e0fd4a
TLSH
T1F85185736850AB37E5B296057A8B6EA3CF7951A6AB932F50A6DC070801D755C3313C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 f5878a04b5b895a01b68e2170cc6ae42bad8ed0805cf03a19cbc2ad5b850ca62
MD5 8c8527165d267642259261cd394f0918
SHA1 25a4c79290d20200633b5dbfbaad499a9ebd887e
SHA512 4c94d413f2adbd638d5dae284f605850ac03bbb80dd4592f103f6bab77d641fbfd88c1b1ff4377f9033316fb25058603a1d3f29f37965ecb3f85a0ef2626d92f
TLSH
T1AA71B87768A0AA3799F2D9057D862F56E7A55037E6D63F54E6EC0F0C01C72982313C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 15KB
SHA256 60e9602cc20705f87ce2a337779d9335c8945d14f9b5c21804e538d87e42ab86
MD5 f38c21248a4742f2ff1f9f0a1d8f5920
SHA1 7aed3640d20cb6fc685b434070dba33483e138a8
SHA512 51905b250fde82c96e7f38d4b7d9bec458f941d9437ecb657ddb562ef0a5ac8e9f63087c3bdb05c2866f5e717117de324c3dba781f7fd34d9d825960c8e09c5a
SSDEEP 384:ssrv+89zHqlDNP9oid6NBSFdLlu1isdA0NN:Xrv+4UNbdr541isJNN
TLSH
T13E72B033A878B733ADF2D805B48B6A477B7C50A752C35AB4E5591B8D028B0C93307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5984f5.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe5984f5.TMP
Size 1KB
SHA256 e5db4f487c12fd9087eb8f1eed7f4c76a5bd34b8f40fd5d25f2a4124cd2e2a19
MD5 df0b104ee106195a2672261c738aa075
SHA1 faf90087cb0ff10db13d1be783dc97f63cd9d730
SHA512 8ae4ea43bf75ac48850178aa6c669180ec325940eddd45fc7fec8b8b8c3aa820729aabe8401d6ccd862d8286f7cb598fe358f969c7a748ff4dac99b35adbb1c6
TLSH
T12A3174B3A4906B32F8A2A6463647AEC79F7541AF92928E00B5DD470902D759C763B831
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 952a3119a3bf9540854e9682721137019e7123562d627c0671e0231e11d01338
MD5 d54b03914930ee6a9f51768bd6b796d8
SHA1 e3e12cff63acf7584f6e892ab2d6ebbde42106c7
SHA512 00bcda06ad74c95b05b53b5674a117c9ca1457ac0418176b4a9847a3a327fad1020e301ac370a586bb99aa4eea117b857125f328498d7ea4b02207bd295b3cc1
TLSH
T109D02B13F210037DC45030730252E1382F03B64F10464019982C8A1CA92C4E74B82CF1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4c72c368e70e9f64eadebd2847035e0767eedcfcda5b25c60001c3e8d53681b3
MD5 5478e06c9d6697944716fdf1ba146cd4
SHA1 b81098c6206d9ca938932fcac00d82521b5b9388
SHA512 59ebf3f355714769e13c21a6ce53b11dfb566cf5f1b50e78a272ac585e78635f99f50ea81a4c31bb16ab01acf9411b9e5311601db9f36e451575ace0aed1843b
TLSH
T166D01212F2410278C4502133011361081952C94F404940445828891D6A2846019078D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4811e290544018febebcc01dec1cfd64e1936ef54e6860aced7ef3bae3a07e9a
MD5 5371ffb4c2a30976dc47dc12ef9f0328
SHA1 64a3d178069ee38edc066247a06a1b0f94db6c33
SHA512 888ba2360fde2983dac2da86acec3f6562c0524a259209a1f6aa3f1251478ac46e1217eeb28b2aa4bc7d5e8c3b6c9dd0ba8c2b4e73ed99a9b4392ceaf3b3ad96
TLSH
T154D00450F1400144C4C111374131411017774CC70055014404500404547451050074D0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Local State
Size 15KB
SHA256 e105ef1dc79fed150f02be429045f73fc8b25e20670fcdc554368b76e4080c8e
MD5 0d3bcb8265ba449164788ab39c769db6
SHA1 2102b82ac48e639c97d6e5bb1bf9469c3d700429
SHA512 bf8f46acabb7eb7bfbbc1af2c10f7675321d4d83c65cdb0595b39111930d4c3d7e7bc49a285dce55dacaa782622dcf57acf5fb22ccec7a4071707a8738b59071
SSDEEP 384:yjsrv+89zHqlDNP9oid93NBSOFK9giqfTisdTxNJ:yYrv+4UNbd9nqWTisTNJ
TLSH
T1BA72BF73AC3CA633ADB2D945B48A6A573B78506752C21BF4EA991F4D02CF0DA2307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Local State
Size 2KB
SHA256 018ad022ea683a9c0bbcd22b5bf03c039bbcd110f627e64b096b154cc2fa19fb
MD5 b4c2e8d53db758414e60a69204b0627e
SHA1 9b414d11ec1f0932b66465b8f2efbc655674ec1c
SHA512 8228ed7ea02e79f0c6658a994f68fb6238b9f8b21da2c2d1baf341457bea488ddcebdde644b7408abde02d29ebab491d78dddd032a38d5a6b10d90d278e5fa93
TLSH
T13B5195737C15A73799B39A497E4A2FA39E3550A5A7522FA0AADC0B0C01CB51C2703C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Local State
Size 3KB
SHA256 2b1ce2093c9ca13c8837d69a134407881af0f41bf2b96256846a801f15a7cbbd
MD5 b3283430c4b39a17fa3f8cae59389d60
SHA1 0a4cdcff935523513108b422bb67690af8a52cef
SHA512 810e883a82144bdb439a432c03e218663665ada9ae68a086507ff5430945ce4da8d3b5ce769709ce9fbabdc67b8a3ce8b470e936cf86fc4e7713896d0d5bf40e
TLSH
T1D771B5776D65A9378DB3DA457D852B56ABA55037E6823FA4EAEC0F0C01CB24C2313C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595857.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{AB473F8B-53BF-45CB-AB3F-857A36385EE7}\wv2\EBWebView\Local State~RFe595857.TMP
Size 1KB
SHA256 e35edac2d750e9084e08077f6dd6c37d0cb8b49a4612032f53be76a91af1984a
MD5 d67afd5c804f880b4cd670085ffb2586
SHA1 92289f739b4c9f5931703d84ba016890d4431aee
SHA512 f991898ec337968d6695587bc79e049393c1deb9a50e874d99238b6768169660e7b6d35792c1ae3ab2bf35ee28f99239b7fb113ebfbde3caae376130da702765
TLSH
T1433196F3AD655732FC52A68B369A7AD76E30007A83520F9476DC470C12DB14CAA3BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-30-0x00007FF904A10000-0x00007FF904A11000-memory.dmp

Download

memory/1148-634-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/1148-629-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/1148-635-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/1148-638-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/1148-633-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/1148-637-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/1148-636-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/1148-627-0x000002405E150000-0x000002405E151000-memory.dmp

Download

memory/2376-117-0x00007FF904A10000-0x00007FF904A11000-memory.dmp

Download

memory/2908-560-0x00007FF904D20000-0x00007FF904D21000-memory.dmp

Download

memory/2908-561-0x00007FF905440000-0x00007FF905441000-memory.dmp

Download