5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb

Analysis

user interaction
yes
max time kernel
238s
max time network
241s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 05:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260719-f2ft2act2q
SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
MD5 81ee0f82e959c755bdcb29c510249fbe
SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
TLSH
T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware themida trojan

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000d00000001c493-1043.dat	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
65	api.gofile.io

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_1404421226\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_1404421226\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_511460930\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_511460930\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_511460930\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_1404421226\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_1404421226\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Sigma\Other	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4260	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289121739699887"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
6192	chrome.exe
6192	chrome.exe
4656	msedgewebview2.exe
4656	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4968	msedgewebview2.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
4992	msedgewebview2.exe
6996	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2516	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4968	1308	Madium-Bootstrapper.exe	89
PID 4968 wrote to memory of 264	4968	msedgewebview2.exe	90
PID 4968 wrote to memory of 6024	4968	msedgewebview2.exe	92
PID 4968 wrote to memory of 6024	4968	msedgewebview2.exe	92
PID 4968 wrote to memory of 6024	4968	msedgewebview2.exe	92
PID 4968 wrote to memory of 6024	4968	msedgewebview2.exe	92
PID 4968 wrote to memory of 3364	4968	msedgewebview2.exe	93
PID 4968 wrote to memory of 4748	4968	msedgewebview2.exe	94
PID 4968 wrote to memory of 4748	4968	msedgewebview2.exe	94
PID 4968 wrote to memory of 4748	4968	msedgewebview2.exe	94
PID 4968 wrote to memory of 3800	4968	msedgewebview2.exe	95
PID 4968 wrote to memory of 3800	4968	msedgewebview2.exe	95
PID 4968 wrote to memory of 3800	4968	msedgewebview2.exe	95
PID 4968 wrote to memory of 3800	4968	msedgewebview2.exe	95
PID 4968 wrote to memory of 3800	4968	msedgewebview2.exe	95
PID 3184 wrote to memory of 5284	3184	chrome.exe	99
PID 3184 wrote to memory of 4260	3184	chrome.exe	100
PID 3184 wrote to memory of 5628	3184	chrome.exe	101
PID 3184 wrote to memory of 5628	3184	chrome.exe	101
PID 3184 wrote to memory of 5256	3184	chrome.exe	103
PID 3184 wrote to memory of 5256	3184	chrome.exe	103
PID 3184 wrote to memory of 2940	3184	chrome.exe	105
PID 3184 wrote to memory of 2940	3184	chrome.exe	105
PID 3184 wrote to memory of 4420	3184	chrome.exe	104
PID 3184 wrote to memory of 4420	3184	chrome.exe	104
PID 3184 wrote to memory of 1716	3184	chrome.exe	106
PID 3184 wrote to memory of 1716	3184	chrome.exe	106
PID 3184 wrote to memory of 2080	3184	chrome.exe	107
PID 3184 wrote to memory of 2080	3184	chrome.exe	107
PID 3184 wrote to memory of 4816	3184	chrome.exe	108
PID 3184 wrote to memory of 1048	3184	chrome.exe	109
PID 3184 wrote to memory of 3004	3184	chrome.exe	110
PID 3184 wrote to memory of 1048	3184	chrome.exe	109
PID 3184 wrote to memory of 3004	3184	chrome.exe	110
PID 3184 wrote to memory of 3052	3184	chrome.exe	114
PID 3184 wrote to memory of 4576	3184	chrome.exe	115
PID 3184 wrote to memory of 3052	3184	chrome.exe	114
PID 3184 wrote to memory of 4576	3184	chrome.exe	115
PID 3184 wrote to memory of 3416	3184	chrome.exe	116
PID 3184 wrote to memory of 3416	3184	chrome.exe	116
PID 3184 wrote to memory of 3044	3184	chrome.exe	117
PID 3184 wrote to memory of 3044	3184	chrome.exe	117
PID 3184 wrote to memory of 6068	3184	chrome.exe	119
PID 3184 wrote to memory of 5196	3184	chrome.exe	118
PID 3184 wrote to memory of 6068	3184	chrome.exe	119
PID 3184 wrote to memory of 5196	3184	chrome.exe	118
PID 3184 wrote to memory of 1280	3184	chrome.exe	120
PID 3184 wrote to memory of 1280	3184	chrome.exe	120
PID 3184 wrote to memory of 1832	3184	chrome.exe	121
PID 3184 wrote to memory of 1832	3184	chrome.exe	121
PID 3184 wrote to memory of 4368	3184	chrome.exe	122
PID 3184 wrote to memory of 4368	3184	chrome.exe	122
PID 3184 wrote to memory of 4904	3184	chrome.exe	123
PID 3184 wrote to memory of 4004	3184	chrome.exe	124
PID 3184 wrote to memory of 4904	3184	chrome.exe	123
PID 3184 wrote to memory of 4004	3184	chrome.exe	124
PID 3184 wrote to memory of 3104	3184	chrome.exe	125
PID 3184 wrote to memory of 3104	3184	chrome.exe	125
PID 3184 wrote to memory of 5860	3184	chrome.exe	126
PID 3184 wrote to memory of 5860	3184	chrome.exe	126
PID 3184 wrote to memory of 3036	3184	chrome.exe	127
PID 3184 wrote to memory of 3036	3184	chrome.exe	127
PID 3184 wrote to memory of 6004	3184	chrome.exe	128
PID 3184 wrote to memory of 1408	3184	chrome.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1308.4888.3884717646200891414 /pfhostedapp:32a0460e63072fe72888bcf5e3bfa01b8e5adae0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView /prefetch:4 /pfhostedapp:32a0460e63072fe72888bcf5e3bfa01b8e5adae0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcd6065fd8,0x7ffcd6065fe4,0x7ffcd6065ff0
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,13558204287510508734,14223469473276214353,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:32a0460e63072fe72888bcf5e3bfa01b8e5adae0
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,13558204287510508734,14223469473276214353,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:32a0460e63072fe72888bcf5e3bfa01b8e5adae0
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2408 --field-trial-handle=1772,i,13558204287510508734,14223469473276214353,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:32a0460e63072fe72888bcf5e3bfa01b8e5adae0
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3308 --field-trial-handle=1772,i,13558204287510508734,14223469473276214353,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:32a0460e63072fe72888bcf5e3bfa01b8e5adae0 /prefetch:1
    3⤵
    PID:3800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcd346c728,0x7ffcd346c734,0x7ffcd346c740
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,6904202994725563317,7301164429288224574,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,13772239244541910232,16015779534268073668,262144 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,17296982311671643063,6853995745630275505,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,1572200593935663098,7994786506284314846,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,8576479613013268560,6902713605343548534,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,11434389063765152530,9957371264862139847,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,11182399880498401571,6542457162782218103,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,4303169795705972603,16750886324396193137,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,6219271105252304685,8611054831361336602,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5516,i,6564498035661640420,9184808062216059802,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5864,i,15746345381333191737,13761527041319026693,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5800,i,12239260066457352646,16479707021090173946,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5628,i,7857538768662444346,6970700127005720910,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5404,i,1049199505076870514,1601600303446821871,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6200,i,4758680807485004117,18182747105350450840,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5660,i,8673175073863228405,6499541621172171420,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,14521103088196912209,15194436949945017814,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,14338670072797187081,7447989019930063036,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,7646864059985293293,13311680854813757193,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5692,i,1711891634628113933,40937131633157306,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:9
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5764,i,2031611786225353071,3823278333884785700,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6204,i,18393484676748675944,1595763694482072368,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6208,i,15367111745698903059,6619060327937097067,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3484,i,5465987733869258771,1104680081715497809,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,15901170827787568843,6903909256492142778,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,17142459729096783856,14921805503529511690,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,12325141671633682051,657017212450289361,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5640,i,8415422025649142002,8155354185747131107,2097152 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6532,i,6647755991762039334,5748175684031596561,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5572,i,15451570339776494097,6738941868238206919,262144 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3144,i,3034820681725758000,9517280627005332749,524288 --field-trial-handle=1964,i,17372491181425269706,9365201589441838055,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2272

C:\Users\Admin\AppData\Local\Temp\141565d4-c537-4139-9475-a5ecf11a0da4_Madium-Bootstrapper.zip.da4\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\141565d4-c537-4139-9475-a5ecf11a0da4_Madium-Bootstrapper.zip.da4\Madium-Bootstrapper.exe"
1⤵
PID:1556
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1556.4500.17646803907217792064 /pfhostedapp:2f3fbe9c8443faa7587a919d375af44756321334
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView /prefetch:4 /pfhostedapp:2f3fbe9c8443faa7587a919d375af44756321334 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffcd6065fd8,0x7ffcd6065fe4,0x7ffcd6065ff0
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2188 --field-trial-handle=2232,i,16070513242308304629,16115341283336584875,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:2f3fbe9c8443faa7587a919d375af44756321334
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=2232,i,16070513242308304629,16115341283336584875,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:2f3fbe9c8443faa7587a919d375af44756321334
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2392 --field-trial-handle=2232,i,16070513242308304629,16115341283336584875,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2f3fbe9c8443faa7587a919d375af44756321334
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=2232,i,16070513242308304629,16115341283336584875,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:2f3fbe9c8443faa7587a919d375af44756321334 /prefetch:1
    3⤵
    PID:3808

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6260

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:6348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:6724

C:\Users\Admin\AppData\Local\Temp\9b97e657-69a9-47d6-8d5f-66fbf5bcefa3_Madium-Bootstrapper.zip.fa3\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\9b97e657-69a9-47d6-8d5f-66fbf5bcefa3_Madium-Bootstrapper.zip.fa3\Madium-Bootstrapper.exe"
1⤵
PID:7024
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=7024.6992.4167054547648541962 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView /prefetch:4 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffcd6065fd8,0x7ffcd6065fe4,0x7ffcd6065ff0
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1668 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
    3⤵
    PID:6200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1896 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
    3⤵
    PID:6240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2416 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1092 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
    3⤵
    PID:6504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4328 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4528 --field-trial-handle=1680,i,8759317719251747361,12211792837429848845,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f259f0049ba50bc5823822446647765c6c83a812
    3⤵
    PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2e3de96b-9312-4a05-8527-5215286a92d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2e3de96b-9312-4a05-8527-5215286a92d0.tmp
Size 122KB
SHA256 2f3a8021b3d8fc45a13da9d410ad1823d3e163e21f9fedf384f7a10e5d22cc2e
MD5 bb7570d15e4feff875d3910c74414c8f
SHA1 2c4978bb3e923eed9a0d28c739542e44a75e9b18
SHA512 5c19dd4fb3e7e04db1c86d59707f74d245a127af89fd215f9bbf1ec40164c2511200d37d3ae68d38b1b710451d62afcbaf994fa88083277d295503afa7fa1ca9
SSDEEP 3072:WvrikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2Lj:Wzik4RlER6EtbaSgZoh0KepeBf2Lj
TLSH
T1CFC31274E03E7E09B92E909EB14AB75FC524F1F2FADE70DE87306606B1B59E5015080B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 4534b56fca621faa9964c3720ee4cb30bbb2ce85fae1b31722791430732f768c
MD5 8ec18bfc5fce90f77e5f45990c9f5849
SHA1 4d0e32fa3a4e9b867d27f9441139e04f70f17749
SHA512 2a6f69397a7caa487d40e1c11ed61dba9a4a105f0b76df099f91b5b5f8d92eb70510eba096a07f9d8c5cbb213f21374ffdcb91c273ee856e42f09e2ee70b81a0
TLSH
T15F01E5128CA9EA9EE3545B38A3C9B7A035BED2FC85070D2AAD558EF458253CD170939C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d297724689c15a2ed12980232cc942004ac05b3ef2026b03e669308bf41ec09b
MD5 3ca5bec0697812491387aa25423c7315
SHA1 85b0d40ecc2b3e289c3a28523087a066e61d9914
SHA512 18c7b9c310acb8ec59e6d347948d6a267d58ad9bd97b0a196ad97f46235ebf7ed017ecfa77593b7fd4752482f3e6aaab4d7f1111abb5a6162954a1473087d82e
SSDEEP 48:YALlqCqNq/nhJsJWXLsJufoKsJCSRs2fsfos14soKsRHSP+pstFgbzsLwzs2y85H:DvOMnxJhS56lobHSP+6WW8y8F
TLSH
T1A3918DF3C3E8957DC91156F9AB116E2FCE691919432C3D26CDD4AE0B63E2972D20038E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3f0206f10229c0dcf883a740d834e43be4f77d551694be1b30d379b8a7f9e963
MD5 1c662222c0073c79c4c5e4e8d51d041d
SHA1 cd229f315caf9ff1a3d2f2460cdbab96a029276a
SHA512 15b8a712e9002cc8c7e9f1a311515209437431aa30c578a3225d05511f3cf37deb6427757cd26af0f5414ee1b35cff9d880c0a5ece7aab7ab62c3df350a1f65a
SSDEEP 192:5RysIa0I9v7pAPRp2o9XxHsb+WNnCCdOIUkwhKVyIsnAUge:5RyBzI9AXjfw3dCce
TLSH
T10632A72EBE10653B6DCBD22AFA657B93D7F6102121D42E44E7FC8A2C11DB5CC622741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7cee4466de31b5e9cbc0486431e5c8f274dcb873c66d938da62abffabd5c00ca
MD5 9d3545ffb64c53f4d8c2ceb8523e774a
SHA1 d315eb6cedfc9796752df2b28446a968cda4e19f
SHA512 f6eefbd8e4922fe63445608a2499a5b8f2baa3d95d172ec22a83a219781626140b37eccdc3052071f3648b4b31ca8f16c5c309644c767745f999207a5bd2d645
SSDEEP 192:5RysIa0o9v7FAPRp2o9XxHsb+WNnCCdOIUkwhKVyIsnAUge:5RyBzo9sXjfw3dCce
TLSH
T1BE32A62EBE10653B6DCBD22AFA657B93D7F6102121D42E44E7FC8A2C11DB5CC622741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7cce19a4dd8a1d4e53389c42bfb11154ff049f9fb38728edd5048d977efb88e8
MD5 ebc9f1f53a0697efdbdf4308d7d11c7f
SHA1 592d02a9a644ef8b84d353a8acd53cc93e4aca6d
SHA512 921f01d1ac2d31661e7f4a4e071d3d2d89765e3197315ed7cc28091fa2a54ee4b1787f98b7d6dd524fca06111421bf5d883264dc15aa7e9aea341542dcda77d6
SSDEEP 192:5Ryssa009v7FOPRpU+lL9XxHsb+WNnCCun/kD5PIUkwheVyIsnAUgE:5RyDz096Xpfw36kD5hME
TLSH
T19D42C72EBD11693B6DCBD22AFA517B97E7F6102121E42E44E7FC8A2C11EB5CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a5a18716df578eeffc0456038b57028a4f631d43e6a97daebacdcbbd7c9a4284
MD5 bbb1aaeeb5010261c4e07b0928d3d8fc
SHA1 caa288906c8e03a12339b3c058bab80f94dc7037
SHA512 cb029862dc2f842e5924337b6e74a0fd521b35bef8f2e499b011fc6f8549d2622033f2cdfe62eee2d8bc560508d002caa4b6e877483fc743fb8ed2d6de33100e
SSDEEP 192:5RysIa009v7FAPRp2+lL9XxHsb+WNnCCu3v2j5gIUkwh8VyIsnAUgE:5RyBz09sXHfw3a2j5sWE
TLSH
T1BD42C72EBD10693B6DCBD22AFA517B97E7F6102121D42E44E7FC8A2C11EB5CC6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e3cebeb02aa2eda09b46494505dbdd880883b3d451fb22821cd342e84752eaef
MD5 313d8cdfe38df8cf87b235ea4699e26d
SHA1 662e74fdd5c96a6494f6db88ebc2aa86bdd5cc1e
SHA512 ca9eeb6567f0f897829f49e0dad6c26ea277be9575ff01412ce8169578368b01c317112c3e339008d3f5a8ba8ea65229d3f96a84c288b235b17fbace0f6e1adc
SSDEEP 192:5Ryssa009v7FAPRp2+lL9XxHsb+WNnCCuS9uSMKw5gIUkwh8VyIsnAUgE:5RyDz09sXHfw3ZISMKw5sWE
TLSH
T12142C72EBD11693B6DCBD22AFA517B97E7F6102121D42E44E7FC8A2C11EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ce8fae43593b6a523cf257bf11242b8fba87b1956417d0522fcea00df8258323
MD5 9dae3650c77db0672dd877505f3f837a
SHA1 66e94f47bb1032eb9d5518059da12453e86e16dd
SHA512 817380c50598f5046baf438926d13e879fb21b13e0fa2ab2172880d778a6b14a9da045bc2b7db734d2ba2b8bb43a16a809d19acf826adcf9f0376346d308675a
TLSH
T1AAA00210C5C05952CD514371706217413795C89C6D51434394910C499D5B9CD8392101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b935aef0be13a8f2689b0c426e775d93f813d83727dd050c7515d162196aad64
MD5 3b8cadaba3b24f1a32f37351c775e453
SHA1 2e35981d0cfea9619444452e46a259fcec889f51
SHA512 af45018d6bd6feb8e29ec7ef05b92e90c1d85d0a899e55befbb2167f3bbe34aca1563adde3212c226a4aa40df989627b67a1e1176cc9e3e91bf1c392085a8e52
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 91a8d11e97f1939917ce322086b5f400859b3af525cb435eeed5161db530663f
MD5 926aa8a6769a98513e5c9a61427c5afc
SHA1 4e994e88b10f97101fb194f6fd0fe8895271aee0
SHA512 b5c26b1f0b53a5dda64a6a2514eef02acd17c4595756b02a47d3af7f4ccf24aee9f71bb9dc214df519f093d708e69fd591f2759420b5ccf1a36c57f7242a2f7f
SSDEEP 3072:DvrikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2Lj:Dzik4RlER6EtbaSgZoh0KepeBf2Lj
TLSH
T1D4C31274E03E7E09B92E909EB15AB75FC524F1F2FADE70DE87306606B1B59E5015080B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 432f956e011221e3ee224147da407d5e70002de242847badf06edfc14fb4b9a1
MD5 b52e4369ec7998835790233a550d8603
SHA1 ff5a0bcaf090117d1fc3af0e051ffb2fa0063df0
SHA512 dcff10b113874434c4d998da2469c2f8666ff451b38e74aad6d0c2d666c990951af454657da00182a1a84c5e23a706f53f1f1cc1db7fd5b6efb06ff8b6bd2465
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5pmD2B6nGyvn0b4T8SpybJv4a:xC0ITo+TQ0InDUDimPPb4T8kybl
TLSH
T14AA11935A0684D775476D486F1622A83CFB8706BE9B2AFA0EAD90F0D15F70EC1341A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 49cc3f8fe6fbc61a89ae2c7894cb348ac980a233f6185f8610b1c9154aa02e50
MD5 a0c1b0a3377dd8592aa4c83aed237992
SHA1 387f910a8e18237371b76beadbc619cc7ac7b6bf
SHA512 95028ddf42f852f80540534be82c386894cf379bd937b1188bb758c93cbf1f23bd848c104ebdfad1a4ce61d090fedf6ea07d36fc0148d42e446b972ca7581708
SSDEEP 3072:prikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2Lj:5ik4RlER6EtbaSgZoh0KepeBf2Lj
TLSH
T18AC31275E03E7949793A94CAB14ABB4FCC28F0F7FEDE74DD86302A06A1759E9005085B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 5c29b66c78f25f5dbbb781adef58d95e21797a3c388d86111efa26c4f7e87a2e
MD5 ac61be9a8f3237f590c256c029531450
SHA1 7de76e1cda4bfa0376369f276ca3e69c6bde3acc
SHA512 745db5a7ccc4c374554630f050f50a87d5945ae87fd506fa4b8bea5dfd64c7499f3afcb9333738f3330f7bb673c15f252660296dabf7552f749630040e7c64fd
SSDEEP 3072:1rikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2Lj:tik4RlER6EtbaSgZoh0KepeBf2Lj
TLSH
T155C31275E03E7949793A94CAB146BB4FCC28F0F7FEDE74DD86302A06A1759D9005085B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Local\Madium\.staging\Loader.exe
Size 4.5MB
SHA256 f9a3d37d50ef9cfaf8bace3e50767e1b8ada51dd15da014d1dcfff420557efe0
MD5 b09a717aa807f38ab74b56fcc6c5c531
SHA1 1fc0ef2afb584de047985c265eec845e2d3ed81d
SHA512 49e557288e7e2553be43b604ad4db6fe9f389bacb3868e1f786b407176ee5149865d4d7a911b2c7d125f4d26282c5d99b0915b071fa98d8c452e3d16b5c8858b
SSDEEP 98304:E6GUPAfIZfLyl9/daqVIYyYCaD25lVrI212N0:DIwZC/AGrCaanVn12m
TLSH
T12426331FC41590B6DE7444B29D780E9DFB39E69B0E308E440D3B1A4BEE89E390A5C6F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Madium-Module.dll

Path C:\Users\Admin\AppData\Local\Madium\.staging\Madium-Module.dll
Size 7.7MB
SHA256 13231d7107c484f3b23a4f7f9a823d6b0d8f65455111b4ef54a379e2e25549bb
MD5 1f34262648b78362eb4c4c7e12bfd5a0
SHA1 b3b3ffeee341085a5029bda59cd47563b196405f
SHA512 bdb722eed4b53d69eb8cfad2c1d4d03fa63e5b75fefe12b6c820fb4e684e877817f4a3d0236e0489b4baa4ce80159278612acb8504dce0f27da73ac60c3df11f
SSDEEP 98304:vZReghD9p/WuaLC0axdHxnT8LE/I1eTBbw/WP9YpiebwmDDzUFq3YVmjH/Nl:vXTaLCbxT88I1eTBbw+P23bwW3zf/
TLSH
T17F86CF3CADF9F36E4BB56EC56BD20C39CCD6B50498478D8DA9148928ED3C872BC72164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\.staging\Madium.exe
Size 13.5MB
SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
MD5 23e1b97c9b104e4a6d0432a8c8000496
SHA1 75eaa7184853f7aff363befcec625e1302f62940
SHA512 9f666471148d909b17a00a51374d834fb880a8777df74485d3091757d61cae6972d67b54be1f448d4012afa9bc38246326261ef86e6687c6c0ea06a323ac692b
SSDEEP 393216:nwfBqWTa3LqxWB04nJIslV0PTmP+00EVkJu:wJClxlW0lV3
TLSH
T15AE6CF07F64081F8C4AEC278C37B9536EA72B889452072AF57E45B112F2BB706F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\.staging\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Local\Madium\.staging\version.txt
Size 5B
SHA256 67fe5135c40739e3ded1ac7479cec5aefd82cdb27bb53fdea1b826a34bff745b
MD5 c656ea7dc2c8bcff6a6b9ea186629b9e
SHA1 53582f11f1c209223dc725795cb6cc4aa1c61be1
SHA512 515ab81d5032870b7a29032d39f2e7526f90f947cfc34127825e5469dc0a68189b5a58166e1a292bf808fd79d8be13d8d144e0f19872fb1c525182a5fb58043c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eea2f436a5886a1c73004a687bc747f111ce407079734e58ab10e847810bd0f1
MD5 6661d8cd277fc8dff00a5ed3defb0dc7
SHA1 732c66bf572c41786573007ae02b474b06d5f403
SHA512 40a8a97b3a669f0c07dffed5f0d1618d5d437338b6e02c85f15d52ee310fbbcb9ef1f488494be71416b2c3bbf678b3ab502f1d74af327af6f95243059febd56a
TLSH
T10FD0041371511101C400543114107F0C114D4D07100571031111013D07775103115500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2798da3120b7c5d15ee3fc080442ed6216fac4f5d6d806b0eb08e3cdcffcf14e
MD5 1b7c1eee25fe80e9a7cb0fe98846edef
SHA1 b0133787ead88533bbcefef4e9d13077a33a423f
SHA512 7502e6601fd906f843d8b0819b2737d7816f52cab465d18ecc470f799a60e643f375276d43cb9b9855f1114af0ad672b5f47a7c1591f6463f208fb93819e9419
TLSH
T112D0121332520234C410243314027B0C1445C60F4009A0026429863E1B2A4602A16841
MD5 SHA1 SHA512 TLSH

Submit Download

2e2ebd19-deab-43f5-8153-18551ffe7c0e.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Default\2e2ebd19-deab-43f5-8153-18551ffe7c0e.tmp
Size 5KB
SHA256 61a72500d1f226e71be0bb3ffca7cf2f5f4f76e6f0b94a58cc2c82ae3e3700dd
MD5 93a4b5983d38844d77f96fb989a519a3
SHA1 3e9bdb36cd4960c1c46a91a8c147a932148de644
SHA512 15696c69b013aba2ae31f4bf6c771ba7f92d94ac43ae35685472750fe0b3a7cca2516b080a1a70f31cc29e6e75c57de50ba836a2148f6f5676e819b2125f7c84
SSDEEP 96:stR/dY5az/b9kWk9o5h16ZZs7/x+6MhmuecmjekK+gOR+28XM1C7K:stF2uwo+sV+FijIa+G6K
TLSH
T1C2C1A7025E24A87B4CCBF149BA39BB43D2F9603275D51D58E7F9462C08DA5CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Default\ExtensionActivityEdge
Size 32KB
SHA256 82a98efe1f51a8563b600bff853ca537c225247c494950c7048004a22394edce
MD5 a23e48300fa45773d9b8d84e831a2c70
SHA1 88e29c6f99a0812f58858e14ce9eade6326bc395
SHA512 e657006f0035df4ea5a022d2f111878fa87876d6d7269cf3d7c2acbdd531f61ffee27b865806024aef201a01484150e02e652afa35371db7963659f52aeecdfa
SSDEEP 24:TLTWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tcm+/9ZW943WOT/
TLSH
T160E23A2A5E3C7121DD6671367C61A4275CB910EA977336F27EE000696F8268BC538CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

f15e6390-c105-46ee-9c06-946e34c9831b.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Default\Network\f15e6390-c105-46ee-9c06-946e34c9831b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Local State
Size 2KB
SHA256 e2a031b45333a5196717a7b51ff23cc8a75098517cd286019f2fabc81029d0f3
MD5 f8ee30358f0d5cb07f5d27f631fefaf0
SHA1 963ee57d23b0b3470d32d2ee3725f6a16d06fdc6
SHA512 2a3865629f6b3ad508ad4a257ba81d57283fe79ae9ce3014a49f63d454b89d3f8197dcebfcba747b2a32d9fd0242793c05e10b230253ae0cb8535bc452daf989
TLSH
T1DA518433A850AA3795E7964A7A456FE3CF7551A5AB522FE0A6ED0B0C01D754C2313C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Local State
Size 3KB
SHA256 f2f2d75747fd5ad91955ac107ab550e8e1d1ed5b843772c193a3e09f706a62dc
MD5 bc9bdd161103e2ae799e886a3ea3d23f
SHA1 b6d9380bfb64e8b62c4ab21e1b3f99474ab98f50
SHA512 e6390941b0cad96b0e9f1fcffdf94c7c0c9ac6ed21e18443683f94ba1cdb51c41063ff0c42e64342e52cc02b2e5cc8dfdf1d4e05898557d5b524c7e3804616cd
TLSH
T15F71963B99A0E93789E7D90579852B96EBA55137E9823FE5D6EC0F0C01D728C1313C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Local State
Size 15KB
SHA256 57a198bcd3eb94a7a95f5e63f13df6777b504922948482ac86e6fc9321987297
MD5 31b73ef50acfa8042f67ba3a05b189e6
SHA1 f20fcd7e47f5ee896de20598b2680847ede4386a
SHA512 b229ed9bd9194596741c46b7d42e959e92c23a8b3be0c92898d8b411d1fb7584fb31722df6d430d055c74b295091182eb6f28c8b4cbabeb34e8f72170ce2421a
SSDEEP 384:7srv+89zHqlDNP9oid6NBSqg5km3jH9NE:Qrv+4UNbd3+m3JNE
TLSH
T1E272AE33D57CAA379DF3D54AB44A6E5B7F7861A792C20BE0EA995B4C418B4C92303D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Local State
Size 17KB
SHA256 79da29c92f6fcfd2a1fa8ab01d5801239707ce7d231b1894fa74331b9628e12e
MD5 d69776a216d5eb9592a7520e4ea1d9fc
SHA1 a15d22ec80192fe217297d0c0081712cc614e90c
SHA512 d38cf871096b25c31c5643fb1f120a3c99fc31d6fbf43df5303f48bdf97ac2c4c80148122c7d4bb51fe0ef9bccbd41d3378a96dab45f12cc3b131b899a2e4025
SSDEEP 384:Fsrv+89zHqlDNP9oid/NlTk5yW7ixpm3jH9NE:Srv+4UNbdUr7kpm3JNE
TLSH
T151728E32D568DB37ACF3C5867546BA9BABB4519252C60BE0D9D91F8C42C74DE2307C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5af648.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1D201025-03A2-496E-8FD2-4BD23BE4E924}\wv2\EBWebView\Local State~RFe5af648.TMP
Size 1KB
SHA256 a49110c0f94ee51a6469180a6d8964874132c482564b24eb333310cc6469a6b1
MD5 9cc62079c5c92d3caca4385a64e2d92d
SHA1 89b98a7e56f70934be9ec2c26a84c954628fcf72
SHA512 39d9277335731b33dac5582b3dd643e610922df30b9372bd3416ff590e6df43ee915524701edfd4c2bdd306cc7a9ce7dadf6ebf37f78ac8c5da346460bf93dc4
TLSH
T13E317477C8A06B33E887A1173641ABE78F70116A92420FD462DD4B1C06D344DA63BC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 331905dfc9e7f097e36ac7d5773890173e513726e99f44d888dc9ec515034c8b
MD5 37ea84d16d5a9fc079388d7a04622567
SHA1 1e101fa6ea90c354c6dc45f3d21b3d0347adf05e
SHA512 e91faf795fded032893464edf6ad9c36909d9dcbbc71360b8038a0691245b9744f8963c21af637706af8f5266fad7d5064dc03ac8a710870782587b93eda57fd
TLSH
T141D02B17F320073ED01038720142F5291B02F30F21024019943DC61EAB180E70FC2CA1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1113e5be6ef88a5e1e77d2fb4e992dd4c1f7dc574497cd5f3dddc6cacdb8fd81
MD5 0d553348c895f876a84881f1217c56f7
SHA1 67da8e9b657894dc5d078239eec58d7f67c4f97e
SHA512 4e12cc3103fbff8f84b216b6f43112fb8255f8d3a70c527d7dc53a97c15181169e9b93ed4427ca6ad57375078124c792fca262033e259c2b99fe338dff8aee85
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 686c19645e9e2cd4831cff5f87486686d507da9baa2bbb9c0763ff5d660cc6b1
MD5 bbfbb40629cc9b0815fb6a0bb6d1d9e7
SHA1 252c9dce713cf1051cc1c377fd4d21976f185c4c
SHA512 224ac41d80800205d42f761415992b00dccd438d2a787a905c00eb436be00bd2bcf8cd5cf85f4d3200185349e6dd133bf67a3fca6e859d73228bf95ed827f7b9
TLSH
T1E1D024173311073CC0103D330003750D0701D70F43054004543DD51F7F141711D43C41
MD5 SHA1 SHA512 TLSH

Submit Download

1894767b-9e3e-46c9-b67f-84b9070949a8.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Default\1894767b-9e3e-46c9-b67f-84b9070949a8.tmp
Size 5KB
SHA256 1aa91203c1ad9d55e11d0b3711cfc11cf96cf5a91797e5835bdff6310f378a2c
MD5 eeb31c1850de83b4f99aa7ce9ed7641c
SHA1 25e1664e1d8a60060733f7ca4c80f8aec5222824
SHA512 1c715654bd89bc297f85f0ac08bc3d50b3978dd0c98cfccd46463c2e4b9e72226443d3ce3ed672a3ff9cbd132796d61c10265004126cefab5aa3c837800a5bf5
SSDEEP 96:styJ/dYx/8gwsb9kHkXEo5h16ZZs7/x+6MhmuecmjesK+gdI8XM1C7K:stC2agw7do+sV+Fijkvg6K
TLSH
T1E2C196065E68687B4CCAF159BA79BA43D2F9603231D51E98E7F8462C08EB5DD2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Local State
Size 2KB
SHA256 5e5a03fb444e10a574be77412e1acebbfe96154e269ebb90089880d6ea48bc57
MD5 2c9f9410872c2d2fe2c3e36d4fc9e922
SHA1 95b1ec322873815f3697db242aa03d01146fea17
SHA512 7bb1bf03715ed004475f18b17830bd8b3a88ca57070cd77c96d02922e8f0e0d093c483c03446237748cf26f88a97df19b2887d37577ea9d0849aa57fa7b5afa5
TLSH
T11551B67398406A77A9E3A649B986BFA3DE7540B5AB922FA097DD0B0C00C794C1307C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Local State
Size 3KB
SHA256 e167139988f6de2ccbbb57ae4899dca0e33591376fb8de13a9d7377c9a365b8a
MD5 7d7412c161d41cfd05607486ae085056
SHA1 160ad1a9cea661d1cf57e25d4793d380f6805ae9
SHA512 df632976b0ca112c042f78cf7876bf6cafbdbd9796bc10988deb7eba043ad512fc81011ba7cecff66a5daf574041ad44b73c2f0528a3dd5fb4602bbcc346b3ef
TLSH
T1E771947B99A0A9775DE3EA05B8C57B96A7A54037EAC13FA4D6EC0F0C01C76881343C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Local State
Size 15KB
SHA256 37f80c1550591003f9fa17503e30c43258572710c8c36f3deec8f3c507844852
MD5 e21a15c4b947fe163adbb2bf3f0c5529
SHA1 046a58608510bf40bb9521d528d2bb6752bef10a
SHA512 ec72c7e6459884ca2239801d26ec50de12f50aecab30147a70bd0a2eb56dad48e498da7cb6fc1d1d85f40fe71d218d0eeb5bfb6b8ebdb5a1eb1d4e9dd4af7fa4
SSDEEP 384:8srv+89zHqlDNP9oid6NBSm+7Aoo3GjN1:nrv+4UNbddHo3GjN1
TLSH
T13E72BE33D178A637ADF3D549B48A7A477F7850A752C21BE0DADA5B4C418B4C92307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a8493.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{334BFF58-DD22-4EF3-B33C-47243A3A3949}\wv2\EBWebView\Local State~RFe5a8493.TMP
Size 1KB
SHA256 01d89d02df504f41fd7435e15614bb7d2c439918255ef435a566ea40b535484d
MD5 fbb3fb23fdbb81384237596c12ab4b86
SHA1 97fec667bd1e3e6b2b8153716749d18cd5d00560
SHA512 dd621160b9461ec39c8b50211ec620c34f592daa532fccd49eed11fa8cc186dd2f54f65815b3a461b5f5c0af35b84b29e0abb33df02b88777403ab46ccd82f9f
TLSH
T1EA31A4F7C8912B72BDD3A2477141FAD39E6100BA83814F8062DD071801D344C952FC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6fb089488965973f1304d5a971610eb03589013bbadf35aadd6a884d524a6637
MD5 60c52dae7fd9179b46692517cbad143c
SHA1 7431817ca202f34c97fc9e3f4063909904054df0
SHA512 46de945af269dee5efe152602fbc0c11b8d05e60092b1bc40c747e3db4c76f18805d509e5e00b0332796d8f64ccd6f13294b7faed33300bfac44e375db0be6e4
TLSH
T13BD02B17F310027DC01078730161E52C1A01B20F10474026A82EC7AC591C0DB4B85CA1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 982fd21ff6f10d036ec299118116462f561b8967f6315025135dd4057658efc3
MD5 806425d38b233c650255246335e2e491
SHA1 2d79be6fbfe11dbe441f87095248e84bd1b5925e
SHA512 cb70129141a014c0e07f1897258a70e0eaf8be08656e862c3f1d296e1fc0491c5d4bda4be0e646a531e65d40c96b74625ff5b5f57006d1756e010177731a31f8
TLSH
T19CD01216B3010178C01138331022650C0400D50B444B4101682EC6AD1A1C094090A841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 81a9b8ed0a3b6bd21db7334b4df3baa2c131a921c7a5b6b676aff513d72812e0
MD5 0b5d9b8aa6f72ac157bf9a804aa06599
SHA1 1b13af97cd0d6b7903b02826b27a7fbbe5e89d79
SHA512 04a1241606681afa34aaa7cfd0cae7e9185bd012b727ed83bf24c1a0d09d4731af96d9bac4d199ee190ea27f28c017ab4e05ec149b657f9b2bc0c6cc51ec5148
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Local State
Size 2KB
SHA256 c95b632d476fc336bed51234abef1fe094fb17cda9a25d827921317b51b5c299
MD5 8772d4440763c00d325863c101d4c0e2
SHA1 90ddf23b45bf332b6c7e48bd3b5fd361c616e431
SHA512 e0a93c2acba414acced91f8c6e81e3817675ef10d52a4172bf495257bd112291b4c2f23b9889609635813c86ef56639759693b31e1b5a4b2c6ca99026858c568
TLSH
T12651843378509A7B55F3DA09794A7FA7CE795166AB931FA0AACD0B0800DB94C1307C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Local State
Size 3KB
SHA256 b5f77272d2424382c4ede4e399c73ad0cae7cb5d935f7b9419fa9d9235bfbde5
MD5 a2c25be1390e34fba131cb8446357056
SHA1 ed1c625a10964da3246ba8692eeab049b50ed81e
SHA512 189f280cc0dbdef9c50c79235278832d783444c22472725aad86eac5956c88832daf87f1216177eebe7e1ce40360a282c6c1a4b2218936590b960cc9f820f11f
TLSH
T10771A63B69A0D97B49F3DA09B8852B56EBA55137E6C62FA4D6DC0F0C01C768C1353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Local State
Size 15KB
SHA256 069be94cb6af41f38396d2923ab7601d8a142b4772ddc242161cfe715259956e
MD5 3ab7c78bc5e12f977a38cc1495e490ad
SHA1 730d16c6c5ad87e42298e47f0703c120ce38d5e4
SHA512 ff45ae9232bdccc4adc142a13ecc885841c6e97d93c843c4d1b3328f5211f0af2d90e49b328a3a90ad2feaa64215d775e2810eff959c6cb27fcfd0e9a01e4a2f
SSDEEP 384:+srv+89zHqlDNP9oid93NBSfV1hy9pE3NcN+:prv+4UNbd9A+E3NcN+
TLSH
T1B272BF33E578E6379DB3D50AF44A6E4B6F7860A7A2C30BA0D9995B4C418F4D92307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594656.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{B9834D96-25F8-4AC5-8AEF-C8A64EB29A54}\wv2\EBWebView\Local State~RFe594656.TMP
Size 1KB
SHA256 4782654dee56890a328758bb10c0147e203ace77dcf2aeedad21510e5133693a
MD5 9c393499ee5262c8798631628e2d5e89
SHA1 9ae85e4c0636d4ef518cef88dfc7bef1e866c5fd
SHA512 62f7f7254da17732ddcf43eb20e2ea7b589e0c86cb92d090f980bf102bdf6320fb1f4469bfa7e4510cde470bc4ad012371971e76729766c4cbcfd36bafafce4f
TLSH
T1A43154B7A5A05E7268E3A54F7541BEDB9E70417B93C34F8476CD070C01DA54C562BC3A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3184_1195433100\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Madium.lnk

Path C:\Users\Admin\Desktop\Madium.lnk
Size 1KB
SHA256 8a7fc5eb3f7510eaa6a5d67d21b883c7bf8e3e1e2942bcaa955da2f65ca0fff9
MD5 88864ef74a7017640e97766472f3ee5b
SHA1 d76958f80526740ad33d7080bfdd88a71188b51d
SHA512 28a4912985673721e487e2f8678a6fcb1825c2a896b42ef476ba4aadd97337880b9e7af48dd946916efc064d9ffdc419ff5a9fe73aebfed66529fc89f1d57ee4
TLSH
T11341E732ACD92120E7F7DB7E53DAA225C6BB7827CB495A184080C1452F21B1C6A55F1B
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6996_110244176\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/2096-1559-0x00007FFCF6C70000-0x00007FFCF6C71000-memory.dmp

Download

memory/2096-1558-0x00007FFCF5FA0000-0x00007FFCF5FA1000-memory.dmp

Download

memory/3800-105-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download

memory/4656-1627-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/4656-1629-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/4656-1633-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/4656-1636-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/4656-1638-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/4656-1637-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/4656-1635-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/4656-1634-0x0000027F96520000-0x0000027F96521000-memory.dmp

Download

memory/6024-104-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download