1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26

Analysis

user interaction
yes
max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260717-22sz9acv21
SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
MD5 eb557c8a6c10e7d92e2955fea2ac788b
SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
TLSH
T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1660	Madium.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288031264228322"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	Madium.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	Madium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Madium.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe
1660	Madium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1240	msedgewebview2.exe
3928	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	Madium.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1660	Madium.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1240	4252	Madium-Bootstrapper.exe	85
PID 1240 wrote to memory of 4940	1240	msedgewebview2.exe	86
PID 1240 wrote to memory of 3348	1240	msedgewebview2.exe	88
PID 1240 wrote to memory of 3348	1240	msedgewebview2.exe	88
PID 1240 wrote to memory of 3348	1240	msedgewebview2.exe	88
PID 1240 wrote to memory of 3840	1240	msedgewebview2.exe	89
PID 1240 wrote to memory of 2268	1240	msedgewebview2.exe	90
PID 1240 wrote to memory of 2268	1240	msedgewebview2.exe	90
PID 1240 wrote to memory of 4168	1240	msedgewebview2.exe	91
PID 1240 wrote to memory of 4168	1240	msedgewebview2.exe	91
PID 1240 wrote to memory of 4168	1240	msedgewebview2.exe	91
PID 1660 wrote to memory of 3928	1660	Madium.exe	110
PID 3928 wrote to memory of 4880	3928	msedgewebview2.exe	111
PID 3928 wrote to memory of 3272	3928	msedgewebview2.exe	112
PID 3928 wrote to memory of 3272	3928	msedgewebview2.exe	112
PID 3928 wrote to memory of 3272	3928	msedgewebview2.exe	112
PID 3928 wrote to memory of 628	3928	msedgewebview2.exe	113
PID 3928 wrote to memory of 808	3928	msedgewebview2.exe	114
PID 3928 wrote to memory of 808	3928	msedgewebview2.exe	114
PID 3928 wrote to memory of 1808	3928	msedgewebview2.exe	115
PID 3928 wrote to memory of 1808	3928	msedgewebview2.exe	115
PID 3928 wrote to memory of 1808	3928	msedgewebview2.exe	115

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4252.2008.10650641615880477642
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa638fb078,0x7ffa638fb084,0x7ffa638fb090
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,14368712311734528477,3791975979697716690,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1920,i,14368712311734528477,3791975979697716690,262144 --variations-seed-version --mojo-platform-channel-handle=1352 /prefetch:3
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2308,i,14368712311734528477,3791975979697716690,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,14368712311734528477,3791975979697716690,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2612

C:\Users\Admin\AppData\Local\Madium\.staging\Madium.exe
"C:\Users\Admin\AppData\Local\Madium\.staging\Madium.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1660.2276.12375127495210206802
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x190,0x7ffa638fb078,0x7ffa638fb084,0x7ffa638fb090
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1824,i,15055268601476506151,11445730583211582042,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2068,i,15055268601476506151,11445730583211582042,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2316,i,15055268601476506151,11445730583211582042,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,15055268601476506151,11445730583211582042,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\.staging\Madium.exe
Size 13.5MB
SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
MD5 23e1b97c9b104e4a6d0432a8c8000496
SHA1 75eaa7184853f7aff363befcec625e1302f62940
SHA512 9f666471148d909b17a00a51374d834fb880a8777df74485d3091757d61cae6972d67b54be1f448d4012afa9bc38246326261ef86e6687c6c0ea06a323ac692b
SSDEEP 393216:nwfBqWTa3LqxWB04nJIslV0PTmP+00EVkJu:wJClxlW0lV3
TLSH
T15AE6CF07F64081F8C4AEC278C37B9536EA72B889452072AF57E45B112F2BB706F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 426B
SHA256 6aa74a67c01373cfb79483dcdb9c330512518458df91128ec8501d3f1612ae84
MD5 714765208d106170f0d60f93e2b8522f
SHA1 a69f8b5c1635004aacd5f13fafccfd712579096a
SHA512 fcea385a9ced3fb9794128f1c29508f5205a458ad076fdaab526a51f4ed9bbb140415953525e67a6b95e915f8fc68ce9dea324050c68ed6e015f3985b20fdb0b
TLSH
T158E0687E5C0213B1ECC2E30384D9B20385B86212FB25816CD3F65C2C02E72691DAFC93
MD5 SHA1 SHA512 TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
MD5 6d946a685bf8aaadcfa863364abb3fbc
SHA1 75c5e878634d581ad8b2a341249f9aa550f80bf5
SHA512 59e165eb60008fa5d19d3882a7bad4e01e4d62a8154e639be31cf1e21dadf9c28e63e2a1899a26dbd48074cc6bcaf80108f47288015ad4500aedc7ff0781ec4b
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 39B
SHA256 1d7d4e09ef38b5ee654d44295fe4a38173381dc595a4543f565685d757e3e634
MD5 1db4a98e52be5450f7ee1de11316547f
SHA1 1b1305fc04bc19e7093b13f1e29eccb93259c629
SHA512 1e1518f79d2776cc7ea40fcf37dcaab7061c8019b0e3c9a06d6fc8941ff0c380cbbf879ca75762a3aa1e9b81b8ec2b647bced51bf7f761769a8c1d97dcef3326
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 cef88d0bd38288c97f86a5235aff7497714fb1b48e31de35e84d58dea5eac43c
MD5 95cb793063cb17e3ddbbcad9f9190d0c
SHA1 cc9ccb6da8f89f3ae06292224e21b8532129c5ee
SHA512 e0bdc4bae597cca4eb41e8ae335bfe9e8e7ada73789d82855b0ca7f8305ac756babd6bc0f13410299585da5ca803e2fe2993e211b12edb7a30979c1d7406c9bc
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 7c6552729881310751b8081e5b1eed41704070f949ed09114fd50c3a104df1f0
MD5 3ee773cf234dc95e2326810c803b297b
SHA1 6982e0fad3b2f4fba812474873d7670bbfd853f1
SHA512 2d957996e7c092d7223addafcaefb19c42d8afc3e5a5221760fb44f2b73d5cb2b40425888e3bb5960cf750e174e9e3a66fe12f78e5ea0162eef4fe0659fa9095
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 36B
SHA256 432b1b0905da045cf89763944864a902757ad3a16fa38c49e2ce9eb97a29fd9c
MD5 005c26f3d60e7b6924f813eca528cf33
SHA1 012e9d2b4bc7cd9f1f71cbe88d51a6ecd17c15eb
SHA512 76e46f16df58aec4a1a410b6cd8662347b1a73fe05ee2831ec67016afffc58ad7a960660005aa3f0f5bf23302af468b9205f5759135985a6ad84ca27560a3330
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 d1c89106aeac4779658a5ca0b7240ab2b4c1219ff6eda1eac7b9c4a1b6a115a8
MD5 940ecc7e1b2b944bc8d7fc452d1ce0f3
SHA1 171e4ccf3a812d87cf5f361deb35a020b1a4c1e0
SHA512 216ae8904358a4e2367518f582e8d1f20adbd8ad9f94efadf80234fe1caf5ac79235f263606a0a6d846f9ab2e58ab272a5d93efabec108b41fd474db8b1b0704
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 38B
SHA256 1551db0cdbe38874970124f6800fda88692f64e7a52fa5ad4159ee98e7b1915d
MD5 ac14a43bcf6ab16e5552601a0a07d9bf
SHA1 29e4eeba58bd2245439176087972927d0cb702ba
SHA512 7c38188d8f3ede5499e5ccdcd5749e2806d620838030c776a7389f658e1c72c836a9327545d2831a4b203ce50972aa17ac51ca9774be2d021ee7fed768506af9
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2dfdedf012dfb0c04fd9386b30da91a602739c587331dfa752a1da9b1934994f
MD5 8429c126b7178d58efd091abd1289988
SHA1 5ea6d45c8753f1bc8e130efc773bc23cc6bd76ed
SHA512 23e77b442eefd3c543f9fe9ba57d4810f8cdc08debdc03c5d5efe1d0e44d74e8cae488d982637e864c0528c025cf57306fd57560097e90f1f0f1396418eebaa5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5c724e37934000a2e31b6b0c6f7957af3d67acb4a40f0149009f3c7538e69e07
MD5 cc9f0f059be940d3e06aef764061d647
SHA1 677c028cd4c4d56dc5cee47f5b625d529496b29b
SHA512 a7993c7414b2ab34245e8f590331d9af3e0fbcc1b87cc82363a5c7e3a9e98e2631667dc2b27abe296bce06bd42760c37666b90b98940b0ddcb0f1b71b0506f31
TLSH
T142D0121E73430134C0102073005262190502C90B41094015943DC95D1A1C0601926881
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 0addbbf6d343e9015ee6b81d8ac6c4ae6ad6304ad77cad3f2eb2aa815c3efb6d
MD5 cc89cb7099ad6863cce96b25fb2cc706
SHA1 8e1386f689ce930c50ff7695a1fa61ce003c4516
SHA512 6a47f6160bd7e6fe4046aeaf22e261d3f3a0423bf45b8ea62b9ec0af7acf71435f5777f31983d3985777c1baa8c337383ea3df45484727ed522c607de4fbb1d6
TLSH
T1E2D08C543A204C3CCF0605F0A3C2103832F018B481930E2044B300BF58C5B8AB2E0AC2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5228.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a5228.TMP
Size 48B
SHA256 21e64279ac49499b796a44e11bc35a3766de8690eff6104068e57c1bbf9aaf56
MD5 1ea01b1d76a616fdfd67a3fe98633bd9
SHA1 9d3abe8580ef12911c347a99dc354abd14ed0eae
SHA512 eb32b799e91b9a094fc3da7e867918d39b7011e8926ed66b4280404a7aab3ad3ff4739a9b995ba4f4c5092c05168fc88f1f06ddb60f98c91e66997e832632f9b
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 3fb1173bb5277c56198be38006eec8250b323749cea75552e1308f650192a362
MD5 44247c89544767d2407e62dca3675089
SHA1 83c9f7ac464889eb24ad1c0146a98e1196232e36
SHA512 5e243f2d16bebe16d8aa1782a2c9c5f1a26d38b02e343d813341d30db794d93652499aff898c0888a51ca9ba999900116e3100ec6481a456145dbee3b7527a7d
TLSH
T1C2F059E3507AF467A13C0BAA2A4878163A75F03402A57CF8C9A3417CB0907FB560A471
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a7dfb.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity~RFe5a7dfb.TMP
Size 356B
SHA256 5f9215c02cb6a8cf7cd859e9e4ae04870f018a4567281955f0f4c0f2b172bcd2
MD5 b5abf8d64972bf669ef6ad94dbb13487
SHA1 779d8bae75e8605b8acc254a47723054ad2f62a7
SHA512 83c1dc2e0912ba68d961ba941bdf6c924a41c3eed86a66acfa6ea476716a063d1a70daffccf9097e1559ceac210eaab41839aafeec7f30733ad3ab21f58eb092
TLSH
T181E0D892407AB027613C0B3A1944BD163A39A5301190ACF8D59341ACB0906F66A06431
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 7324b7dae1276440cc5ec878ed86694debc63239105aaaa5b49d5fc87c362e33
MD5 da2cb9639905a24ff49da7ae4a96bd16
SHA1 dfd55b29e55f490112aa6714f84cb27f44e3c101
SHA512 649c4250c67304dfdae431b063de16d8408f488262a98fdd0f481277128283f954d945d5be0d8498607e230311e57404bd0ea94e4c80c22a3e2958141e833861
SSDEEP 96:st105X2f1b9IffiEZ8i0vhEektum/7qx+WVHMSm+uecJBhMFHYtQjt+ggvMOB:st1099flZ8paF7/S+WiTBhqYtkmvMC
TLSH
T14BE1B5035E68697B4CC7F60A7E35BB42E2F6106266C44E58EBFD870C04E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a9a8c.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences~RFe5a9a8c.TMP
Size 6KB
SHA256 b0a1f3d2797cc44fef0450c6dbdba0c8f31dbd7c791c716b4f2b7789117541e3
MD5 fc5005f137f102a0ca59226db6844514
SHA1 3bc3308debb7bee5707a57a5011ac9d1754baedb
SHA512 23941519a327e5cf5f4842482d81c2a2a16fd94263088ffb7d4ac205166c397d62aabdedd2dd35d2f183b227568af4eabcef4787394de7afc0d0c40caaf13d0d
SSDEEP 96:st105X2f1b92ffiEZ8i0vhEektum/7qx+WVHMSm+uecJCs1iYtQjt+glvMEB:st109DflZ8paF7/S+WiTCswYtk7vM8
TLSH
T199D1B7035F68697B4CC7F61A7E35BB42D2F6106166D44E58EBFD861C08D66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 e1a9851eb2c2aed10bf5a154e06e9fa70c2553e18a52b779243a1db5805c3d29
MD5 a4c6f71b89547f802af4f81105389098
SHA1 76af4988b6e10f583b1e421948818edb175386ff
SHA512 7e8f6ca7f497c0b259dc8240006808e471c557ab41df15d39273e25fc9cd7a25db10b1d2765c58300397ca14dc9f2635144713b588e7c63bbc75d3500b1d84bd
TLSH
T1D051B673B898AB3799E29949BD453F439F364075A7911F5096EE0B0C01D7ADC2312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 1KB
SHA256 71c4194da48b18b37d073b9f76b572c6ccadc98233537c5be3b84438fe938e82
MD5 04d2b0f5f7349bd3d989a525aac793da
SHA1 9c5af315eac743d4f9413e790c4fc1f7696dd81a
SHA512 991c829e66d2f4859e9fe8da519cd87934023bba0effd83dd4ebf5678ba611b694055c3830fb6363de4510ac84cfd2ff66b4f46efb363080cadadadafb546875
TLSH
T1283185B3E4E86B367CD2D54AB546BE832F22003AD2504E0461EF4B0C02D79DC563AD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 4de13812711b6381bb8fdaabb8f7eef3a0e15bcbe6ef3305bc73c4dc8b68a7e0
MD5 d81ade04b163e8fe750c96c73c4eec6e
SHA1 40bf5ba80cc7b683391a7f977bc6e353975f3de8
SHA512 0f1cb934c6503450b311717b2af737d6b1cfe3d5dcc2dd5f438c99e013883f8ae6044c18997c79f3b835567e8347ea5583a016fbb3154a8e87bd7d19385c656c
TLSH
T16B71A567A8A8AA375DF2D945B8852F02BB624137E6C02F99C6ED0F0C01D77D82312D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 16KB
SHA256 90ef5a095b16a793ff4d3ff590a5a4bc3b559fccdf87be20e21d90f5ee69e10c
MD5 bd8436a7c1742e12a222a1b530cbc85d
SHA1 906d6490738200f9619665dfdea0092871fa6375
SHA512 715e0e81fe9bd3c07ee7d875672d635f6e0a39fbcae5084c6e7bd5c45dfc4031c8f5179bf41029fdba304a0c6cdaa5762e98a5e12d71b30645bbfabfb3f4753e
SSDEEP 384:zXsrv+89zHqlDNP9oid6Nbqg6NEOajASNk:wrv+4UNbd/ZbajASNk
TLSH
T140729E33E07C97336DF2E844B84A6A077F78506692C10BA4D5DA4B8D42DF4D82316E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59fd52.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe59fd52.TMP
Size 1KB
SHA256 2ae51ec18dd4038887b06d1b81daf2caaf94c144e9bc58666e6151aeb665f182
MD5 821503580e648e64afd3a2d466df8e91
SHA1 4004387fb0afd73e3b124e7f3c174a0f3d02df3a
SHA512 4f734e96eefaff6094814a260c57b476404d85211be91d580358877cdedcc52982235b8e04469b8632cfeca635e58f221f14599f569f49291c9ffa549f95b0e5
TLSH
T1692140B3D4986B36B9D1984AB602BE872F11403AA2504E09A1EF471C02DB9EC473AD33
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 89125fe9c7629cf280dbfcb0d5bd03caccefe82476aaabddd9a7367329b489e5
MD5 3d40c7559f12e0ac9fb8e2dac96f84f3
SHA1 8d936631f069b559f4ba240f56e506caafdf3cc9
SHA512 29eec68091293f30a007912ef809501e73013f62245970703ac6d18fe0f3d46949f7bdff1464edf41f1999ba99669b7766593a421b3a4e55ff400fdde63abfb9
TLSH
T1F8410C58B6F91148B3B77E566BF7A47E487A7C372E06C45D10110E4F0626A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 da0d0897673b4db8c981b5dc3758a1ee0f4750284b8ed5b47b84db95790a6c46
MD5 ec53fe4ecde7397445d449696a2d1e1f
SHA1 47cae813bbd16d3fd0c3c03bc569efc4d396ad67
SHA512 0720d8c43f269a6b179593fdc6c4343062ef6bcf7de19fe4f8f494c5e430ff36d7f550a9491636b84a3494c34cde78232d23e0fde4980b9aea95294936decb20
TLSH
T1C4D02B23F311033DC42030B20152F12D1F01B28F51038029943CCE7D5D080DB0BC28A3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 67db0d8e04b6d13524cdccfd81d64caf9bc4c7c707a10ddb4645f1f54a0c4794
MD5 0ea468f03d4821df852e4e8fbf9f85f5
SHA1 0256c032787705c1c08424667ba9d6a27ff6b441
SHA512 62c56ab0d7d177c4f57b0b8360a058c3c8a63e46ca5bc1653d40774796b31a31f3ff67e547a8126072d9fe0a496f10f43a982841b39548853795d5ea4abcbdf0
TLSH
T1B7D0122233020234C42121730013710D0A00D58F82068104543CCD7E1E040540917443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 53b534eceabdd21563f09ef9524b2590496aefa4adea0e4da68d514f5bff90df
MD5 3cf669072a768e51ad3843ccbecbd39c
SHA1 2b97a4b20ce733841689f8d7febb213fe241be2b
SHA512 974a62b7d0a5f42b227ac5f2f6dcf9756612729a060e36c99beb508565b4fb130c86bc204df53f3e2edd920632edba6b567b7551c3868b13f85c80b1a8ae0ce4
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 979996eeefe1e425759aa74b7170310f0644753340d61f1fadd0b7a2d79ebf04
MD5 7acaad6e8f2d005f90d1c4a29cce319e
SHA1 af81598d680e3984aed7f5e6ff6b800b4e1662b5
SHA512 9a325d452914af909a0398a94efdf2565db72c16d5248b06d5b5e620ec81d25ceef64ddc2e93c80db55f18e98d7edb2b59768d7e8cb0a851d73e67c621360e82
SSDEEP 3:LstlNllkll/liFVt/:LsX3lEtibt/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 66fbaf1f296649e344679f7f9bc484e6c51fdf2316e607b4fa5638121149dfe3
MD5 cfcecc6bcf5755ca99e383d225162dfc
SHA1 94da2b82905946d69bc1cc89b0b22e5b968acd31
SHA512 b28ccd8b5f88e4b302ad603a3708c52710d05a46cdc1240c5962074bc722a0a74d158e26623a01b47426da437ac1f547b2569b04ff897dbb856e4cb842b144e7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 d5902164206eb0d180edba380525fe70e4a1276f3df4e812f67c23a6fd596e5c
MD5 0c7a809678a25ee973aa34e7ebf0d2ef
SHA1 a3c8862c0aca215cb3521e5fcd9beac9f55763f5
SHA512 5cbbcbb5f9d1e11530afe331af59762c2c77b9483dae9a57775d260db2d62e8423a7f46f52845f9b79399d0b1328831091f8296d64ed93f0e242597b49b13712
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 f320a4fbf5240678df9ac20b053195194a2234635bc1cb13247d1ad99b57830f
MD5 adf16eab6b5649630ec76d2435d700d6
SHA1 323aacbe7ab5f0aba885abe4cf9ced0f912a0277
SHA512 4d68ede7cd728941f6e8ef657bd05efb8094969d1b5901abbb2a213fc7b3bbd2068758b7eb21f7c6ac823a0eaa46e8735cca4ea5e2211eabf5661a684a2f5e1b
SSDEEP 3:LstlNllkll/lWf1:LsX3lEtWf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 df43e92918687c21d8930fa4ce34e856e361c59171184920272af33f42ca42bf
MD5 ea2077c5cf977163fdf98d6e9208b0e1
SHA1 468406b03ac15e256f76bdfc39fa8c7cd1ceedc0
SHA512 3aef87e0859c7497a615c77969f527c351d24469685751cb8527c4e32ce9f4603e1c53d181b796755b8505f0fba354ab5cd79c7e722fd02886baf71dc1f8c98c
SSDEEP 3:LstlNllkll/l96ee:LsX3lEtYee
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

8ab463e6-6019-4882-bd42-6143d1ebca09.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\Network\8ab463e6-6019-4882-bd42-6143d1ebca09.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Local State
Size 1KB
SHA256 a9c346188d74dc8630871649e53e44cdf28bb4db61b1b14c4b8cf55d9383824d
MD5 7938f36ce0ea759bc25e5ba0b8b3aa43
SHA1 ed70f6c4fc9d8384c4e0e8e26326be55742ad0d2
SHA512 5b930a733fa5ef89a052c2432863d03a692edad5f39ec2981517e6b8f7892f0374f780c3b97b02e7eb4b0653514c752a8d70e77497511994e2e6824c410d7ca3
TLSH
T128318772E5D02F3AEDD35146735379979E2140AA83108E4491DD8F1803E71AC961BF32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Local State
Size 2KB
SHA256 c5d4c1cfb81cdaf39980ab2063592da86fa2d7a343a772530eeecd8c02b7fb61
MD5 30251e5f6d4d7dde38e91b1c7c16e03b
SHA1 5f67dd595ebbfa222d36069077460f131560d36c
SHA512 64f9fb11b55ffe12342cb2570579780cc3fc80e7967333e85db866c1a2540481c233fb64c40740015c8298dcd75b1136e3ae8d73f96d1adf97845ca947130ee9
TLSH
T1F951B633B894AE3BCAE39544BA563E63DE3540A697516F5096DD0F0C02DB56C2302E77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Local State
Size 3KB
SHA256 e6a57f2432083b94cded2a098d4887bcba68fe08f03a3f92acc4a5cd87059699
MD5 d89448b3a988bf0e59b8f88f36e12cb7
SHA1 4c09cf2e59f9e928e69514a73bf90be8501efd72
SHA512 b23eeef819a04f5132b777dca937064941ba761d156dcfddcff4a2986be93b3b4eb5b68898c02633394bc4c070e6d8bbfe61e655c842f3b6357ede15eaf80c3b
TLSH
T15071C732A9A4AD3B8EE39905B9863F16FB614077D6803F95C6EC0F0C02D73981302D23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Local State
Size 16KB
SHA256 3bf2e4f5025d141947dc72b69a2248a27371069b6804fd616e883d5d37a1ac1f
MD5 15113e61d749db4ab33051a4011e2f61
SHA1 5fb27249f2a03c697e077d37ecfd0539829b6eb8
SHA512 3b9638d25949e5a7613be1ed18064f44d97f670813e13cf9e56da505e5e229ef78518ee827e1cec699a49fb74c0126591241bd9d5dcf88addea90b38bbf0d331
SSDEEP 384:zmsrv+89zHqlDNP9oidw3NbTyXMtFjAqbIN9:drv+4UNbdwUctFjAqsN9
TLSH
T18F72AE33A4689B37ADF3A844B44B3A1B7B7450A692C20B94D9D90F8D42DF0D92307F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5865e9.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4BD03D9D-DABA-4E2C-AE1D-3CE7E235CDB7}\wv2\EBWebView\Local State~RFe5865e9.TMP
Size 1KB
SHA256 6f84600dbde295aa917cf3921a37b4398fc4e686c9167cf58f49f1343f8179ef
MD5 aa8d19f882109cf78248c9c8663a6ecd
SHA1 416c31377f7ea817eb88fba71ed0dcfe65a7c01a
SHA512 37d380826e55e3cbec23b3a4c6ae068c1bfd99361e9c2aa439d7c7de273a59268448fd4c3a0cd41c5bf9e2beccbcec7646e4f222be2c7b6822e67b5ddfc4d2ad
TLSH
T17D214272E4D43E3AE992545AB313B9976E2140AA83104E05D1DD8B1803EB4AD9627E72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1660-539-0x00007FF753390000-0x00007FF754117000-memory.dmp

Download

memory/1660-680-0x00007FF753390000-0x00007FF754117000-memory.dmp

Download

memory/1660-716-0x00007FF753390000-0x00007FF754117000-memory.dmp

Download

memory/1660-572-0x00007FF753390000-0x00007FF754117000-memory.dmp

Download

memory/2268-60-0x00007FFA7EF40000-0x00007FFA7EF41000-memory.dmp

Download

memory/2268-59-0x00007FFA7EB90000-0x00007FFA7EB91000-memory.dmp

Download

memory/3272-556-0x000001801B2C0000-0x000001801B778000-memory.dmp

Download

memory/3272-744-0x000001801B2C0000-0x000001801B778000-memory.dmp

Download

memory/3348-29-0x00007FFA7FA50000-0x00007FFA7FA51000-memory.dmp

Download

memory/4168-150-0x00007FFA7FA50000-0x00007FFA7FA51000-memory.dmp

Download