5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb

Analysis

user interaction
yes
max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260719-xr79zacv21
SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
MD5 81ee0f82e959c755bdcb29c510249fbe
SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
TLSH
T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
45	1552	Madium-Bootstrapper.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289616072588279"	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1584	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1552	Madium-Bootstrapper.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1584	1552	Madium-Bootstrapper.exe	84
PID 1584 wrote to memory of 2320	1584	msedgewebview2.exe	85
PID 1584 wrote to memory of 4216	1584	msedgewebview2.exe	86
PID 1584 wrote to memory of 4216	1584	msedgewebview2.exe	86
PID 1584 wrote to memory of 4216	1584	msedgewebview2.exe	86
PID 1584 wrote to memory of 4732	1584	msedgewebview2.exe	87
PID 1584 wrote to memory of 5028	1584	msedgewebview2.exe	88
PID 1584 wrote to memory of 5028	1584	msedgewebview2.exe	88
PID 1584 wrote to memory of 4424	1584	msedgewebview2.exe	90
PID 1584 wrote to memory of 4424	1584	msedgewebview2.exe	90
PID 1584 wrote to memory of 4424	1584	msedgewebview2.exe	90

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1552.872.7305848776217997225
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdf381b078,0x7ffdf381b084,0x7ffdf381b090
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,15245568976688501311,5943734820542425626,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,15245568976688501311,5943734820542425626,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2296,i,15245568976688501311,5943734820542425626,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,15245568976688501311,5943734820542425626,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 689f8f9cad1d5ce2a379e44b70620389e7526b92f0921aad66ffd3c0fc97494c
MD5 5642abeaf3a92bd394d6af6953cc119c
SHA1 9194988c9dab852c208817eae22d70d286940981
SHA512 e9795aea353b1946feed78a51391b5d76da0ca2ad8ae82f36e6c2e3442cac16c3bbbce29ec96ca01830ca92126be243c8b14e91577467e5fe468492dab7c983b
TLSH
T10DD02B13F310433FC11030720141E7282A02B70F60024017B43C961C5A4C0D70B868A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 928f64bfad284479621325a8f62c85f5d43b598c4720ff57f22b108394447fae
MD5 3d1510423d16e595bfa0981767dd756a
SHA1 3d9ab14a5ffc31d8bd072c507e7fcae30f9dc3fa
SHA512 f073aa8a7018ccaf76d3a376ddc449f7aa060662282220473d53079c4b2653cb8d88e4cca9b8d09a4388ee061f2fc9a99976ef022c78ce00c51cd402d206676a
TLSH
T129D0121333014239C1102133000667081451CA1B800541427438A51D1B48050091B446
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 17033b8cc05f6a2df0384fe98b25f566ae0b70bfc59546f99c8c19a830fdaefe
MD5 4517f30ea45102ff6a446fb459703862
SHA1 33700422e69b54780afab2a05ad8db8ea904f447
SHA512 842d5d0c8d73d3c97fde4b13c3af43b223f968a12ab5e8de310d7815e6b1469f34a34237f01975638b36bd1aa9f8f58a0591d9905feae8d08f1ae6ba7834e899
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 9b7c9735269aa95c1aa4a6e44e1822017a1b31ef7625e8a56fd10843c3a3f97f
MD5 27e1b5540c7b535beb020eacdc2f2abb
SHA1 80fa2e3dea84f3c41a1c7ce6aed22dd471ce1d48
SHA512 e0bbeecbef18db9ec209737baa7ea258ab21ffd0a84c752944d6133a42f6caf45cf00c693a9f6af61842d649272810b296f24132fbffc98c75c78ce038af2268
SSDEEP 3:LstlNllkll/lpKXl:LsX3lEtpKXl
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 66cd128edf25f1de9db86d60f4cd441a969ab1f50d414dcdcbc074156230f1ab
MD5 2a5a3bb3f1b6de4004c13f49e43d8f7c
SHA1 2f59a10055a1ea6772de0cc3400b3e0a7a262dd4
SHA512 267e3a66aa507a5e35df872b3855ae69901a1e25f53db3eb427886a2e39e408b2090b9c7ed2c76509965e5aba4f66661fc82a173e2f0305d3c697c1faa967286
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 087ee3f0e093f693df0ca9fe60a12d581b55701b73200cc638ee32546f4a5887
MD5 b8066ee9411c2866e9ca98357c2e517f
SHA1 cca810b3c22d5441c70853c3ae9193b776e7e53c
SHA512 5a673f851622871aad3bbacd7806b442888e53396785bb46d929954a114d3676b6efe52f2c6b0e081e4b1183f40a66ddf50a8d547671c8db3e8283bc3b82baf2
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 36d8db95940974e50ea4974f0fe1c2e9812bb8f8d9686c3917e00834bfe1f365
MD5 5847dd912dccef3646083b033d0a5ef1
SHA1 a832d633530d803ab08a42c94d1aecdbacc3f74b
SHA512 35040b74c9ba3f21f4f80662ac8dd786adb110c68d9d944fc92a744c183423098809f30585b9f1bb6854811ddd15ba6e7b66c2e6def059cd13888d23a3887ed6
SSDEEP 3:LstlNllkll/lKxj0fXl:LsX3lEtKl0Pl
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe593fed.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Network\Network Persistent State~RFe593fed.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ff0b641a-2071-47a0-bc3b-5cdb7cdeb5fd.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Default\ff0b641a-2071-47a0-bc3b-5cdb7cdeb5fd.tmp
Size 6KB
SHA256 2efe81855c9422314024eabaa5f6cfca283061366e4462799d6087af7488f574
MD5 f81a0297768f146bea1127a07d84285f
SHA1 dc85dd8763be4a9ee6a177fc34b977a6b00e2f09
SHA512 2d04973989a6699b2b35eab795f8f30630c09456acb73deb813990f0466d76d84516aaa72d1c2156a5411188498a21d51a16b193b66f4aafc8d617454a34a4a1
SSDEEP 96:stV05aP/Ib9kSff2Z8i0vhEwklm/7qx+WVHMSm+uecadQj7+gLFFiKEB:stV0gyfeZ8pai/S+Wi8dmbFiK8
TLSH
T138D187079E78797B4CC7E6197A35BB42D2FA502266D40E58EBFC461C08E56CD130BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Local State
Size 15KB
SHA256 9985761db2b6e1bb7400c36a83eaef6ac5a3bc2f5d2ebda61243c0b4dc1aca26
MD5 cf6fcf815a7899fede270843b72a9981
SHA1 46bcbedb6fade5a2c469bf4c4a41c7f8bb11b379
SHA512 6fa3d013655b975340f872f994b146b23a9c2000380cc31572997abad36849000ec23d91ce7c071f3eaf26b27e70462ea201d86b021323bb70cee6b8b6e42dcd
SSDEEP 384:zRsrv+89zHqlDNP9oid6Nbfby4HdyjA6INz:arv+4UNbdC99yjA6INz
TLSH
T1F772AE33E12CA7336DF3A845B48A2A0B7B78519692C10BE4DA9E4F8D469F0D92307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Local State
Size 1KB
SHA256 202afe310ee92cb5cb9355276095298b3f48051337758f856758b2a20a68a7ca
MD5 d0bc9e23a54a14b9b2da2fd526be3b30
SHA1 0b9d7793b6e43dfd4661d4a4d23ea0aa794a022d
SHA512 798e893d5110fc8d17bae4406fac33c08912bb9e569cfa5463d77414d4dae8de5cda97c08c45099c25302e6ea3ced9b101eab67285a587942045ff17ddd05f3a
TLSH
T1EC31A772E1903B337C936656B2577F9B1E2481A6C3204F84A3DD8B0C16EB5BC462AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Local State
Size 2KB
SHA256 43106b42eb84430126a8345b2e1a431199bfd33b62cd068d9277077760df7c8d
MD5 c26b3ae5a5bce9409dfd008849e18b02
SHA1 a0eb73e9a69207e0d74002ae3d09b3760c808cbf
SHA512 a19eb6ad6edd7b8638cf48491ebf0e4a303f4a78a04b80d9bc4e9b590c3ec0f9880c88716c45b3b875ba1cfc99489e4ade16bcbaa7c5046e909c0517fc22607b
TLSH
T18C51A573E8047B3799E35A55BA5B3F539A3981A1C7612FA097DD4B0C01DB56C1306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Local State
Size 3KB
SHA256 61a084527b8baa2a0b70a29fa46f7487711ee08feaedba17d748f7a3f67095d2
MD5 f9b9f195354f82a5ee57ca7026c3e97c
SHA1 447a0b3d0204850f4b1bdbaeb6a55b80658f037c
SHA512 35d4ad6af405ffcc1e819f5931b3deed85b607d08d89f8a371aca5beb05e8e6f9e8c2b1c8a5a8043ba1d8e5ea489c99883c809972114a382954206b2ebdab578
TLSH
T1FB71B637A564BA374DF3AA05B98A3F16B6658123D6903FA5DAEC0F0C01DB2AC1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58da7d.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{BCC81205-35B1-407D-BCE9-D20B4E392959}\wv2\EBWebView\Local State~RFe58da7d.TMP
Size 1KB
SHA256 f20bbcfbd2e7437a9dd0f727372e87c399bf48b94b54aeb33f5d0f1f43edfbff
MD5 c82f4a26ca20311efeb822d74281767e
SHA1 24cec4726c5f441dfa07830f50a1b3a75b64d62f
SHA512 0e66fea89d20aa0964c64aa96e55d7f7e284948ca45a4b5655fd7ea9f9ecc5bd2507385565c3669d750055beacb326f802d79362810080d023f3e84f1d8fe744
TLSH
T16A216273D1853B327C522956B2677B8B1E54C1A683205F58A2CD870826DB5BC432BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4216-215-0x000001F745900000-0x000001F7459CD000-memory.dmp

Download

memory/4216-29-0x00007FFE0FAA0000-0x00007FFE0FAA1000-memory.dmp

Download

memory/4424-216-0x0000025CD2C00000-0x0000025CD2CCD000-memory.dmp

Download

memory/4424-122-0x00007FFE0FAA0000-0x00007FFE0FAA1000-memory.dmp

Download

memory/5028-96-0x00007FFE0F670000-0x00007FFE0F671000-memory.dmp

Download

memory/5028-95-0x00007FFE0E300000-0x00007FFE0E301000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads