5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb

Resubmissions

25/07/2026, 00:00

260725-aahawshm9v8

24/07/2026, 22:31

260724-2ftdwsvbqf7

Analysis

user interaction
yes
max time kernel
30s
max time network
31s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260724-2ftdwsvbqf
SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
MD5 81ee0f82e959c755bdcb29c510249fbe
SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
TLSH
T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3412	Madium.exe
2988	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe
3412	Madium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2572	msedgewebview2.exe
2588	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3412	Madium.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2572	4296	Madium-Bootstrapper.exe	89
PID 2572 wrote to memory of 3192	2572	msedgewebview2.exe	90
PID 2572 wrote to memory of 4660	2572	msedgewebview2.exe	92
PID 2572 wrote to memory of 4660	2572	msedgewebview2.exe	92
PID 2572 wrote to memory of 4660	2572	msedgewebview2.exe	92
PID 2572 wrote to memory of 4660	2572	msedgewebview2.exe	92
PID 2572 wrote to memory of 5132	2572	msedgewebview2.exe	93
PID 2572 wrote to memory of 3168	2572	msedgewebview2.exe	94
PID 2572 wrote to memory of 3168	2572	msedgewebview2.exe	94
PID 2572 wrote to memory of 3168	2572	msedgewebview2.exe	94
PID 2572 wrote to memory of 4044	2572	msedgewebview2.exe	95
PID 2572 wrote to memory of 4044	2572	msedgewebview2.exe	95
PID 2572 wrote to memory of 4044	2572	msedgewebview2.exe	95
PID 2572 wrote to memory of 4044	2572	msedgewebview2.exe	95
PID 2572 wrote to memory of 4044	2572	msedgewebview2.exe	95
PID 4296 wrote to memory of 3412	4296	Madium-Bootstrapper.exe	96
PID 3412 wrote to memory of 2588	3412	Madium.exe	98
PID 2588 wrote to memory of 2000	2588	msedgewebview2.exe	99
PID 2588 wrote to memory of 6016	2588	msedgewebview2.exe	100
PID 2588 wrote to memory of 6016	2588	msedgewebview2.exe	100
PID 2588 wrote to memory of 6016	2588	msedgewebview2.exe	100
PID 2588 wrote to memory of 6016	2588	msedgewebview2.exe	100
PID 2588 wrote to memory of 1832	2588	msedgewebview2.exe	101
PID 2588 wrote to memory of 5456	2588	msedgewebview2.exe	102
PID 2588 wrote to memory of 5456	2588	msedgewebview2.exe	102
PID 2588 wrote to memory of 5456	2588	msedgewebview2.exe	102
PID 2588 wrote to memory of 240	2588	msedgewebview2.exe	103
PID 2588 wrote to memory of 240	2588	msedgewebview2.exe	103
PID 2588 wrote to memory of 240	2588	msedgewebview2.exe	103
PID 2588 wrote to memory of 240	2588	msedgewebview2.exe	103
PID 2588 wrote to memory of 240	2588	msedgewebview2.exe	103
PID 3412 wrote to memory of 2988	3412	Madium.exe	104

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4296.4332.2425167892666327471 /pfhostedapp:88b4ee5c5009e9e12fec53c68189f6b73afd8f9c
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView /prefetch:4 /pfhostedapp:88b4ee5c5009e9e12fec53c68189f6b73afd8f9c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa77a95fd8,0x7ffa77a95fe4,0x7ffa77a95ff0
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,9835973827809450929,16327540923035906673,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:88b4ee5c5009e9e12fec53c68189f6b73afd8f9c
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,9835973827809450929,16327540923035906673,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:88b4ee5c5009e9e12fec53c68189f6b73afd8f9c
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1736,i,9835973827809450929,16327540923035906673,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:88b4ee5c5009e9e12fec53c68189f6b73afd8f9c
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3668 --field-trial-handle=1736,i,9835973827809450929,16327540923035906673,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:88b4ee5c5009e9e12fec53c68189f6b73afd8f9c /prefetch:1
    3⤵
    PID:4044
- C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
  "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3412.2360.5327339512021198910 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffa77a95fd8,0x7ffa77a95fe4,0x7ffa77a95ff0
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1916 --field-trial-handle=1920,i,16283204919487470643,13824814846382981479,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1920,i,16283204919487470643,13824814846382981479,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2552 --field-trial-handle=1920,i,16283204919487470643,13824814846382981479,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3452 --field-trial-handle=1920,i,16283204919487470643,13824814846382981479,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
      4⤵
      PID:240
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
Size 13.5MB
SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
MD5 23e1b97c9b104e4a6d0432a8c8000496
SHA1 75eaa7184853f7aff363befcec625e1302f62940
SHA512 9f666471148d909b17a00a51374d834fb880a8777df74485d3091757d61cae6972d67b54be1f448d4012afa9bc38246326261ef86e6687c6c0ea06a323ac692b
SSDEEP 393216:nwfBqWTa3LqxWB04nJIslV0PTmP+00EVkJu:wJClxlW0lV3
TLSH
T15AE6CF07F64081F8C4AEC278C37B9536EA72B889452072AF57E45B112F2BB706F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
MD5 6d946a685bf8aaadcfa863364abb3fbc
SHA1 75c5e878634d581ad8b2a341249f9aa550f80bf5
SHA512 59e165eb60008fa5d19d3882a7bad4e01e4d62a8154e639be31cf1e21dadf9c28e63e2a1899a26dbd48074cc6bcaf80108f47288015ad4500aedc7ff0781ec4b
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dfc6047d3ab0c2fd013b4ea2654605a648c361feeecc7e242d0ea550cefabd20
MD5 73c90e18c554aa4862002b8132daf69f
SHA1 5ffbc05823cbecb0b9d62d2801e1b0f6d5bfd91d
SHA512 1566f7ada9b07e9fe4c0647a669482e78d2d0974cc555ce27557693cd8d03bff87ba9c7a55ea8b20fb9a343c137fc81331ff4e99680eff0ea5d12ce623e5e2b7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f0a52c29bb180cea6dc8b81dc760dcc122a4e79adb3db09333f83e75f076d657
MD5 4d346652cfa20cfd7e8d9c2178f35df5
SHA1 15019c671ab7fe8a5dc1fa3f97ee50329ab33b78
SHA512 c1dc6ac7996b6ecdd07357ae36e21a5ce5cd31f8faeb18b08c4e50607a54467c23385ed155b3ef9178f28b64a580f5a6b14a28cd2db276b7190b5ecccbc0dfd9
TLSH
T119D0121233011234C91034770003E3080440D10B4106444498B9C51D1B9409C0A42451
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 636822be15a44bc21bee454b56396d93498b6d826facf979b1290e67d3628887
MD5 e1ca0cdb6425c6713aa531c0e400767d
SHA1 e6057a390b62e761dcd8027cfb724a81a88fa257
SHA512 7edf7fa368a4bf931281cbfd49e4757d6a46465b87533da29e42cb37affc3aaf59b9c9b8554473160e137d5fc172e220c3469fe6faa30d9e8948e08cecba3b9f
SSDEEP 3:lSWbNFl/l/klXlR4llrqgqz1zGcSFfoayuuyOV9RUISd7A/mhWJFuQ3yy7IOWUo3:l9bNFlaSqguxtqlyup6YZ75fOSIe
TLSH
T1DBF2C9C35E549473D85C2F3E5ADA82FC2F726A8C8FD28D0281A84D310AC16CC45B8D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 953f8aecda0935b82f564c88fa73880f28a410c719dda4959fe9446b5a90f404
MD5 bf4c91c48d40abc362126912d949016b
SHA1 7d59bef23bd323ae1177962ec5edafd029517115
SHA512 030fd6f3eabf2dedf298cccbd22d8d6935f69bdc7f6413e8afc406e0ac849a058fef6bcb510b42bebe3e0bc42e6e9d291dbf44d4cc1517d51c3b2635b2f6005d
TLSH
T1CA61B87B69749A775EF2CA05B8863B0667A85067E6953F94CEEC0F0C02D739C2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 15KB
SHA256 ead676c583b20395a5a9a025064e64211b6ffd17106b2b87908e74855c033e46
MD5 e514db29ba978ce0f67b6df2531d3733
SHA1 58b740353d525c2d617fcfbd6a73fd286fa80ced
SHA512 de7340d8f954caec42cb4f098725373f5b139488e5560506d2ebb9b6c04143ecf3672edf2d0573c2a2aa51b8255f6c403d70602abf4cdf6d7462963e7b063144
SSDEEP 384:xw+aQikB+z/xvxjg/qhEwNBSPYZSC+HOQd9zK6:x/UxvxjgC+HquRFK6
TLSH
T1D8729F2B64686E37A5F7E6047D59078B9ABC88B291C229B48EEC1F0D17D73941302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 8dfa7a98f7e644019f9b9dfd66465f174a6c7f8626bbf3603ab94cd28d7b8e59
MD5 c5c41c0edf90f40705394a0834f4e253
SHA1 9026c206988bbaef60b28b0f2fbd83116e547a4d
SHA512 cc2c13a193f42e1cb5179b60d625293842409c81f0ef664184aeed776f9b64b7a30d10f3f63b3ae24e30d68dc3694cf0241a2f64dabc22201d182e5eb6b74d86
TLSH
T16F51927379148BB7AAE2874979473A539A3850A5DB622F509EEC0B0C42E766C2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58e71f.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe58e71f.TMP
Size 1KB
SHA256 e2f8348cfccb8c0879a75d12ec7702ea4356bd17daad9585fec455f19cc7103b
MD5 c740f9e32eb1bc5307b5b13bd583d719
SHA1 c5f0e65ea68a7c34e4a40a2d0fd01ac34895d05d
SHA512 739c55f9938c14adecb134a008163cccb669ab66f3c0eab3431c38fd9b3548a54c4fd1ce9f07c62c28285d907bbafe9a7c0c65d7abecb72b4dedcd56d05a8cde
TLSH
T1A72165F7E5A44B72BED5564A7152A6972E34109AC3544E009ADC0B0D53E315CB76FC33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a6ec5a730bc4675ae1f410a913b863a6229f617669294301f54d22704bb88fbb
MD5 4661e30847e4ba239399596336ebf5bc
SHA1 0313ac5188455889be72e57344e87622d6c3a621
SHA512 626b7b16c613283661184aadae635be890dedc60940ee67e15e5f1b24a43868ae648464135939545831a2ea82ceac1ac43928223786b7e08518baaeffe5fed62
TLSH
T15CD012127A555675C01020331412B1081800C30B87094400582CD91E5A0C0500902891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 32906fe6a1439733c24103e304b3f2eb02ee9101599febe56f55107f7acfe379
MD5 69c4a1572085bb9523609ff14463d14d
SHA1 94e9ba42a5ae1d6649c56d5f49eb235d40db473b
SHA512 f812bf182d568eecff4473c9cd8fccc6342c0c8f5067f20c8f721f3b116ad8b05ee3001ed500481f40ba9d9288e79d28c833ac7bea464f11c47128f1bd8a6ba9
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Local State
Size 2KB
SHA256 6d995e96af94e22bdf91a47e537d0ba5fc8019c8870a1d81263c5f5430141b19
MD5 900cac25c26b774c250ed90403630cda
SHA1 ee4dfea0da93575b893ff38fafefde85a8a2ea0a
SHA512 9d7ca2622157f3bc62aca2ed88f94958d1944c1bb54464fb195d2b91285c62d9e1bcf3482c55718d63cbe2c65cd7b84794532f23a168cdd77ea7e4b64d8068df
TLSH
T1F05155337825A73785F39705794B7B638A7D9065AB912F50EAEC0B0802F7A5D2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Local State
Size 3KB
SHA256 066faee0268aafd10f014c8ce15d7d5db2b297d1c00409ebe4e8a6a642559849
MD5 297eb92ae8f9ea7319d019b48b4080d1
SHA1 4265a427f054e89a4bb8e0bd576a186ddaf92b93
SHA512 429e177ce2ce6f0bb74456033a64dea824ebc014c89667a30c4ecd5e6c6dee875c0ea78b213012570c24f08636636b72595da5adf91546822cd55ad2aa231d7a
TLSH
T1466153376975AA374AF39A05798A371667A95027E6903F55DAEC0F0C02E778C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Local State
Size 3KB
SHA256 46d97d78a328f739f695f923a60c90969c019c3b1aef13d90fd3af1827c21977
MD5 0bcc519988a7a7a50734ff8663ba4c03
SHA1 7a9d33bc7ecc30e01ce1f7fa6da902bdaf0b8a72
SHA512 c07a5bfc9ef5841f3c9d685e66cb1be01b773dd9ae38575036aa7824da755cc0d084aae8c9d8bcd0296b357615f7a87c90f4629bf6d3622c1dd70a94c395e7de
TLSH
T1AB8173276975AA3749F3D605798A3B0766A95023E6C47F95DAFC0F0C02E778D1342823
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58c5eb.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{F8E14243-97FF-4AC0-8E3C-F166088A23DD}\wv2\EBWebView\Local State~RFe58c5eb.TMP
Size 1KB
SHA256 a1c1e86ef4b8ae9f023242c84f7b4898d2e7d71863d88e4123e92f5fc2cbf963
MD5 5a203fb2c42a8dafacbd9792cde2a984
SHA1 6bbc585a5c92cfdbddb244308b014a811c053988
SHA512 7cc6be4d1d33a835e48a4cce6c174404be04fac28317ee7b632ae5f6d8f45de101652d65b956a0d1f5e76bc4e7d294269cb183c3c72b969748cde6c87f52c649
TLSH
T1C8213FB3E4795B33A9926306314BB65B1E69906A93904F00A6EE0B1D03F764D6367833
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4044-107-0x00007FFA98D00000-0x00007FFA98D01000-memory.dmp

Download

memory/4660-30-0x00007FFA98D00000-0x00007FFA98D01000-memory.dmp

Download