5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260723-dhx8vszerh
SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
MD5 81ee0f82e959c755bdcb29c510249fbe
SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
TLSH
T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1804	Madium.exe
5820	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1091857838\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1091857838\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1744706807\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1744706807\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1091857838\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1091857838\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_2128970568\model.markov	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000006b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Madium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df06b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 6b000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e1d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb13140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc662000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470033000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c000000010000000400000080010000190000000100000010000000b009e99a5cfc928a173190106dbb32a92000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Madium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Madium.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2268	msedgewebview2.exe
4104	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe
1804	Madium.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2268	1172	Madium-Bootstrapper.exe	89
PID 2268 wrote to memory of 1412	2268	msedgewebview2.exe	90
PID 2268 wrote to memory of 4624	2268	msedgewebview2.exe	91
PID 2268 wrote to memory of 4624	2268	msedgewebview2.exe	91
PID 2268 wrote to memory of 4624	2268	msedgewebview2.exe	91
PID 2268 wrote to memory of 4624	2268	msedgewebview2.exe	91
PID 2268 wrote to memory of 4720	2268	msedgewebview2.exe	92
PID 2268 wrote to memory of 2696	2268	msedgewebview2.exe	93
PID 2268 wrote to memory of 2696	2268	msedgewebview2.exe	93
PID 2268 wrote to memory of 2696	2268	msedgewebview2.exe	93
PID 2268 wrote to memory of 3320	2268	msedgewebview2.exe	95
PID 2268 wrote to memory of 3320	2268	msedgewebview2.exe	95
PID 2268 wrote to memory of 3320	2268	msedgewebview2.exe	95
PID 2268 wrote to memory of 3320	2268	msedgewebview2.exe	95
PID 2268 wrote to memory of 3320	2268	msedgewebview2.exe	95
PID 1172 wrote to memory of 1804	1172	Madium-Bootstrapper.exe	96
PID 1804 wrote to memory of 4104	1804	Madium.exe	98
PID 4104 wrote to memory of 2832	4104	msedgewebview2.exe	99
PID 4104 wrote to memory of 3536	4104	msedgewebview2.exe	100
PID 4104 wrote to memory of 3536	4104	msedgewebview2.exe	100
PID 4104 wrote to memory of 3536	4104	msedgewebview2.exe	100
PID 4104 wrote to memory of 3536	4104	msedgewebview2.exe	100
PID 4104 wrote to memory of 4888	4104	msedgewebview2.exe	101
PID 4104 wrote to memory of 5588	4104	msedgewebview2.exe	102
PID 4104 wrote to memory of 5588	4104	msedgewebview2.exe	102
PID 4104 wrote to memory of 5588	4104	msedgewebview2.exe	102
PID 4104 wrote to memory of 5744	4104	msedgewebview2.exe	103
PID 4104 wrote to memory of 5744	4104	msedgewebview2.exe	103
PID 4104 wrote to memory of 5744	4104	msedgewebview2.exe	103
PID 4104 wrote to memory of 5744	4104	msedgewebview2.exe	103
PID 4104 wrote to memory of 5744	4104	msedgewebview2.exe	103
PID 1804 wrote to memory of 5820	1804	Madium.exe	104
PID 4104 wrote to memory of 6100	4104	msedgewebview2.exe	109
PID 4104 wrote to memory of 6100	4104	msedgewebview2.exe	109
PID 4104 wrote to memory of 6100	4104	msedgewebview2.exe	109
PID 4104 wrote to memory of 1944	4104	msedgewebview2.exe	110
PID 4104 wrote to memory of 1944	4104	msedgewebview2.exe	110
PID 4104 wrote to memory of 1944	4104	msedgewebview2.exe	110
PID 4104 wrote to memory of 4644	4104	msedgewebview2.exe	111
PID 4104 wrote to memory of 5244	4104	msedgewebview2.exe	112
PID 4104 wrote to memory of 5244	4104	msedgewebview2.exe	112
PID 4104 wrote to memory of 5244	4104	msedgewebview2.exe	112

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1172.3456.8060475157358374102 /pfhostedapp:bca362bbb61a13abf1ba456e7d526aa01f67da31
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView /prefetch:4 /pfhostedapp:bca362bbb61a13abf1ba456e7d526aa01f67da31 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x120,0x7ff8b9375fd8,0x7ff8b9375fe4,0x7ff8b9375ff0
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,8821912866305453290,16142813993510949755,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:bca362bbb61a13abf1ba456e7d526aa01f67da31
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2088 --field-trial-handle=1804,i,8821912866305453290,16142813993510949755,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:bca362bbb61a13abf1ba456e7d526aa01f67da31
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2344 --field-trial-handle=1804,i,8821912866305453290,16142813993510949755,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:bca362bbb61a13abf1ba456e7d526aa01f67da31
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3568 --field-trial-handle=1804,i,8821912866305453290,16142813993510949755,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:bca362bbb61a13abf1ba456e7d526aa01f67da31 /prefetch:1
    3⤵
    PID:3320
- C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
  "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1804.4972.13455490540600034934 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ff8b9375fd8,0x7ff8b9375fe4,0x7ff8b9375ff0
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1960 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2488 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3512 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4728 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=1764,i,15476905028055281935,10166638080753177857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5244
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
Size 13.5MB
SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
MD5 23e1b97c9b104e4a6d0432a8c8000496
SHA1 75eaa7184853f7aff363befcec625e1302f62940
SHA512 9f666471148d909b17a00a51374d834fb880a8777df74485d3091757d61cae6972d67b54be1f448d4012afa9bc38246326261ef86e6687c6c0ea06a323ac692b
SSDEEP 393216:nwfBqWTa3LqxWB04nJIslV0PTmP+00EVkJu:wJClxlW0lV3
TLSH
T15AE6CF07F64081F8C4AEC278C37B9536EA72B889452072AF57E45B112F2BB706F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 426B
SHA256 6aa74a67c01373cfb79483dcdb9c330512518458df91128ec8501d3f1612ae84
MD5 714765208d106170f0d60f93e2b8522f
SHA1 a69f8b5c1635004aacd5f13fafccfd712579096a
SHA512 fcea385a9ced3fb9794128f1c29508f5205a458ad076fdaab526a51f4ed9bbb140415953525e67a6b95e915f8fc68ce9dea324050c68ed6e015f3985b20fdb0b
TLSH
T158E0687E5C0213B1ECC2E30384D9B20385B86212FB25816CD3F65C2C02E72691DAFC93
MD5 SHA1 SHA512 TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
MD5 6d946a685bf8aaadcfa863364abb3fbc
SHA1 75c5e878634d581ad8b2a341249f9aa550f80bf5
SHA512 59e165eb60008fa5d19d3882a7bad4e01e4d62a8154e639be31cf1e21dadf9c28e63e2a1899a26dbd48074cc6bcaf80108f47288015ad4500aedc7ff0781ec4b
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 39B
SHA256 1d7d4e09ef38b5ee654d44295fe4a38173381dc595a4543f565685d757e3e634
MD5 1db4a98e52be5450f7ee1de11316547f
SHA1 1b1305fc04bc19e7093b13f1e29eccb93259c629
SHA512 1e1518f79d2776cc7ea40fcf37dcaab7061c8019b0e3c9a06d6fc8941ff0c380cbbf879ca75762a3aa1e9b81b8ec2b647bced51bf7f761769a8c1d97dcef3326
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 cef88d0bd38288c97f86a5235aff7497714fb1b48e31de35e84d58dea5eac43c
MD5 95cb793063cb17e3ddbbcad9f9190d0c
SHA1 cc9ccb6da8f89f3ae06292224e21b8532129c5ee
SHA512 e0bdc4bae597cca4eb41e8ae335bfe9e8e7ada73789d82855b0ca7f8305ac756babd6bc0f13410299585da5ca803e2fe2993e211b12edb7a30979c1d7406c9bc
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 7c6552729881310751b8081e5b1eed41704070f949ed09114fd50c3a104df1f0
MD5 3ee773cf234dc95e2326810c803b297b
SHA1 6982e0fad3b2f4fba812474873d7670bbfd853f1
SHA512 2d957996e7c092d7223addafcaefb19c42d8afc3e5a5221760fb44f2b73d5cb2b40425888e3bb5960cf750e174e9e3a66fe12f78e5ea0162eef4fe0659fa9095
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 36B
SHA256 432b1b0905da045cf89763944864a902757ad3a16fa38c49e2ce9eb97a29fd9c
MD5 005c26f3d60e7b6924f813eca528cf33
SHA1 012e9d2b4bc7cd9f1f71cbe88d51a6ecd17c15eb
SHA512 76e46f16df58aec4a1a410b6cd8662347b1a73fe05ee2831ec67016afffc58ad7a960660005aa3f0f5bf23302af468b9205f5759135985a6ad84ca27560a3330
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 d1c89106aeac4779658a5ca0b7240ab2b4c1219ff6eda1eac7b9c4a1b6a115a8
MD5 940ecc7e1b2b944bc8d7fc452d1ce0f3
SHA1 171e4ccf3a812d87cf5f361deb35a020b1a4c1e0
SHA512 216ae8904358a4e2367518f582e8d1f20adbd8ad9f94efadf80234fe1caf5ac79235f263606a0a6d846f9ab2e58ab272a5d93efabec108b41fd474db8b1b0704
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 38B
SHA256 1551db0cdbe38874970124f6800fda88692f64e7a52fa5ad4159ee98e7b1915d
MD5 ac14a43bcf6ab16e5552601a0a07d9bf
SHA1 29e4eeba58bd2245439176087972927d0cb702ba
SHA512 7c38188d8f3ede5499e5ccdcd5749e2806d620838030c776a7389f658e1c72c836a9327545d2831a4b203ce50972aa17ac51ca9774be2d021ee7fed768506af9
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 36B
SHA256 c8d89df060705d2971c39f7338698d24d0e0ecb3f7537e9f541cb66fb2fbea20
MD5 455753c61598ccfc62eadc858d70793b
SHA1 569cd3d6f1ccd4c491df9bb5d0e242f2c4d86ac6
SHA512 e9f3e0e9d4fe1dbc3025420cb71e056c4566dea7f21f34e93d96c468c074460b8536e1475b0c5cc42496eb392f49c0aef7ac52ca21b975be74d00c267b128906
MD5 SHA1 SHA512

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 34e45f9f4a638d4a925628a0fb2ccf5980c002eea10ef38f71e3992ca4511f78
MD5 aaf31d8f86763a1bb3f593608aad84d6
SHA1 9723fe0ecebbdf1221105cc4a787d29087e7e6d0
SHA512 e38d0816ff0c76cb287d7f0cd572bb2b8a22b3fc3bb856729083211c011774d0994fa240502b80ee6902112f2f72d30161856cbb31b7be37827878ee56aa377e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eab66a6e10cc46fc425787b74733e12388e5a469432ebbb497da7d41714e07dd
MD5 aed1668d3a25c190c86f362974a49a31
SHA1 78f500365980fa27c50c43e6b7188deaf5cb41ef
SHA512 ad08ddc406143a32d1fec7e37455e7cb164528ddc6e39e81920c18b3c32fd4553dc44419371778cb0641e792e24225de911faaae0f847260d04050fd9bbc18f5
TLSH
T1D5D0121633030234C03024330552E60A1408C10B810A40445C28CD1D5B050A00906851
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

98277194-879c-45dd-a082-dc3f668ea874.tmp

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\98277194-879c-45dd-a082-dc3f668ea874.tmp
Size 6KB
SHA256 33d32859a1161617ea7c22a9429e1da18d39ebc738a0cdbb0d8542ae2cef011b
MD5 f4bcdf609baf32b59230524f3e4e4ce4
SHA1 fdb41fa7a80c1e48c947b4e08337b0e3ee630628
SHA512 a9244800024b7b9b845544bdcc45b99758ad88108ea6558be21e30c9d5de237e6b56c7398eded1bc0044931411b3fbe93a8a2079b803b202fd373ef9fbafdbd6
SSDEEP 96:stV/d1NBib9Ekyo5h16Z0/s7/x+6MhmuecJLY1ejeDK+gnf28XM1C7K:stJjLJon/sV+FdLYQjZtG6K
TLSH
T1B2D1B7065E24697B4CC7F209FA25BA43E2FA607265D51E48E7F8471C08EB6CC6317D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 dedaabb28ab8352fe7f8ce3b9f9d961d9bf23350e05695cdfc76a4f7026bf99a
MD5 45c55261d515a395a97759bc011ea1ed
SHA1 884804156794be6f8a1eb482b6343789189c9bfa
SHA512 9026fc3619db960a0a69786cd38f9e05b0ef431029bf10d27c24d8a2ee725b487dc17305096793a02aceb8cd77e2dcfea18137eadef650ca31aeffd43a567d2b
TLSH
T1F6D08C243A740124C3B80A31A2F2203335B004B84687CFE19BB4E0B546A0B5BA174249
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d96e.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d96e.TMP
Size 48B
SHA256 8a19d23e67ba44275586be07f58f3bb9edc0d4314c93e90eceffb40c45a1fc73
MD5 6cbd795d69673f7930eb509ec19d8646
SHA1 4d900888af6e025b4aa15a43f9e21621e4e31c06
SHA512 dbad18f34ae41ed70f4806fdd3800d8b3a5b43041f72ae5e95d6669f53cafcd45c71fec34752cfddfea43ea94219f88590bffb436faba97512afd7f5da642ebf
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 83eb28b277d02c2ee4e239381cda6f0bd795d7c5cad78732ae6483ea37a432fa
MD5 9d61715d795a57a1f3e6cb3fcc43839c
SHA1 8e483db85242e5e7a9e13f462007ffc81911a693
SHA512 251b804c87eaed03c579597f3dc85b92a1b78f896d33b2b0094e35daba76381a45258226ba16b684b9a86cb1d0d5eb5ce03b443c2f39f5bed09376a6909ce280
TLSH
T189518193C3E4C66DC50576E02B34B917CD2E051D92282D278DDBEBD66BD14B2D22164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
Size 3KB
SHA256 eec9a4d00a9212355911c4b674078e827536099376038773dd4f87707e346d88
MD5 a78a3a44f8af7bebee75122ab4a77e81
SHA1 33cd96d4e72ce9a4d576550898bfb521c6f3a449
SHA512 d08cbaacb3e11b4aaae200a7888721a5cd46fee8227382c7df0c024d2b07db0c701dfc1aad09d078469929ce845b9ab57b6137652112be8d63239e5d379ace10
TLSH
T1166181E3C3E4C66DCA0176E027347917CD2D051992286E278DDBEBD66BD24B2D22164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9bf3.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State~RFe5a9bf3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 06de7071e1c0a4b7e2769590411a36f7a2c7c57779ddd48242bc0fd8777922ef
MD5 c099b07e9a88776c2137c72350cbd49e
SHA1 b4c815998c701755e3f2293d50b1d182c3ba061c
SHA512 f70e61358e25b3a87e8d8a178f3eadd9af732203f46afb938dbdb7be303ef1474f5c74c78f8022f0a5ee931b942e921c3ff49cb8fcc906ac2a3c878b135f5272
TLSH
T100F0C9E3013EF42BA07C5B2A2C047D0626B6B036126A68E0DA4201BDB0828F35F02866
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 19f4844f1834ac2906763509b11f5e07ba2c8124504ea1ee1c96ed04b7721dcd
MD5 3664900d00240bfe7bca49731cf07d53
SHA1 d234d46b61117d2565873288f6737370994b6729
SHA512 2ccf8858510175865ea902d9583ea49c5052a33948e1cea358a2fcb494877bc5e194a8d962bb96353d1fc136012195a8b6c9ac7e57f6657073c39178437d5aa5
TLSH
T104F00EE7007EF827907C5B3B2C047C0A26B7B036526A64F0E94200BEB0C2CF35B028A5
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5aad49.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity~RFe5aad49.TMP
Size 356B
SHA256 47ad8513eb61d04342087917e534c7901892354e53fffba01a2573c06b6fe4d7
MD5 fcc7df78c6f3a99456435ac756fe8875
SHA1 6dff2bd08026d18bceeca3bf0ed5434d32ce1677
SHA512 611c6601ddfa82973a9e7c8cd963f05349ea06ff2228bdc24905f24e115ccd7253bed2e2b8beca6b2f18366f445a8e08f0e33a2544eb0529ee3e255bac35aec6
TLSH
T1C0E020F3407FE4B7507C5B3B1840BD055B76B531116194F4D546447E60829F756068A6
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Trust Tokens
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 eda15592d811792025b6e2ca481b7b0fd34904fa456478b2b233858620b31ae0
MD5 1f1963a3633066872880cf09bcb31fe2
SHA1 df52a77709347e8eb146126a8ed7369da5cc3afc
SHA512 415970b32f589f44566d28a9b681a8d4b383d336e4760988c466a09bd1e2f9f4f493fee66c086c2d6b7e34be6c4dc37a828a252b0d40d6b94c8947756ea22d73
SSDEEP 96:stV/dZaNoGib9Ekyo5h16Z0/s7/x+6MhmuecJDpXIjeDK+gYO28XM1C7K:stJyFJon/sV+FdDp4jZVG6K
TLSH
T1C5D1A50A5E24697B4CC7E11DFA297A53E2F6607266D11E58EBFC471C08EA6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 16KB
SHA256 42c888be4d328f722fff3f66d3fca1b1b987434b1df58efa3ea6016a611e001f
MD5 27a593caea5089c2e3073208e0ff6276
SHA1 287b60192b97a4ac77ed539679a3433518e0e6a5
SHA512 a077acc34076882679c13f70602084123a09750a8ad9a14ff3b970f656698359bfe500d9e8fe804e2471298210def553c33718054ec2e20dbed1559f5eb223b9
SSDEEP 384:8+aQikB+z/xvxjg/qhEwNBSH1tFUQisd3D9zK:b/UxvxjgC+f32QisFDFK
TLSH
T100729E3F94293D2795F7EA04B94A178BDBB9887395C26EB44AAD5F0D0A872D40342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 e4d08675148d5f9fc15c0b99d42dad21cfa694a942509537fc39b2a01e6ff286
MD5 8615978890146ed8a3b274bd2e530248
SHA1 2f7500c0fb6e92e3792544af6ba19e9397bf470e
SHA512 3b65c886ebe9c7a473cf12667dc57cbe1f1d4af4e1075a28a95d28779912768f230adff33cbf017babd64f499890a58d41e1a30db3b6b6b3a90622c10a4c5883
TLSH
T1CB516337A810AA3785E24609F9867F57DE7A517ADE521FA0B6EC0B0C04CB58C2357C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 3ba266d364da6db47a13d9c30b5918efe87b3888086874460fba6831ef4b1f46
MD5 6b417f338da3dde51ba2e79f72be21a2
SHA1 588859754e600ba2926ab769bc8bde038892c49b
SHA512 8a71e5a410710f2c7d43f95f19b2562a9b5a3b2f3b35f2cd58f683dad5f2448521c5d6db4ce31c04aa2220a49725ad0fd946d593da8430f21b5b9e134d4db98d
TLSH
T13B71973B9860A93749E38609FC863F06ABA65137D9857FE4E5EC0F0C05C72881353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59864d.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe59864d.TMP
Size 1KB
SHA256 16cd2f259a2c797d04601b00573809d304fce6bfa942c872603bc602813d5d28
MD5 0c3471213a01e9510129865e8727f980
SHA1 0853f483579a90a0d8381d5eae3cede25d54f8be
SHA512 0deecab9231f2131923a4e22bc604ccf2de4e8f5f4b0f2e1a27510e3b009de25849be1bba9ea5bc3291b0d6d7a3b8cb76621e497186b1b737da4d23ea712740b
TLSH
T1413154B7C8501F32A8D1510AB552BB9B5E62127FCA424F8071DC4B0D18CA48CA73FD37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0d51104fab434cb4bf40aec8c9c0549537b48042ae142fda2b13d19f5a7126db
MD5 573706a22b66fd9592719ae1c14c3152
SHA1 68485e1ba90724cbcb4634238173476e637f8d24
SHA512 932a72b57700751c330e20e262c44bca6b4797fd57c66b0a1869d2b194cf2bff788b0788e611038fa79b163732135ef4c332eff82653112e53f6562033cf9e23
TLSH
T1BBD02BA2321A0635D720713B4682E9482100C13F000641042E35FA5C0E810E10CC5A42
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ae67c92fdff8c9cf21dfea0051edd0d47a133b28452f0c5890fbd0003a50a57d
MD5 8a6f2d2401c05a057fd1be25a24192ac
SHA1 37f09e46f583a1a4dc047056a9766df5233f6552
SHA512 bad4ae7f3b68cc6eb0c9fa77fc5391fbe85f69182239d16e927db6ea66a83b0a1619f9b55c42646aa213c196fbb30d33c045410ecaae3e6e379e4b814de57a92
TLSH
T12CD0121276020238D42034370603A9081500D12F400541056828965D1E440940906542
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 027b92bf7c6c314bbbb7c3a7879106dd40956f7a473657fc11904b7c45fa1855
MD5 08a0ca81bba7fee0903a5ce9c21d044d
SHA1 feced76b8634e1eec2e9ddd8e5f4fec7dada29f3
SHA512 8004f4019c59c09c43c9a9aea86644cba836c2c0c88fa865029a487f6273263a6dcc6041ce46fa76359e6234141c58db5c2dfee0bac8351504aa9924192421d2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Local State
Size 2KB
SHA256 bfa01ce7faec27e08e7a6751dc19c3f5cfefb023629b340ba690d7661325acad
MD5 ed42472fa1a224e255ccdd2aef18ba23
SHA1 19f6c2ed1df736ee489b5c9f71c461a42c62448b
SHA512 93ef397365446ded5f711213044199d79ca013aefcb9558bc5a2ad146c6825f840021a0a8afbbf5b26ed43c1a546e617973350f56b337d9c771b0ad2c5c5045c
TLSH
T1E7518677B8105A7B85E6D605F94A3F539E764069EB932F94E9DD0B0801CB94C5303C72
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Local State
Size 3KB
SHA256 7c44d09e46153043f52f8d110fe7817f4fc111405efc5b6f3d742ae24d1b1138
MD5 7f120c5e7f8fa1e25146a3a214b09c4f
SHA1 66c6f636a475f90ea303aa1c48b30d75f0e1c1da
SHA512 71b76d392841c97fa7d68ee802d82456bcbff29a9200d7e04966d624c3a8c11728e223cbc34862ec065005cfd00bb1967592d9b66232c1bfbcd7a8c8e4cb43a5
TLSH
T1E771667FA960997B49E2D605F9853F56AB96402BE6D67FA4D5EC0F0C01C76881343C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Local State
Size 16KB
SHA256 56b0e5604552b02a2263e9bb28f93b638bdfc7e803efe41465e17800123d7672
MD5 10dcd5dc9fc176c31c9463265811986a
SHA1 b08aeba519d4d47854e407a950bfee3413d816db
SHA512 630db0aa02cc0c7ca2a31d89b4be2687474e7ed9a6b3b40cfdcde8d974abf7d9fad446e1efdb6b73beba9d32dd278e06a2e4a3411e3507fc8fe0ba40b68272d9
SSDEEP 384:f+aQikB+z/xvxjg/qhEb3NBSmvw8MNisdiq9zW:u/UxvxjgC+bRTMNisUqFW
TLSH
T11A72AF3F58757D2795F7EA05BD4D179BCBBA847291C26EB88ABD5F080AC72980343C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe595a99.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{92150F76-09CF-4123-8522-9FF793194A1C}\wv2\EBWebView\Local State~RFe595a99.TMP
Size 1KB
SHA256 d3d5626879e42c59563d920136f7bbcedc2f8f39ef0f420bd7868995da830735
MD5 80fc42d4d94fdd46ef4352efbdba8345
SHA1 1a0f6fd1737ee20bb6d159a72d650f017fc4bff3
SHA512 0038bf9304c42b16e803271da096a244b5cd125e9df4097023e14b6902bf6821ec7c5be8e0d0741df2c1f7c555022444e044d709f04a5d9e0e75b3797fded212
TLSH
T1913174BBE8601E7399929246B105BE979E61006FE3834F80B4DD0B0901CB58CD32BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1944-851-0x0000017F85A10000-0x0000017F85A3F000-memory.dmp

Download

memory/3320-124-0x00007FF8DA5C0000-0x00007FF8DA5C1000-memory.dmp

Download

memory/4624-30-0x00007FF8DA5C0000-0x00007FF8DA5C1000-memory.dmp

Download

memory/4644-873-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/4644-875-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/4644-883-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/4644-882-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/4644-881-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/4644-884-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/4644-880-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/4644-879-0x00000236E7300000-0x00000236E7301000-memory.dmp

Download

memory/5244-924-0x0000026026FB0000-0x0000026026FDF000-memory.dmp

Download

memory/6100-695-0x00007FF8D9AD0000-0x00007FF8D9AD1000-memory.dmp

Download

memory/6100-730-0x000001FA3FB50000-0x000001FA3FB7F000-memory.dmp

Download

memory/6100-694-0x00007FF8D9840000-0x00007FF8D9841000-memory.dmp

Download